PHP Security Issue: What Website Owners and WordPress Users Need to Know

This PHP security issue affects back-end websites and web development processes. Because it is invisible to many users, most people do not need to take action.

However, small businesses with websites—including sites built with WordPress—may be wondering how to protect themselves.

How to protect a website from the PHP security issue

If you own a website or manage the infrastructure that runs PHP, protect your site by updating to the latest version of PHP.

Ken Munro, an ethical hacker who has spent years identifying security flaws in computer systems, says installing security patches, known as patching, is “a bit like running Windows Update.”

If your website is managed by a hosting company or web developer, contact them and ask whether PHP security fixes have been applied. The fix must be applied to PHP itself; updating WordPress or its plugins will not resolve the issue.

If you manage your website yourself, “it’s your responsibility to make sure the fixes are applied,” Munro says.

The UK National Cyber Security Centre recommends that, if you cannot immediately apply updates or temporary protection, you consider taking your site temporarily offline.

Security advice for website owners and users

The National Security Agency also urged “increased awareness” in the coming weeks and advised the public to closely monitor updates from software vendors.

“Caution is of the utmost importance when applying patches related to these systems,” it said.

Although responsibility lies primarily with website operators, users should always follow security advice issued by affected services, such as requirements to change their passwords, Kanhire said.

He also warned people to be cautious of phishing messages that exploit publicity surrounding the incident.