Reliable website security and maintenance is no longer a nice extra. In October 2026 researchers found two critical flaws in PHP itself, and any site on an unpatched version carries the risk. This page explains exactly what I take care of for clients, step by step, so you know who is watching your server when the next one lands.
Why website security and maintenance matters now
Most hacked sites are not targeted personally. Instead, attackers scan the internet for known weaknesses and hit whatever answers. In fact, a site that is a few weeks behind on updates is an easy target, and a site on an end-of-life PHP version is easier still.
Good website security and maintenance closes those gaps before attackers can use them. It also keeps the site fast, backed up and easy to restore, which protects your leads, your sales and your search rankings.
The two new PHP security threats I handle
On 21 October 2026 the PHP project released emergency fixes for CVE-2026-109618 and CVE-2026-109619, together nicknamed PHP2Shell. Both score 9.2 (CVSS v4.0) and can allow remote code execution without a login. The flaws are in PHP, not WordPress, so a plugin update will not fix them. Read the full breakdown in my guide to the latest PHP security threats. For the technical detail, see the analysis by Datadog Security Labs.
CVE-2026-109618: out-of-memory corruption
A failed memory allocation can leave invalid data that PHP processes during cleanup. As a result, a crafted request can turn that into code execution before your application even starts.
CVE-2026-109619: session upload progress handling
A second flaw linked to session upload progress handling that can run before a request is fully set up. However, it needs its own mitigation, and patching is the only full fix.
So, here is what I do for client sites the moment a threat like this goes public:
- Version audit: I check the PHP version on every site and server, including the command line and the web server, since they can differ.
- Host confirmation: I get written confirmation that the host has applied the fix, or I install the patched PHP packages myself on servers I manage.
- Fixed-version targets: sites move to PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer.
- Interim hardening: where the host delays a patch, I turn off
session.upload_progress.enabled, tightenpost_max_sizeand set request-size limits at the web server. This is a bridge, not a cure. - Firewall check: I confirm that Cloudflare or other web application firewall rules are set to block rather than just log.
- Log review: I look for oversized POST requests, memory exhaustion errors and PHP spawning unexpected shell processes.
- File integrity scan: I compare WordPress core, plugins and themes with clean copies and check uploads and cache folders for stray PHP files.
- Fresh backup: I take a verified backup before and after every change.
- Written report: you receive a short summary of what was found, what was changed and what is still open.
What website security and maintenance covers
| Area | What I do | Typical frequency |
|---|---|---|
| PHP patching | Version audit, host confirmation, upgrades, emergency response to critical CVEs | On release and monthly |
| WordPress updates | Core, plugin and theme updates tested on staging first | Weekly or monthly |
| Backups | Off-server backups with a restore test | Daily, restore test quarterly |
| Malware and integrity scans | File comparison, suspicious code and admin user checks | Weekly |
| Hardening | Login protection, file permissions, XML-RPC and admin review, security headers | At setup, reviewed quarterly |
| Uptime and speed | Uptime checks, caching review, database clean-up | Continuous and monthly |
| Reporting | Plain-English summary of work and open risks | Monthly |
Overall, these frequencies are the usual starting point. We agree the exact schedule for your site before work begins.
How website security and maintenance works
- Initial review: I review your PHP version, plugins, host and backup setup.
- Fix the urgent items: critical updates, missing backups and exposed settings come first.
- Staging and testing: I test every change on a copy before it reaches the live site.
- Ongoing care: scheduled updates, scans and monitoring.
- Reporting: a short written report so you always know the state of the site.
PHP upgrades as part of website security and maintenance
Running an old PHP branch is one of the biggest silent risks in website security and maintenance. For example, PHP 8.1 and older no longer receive fixes from the PHP project. To fix that, I move those sites to a supported version by cloning the site to staging, testing every plugin, theme and custom snippet, fixing deprecated code, and only then switching the live site. Finally, if a plugin has no maintainer any more, I recommend a replacement.
WordPress care inside website security and maintenance
- I apply updates in a safe order and check key pages, forms and checkout flows.
- Additionally, I keep backups away from the web server and test a restore, so you know they work.
- I also review admin accounts, user roles and unused plugins to keep the attack surface small.
- Also, uptime checks alert me when the site goes down, so I can act quickly.
- Finally, caching and database clean-up keep the site fast, which helps Core Web Vitals and SEO.
Malware cleanup and hack recovery
Unfortunately, even careful sites can get hit. If I find a compromise, I first save the current state, contain the problem, clean or restore the site from a known good backup, remove the entry point, reset passwords and keys, and then explain what happened in plain language. For deeper investigations, see my WordPress security consultant page.
What this service is not
To be clear, I would rather not oversell. Overall, this is hands-on work by one experienced developer, not a 24/7 security operations centre, and I do not offer a hack-proof guarantee. Instead, you get careful, documented work, quick action on published critical threats, and a person who knows your site.
Who needs website security and maintenance
- Business owners with a WordPress or WooCommerce site who do not want to manage updates.
- Agencies that need a reliable maintenance partner for client sites.
- Anyone running an older PHP version who needs a safe upgrade path.
- Sites that suffered a hack before and need to stay clean.
What affects the cost of website maintenance
Every site is different, so I quote after an initial review instead of publishing fixed prices. The main factors are:
- How many sites you run, and how complex they are.
- The number of plugins and any custom code.
- Whether you run WooCommerce or take payments.
- Your hosting setup and current PHP version.
- How often you want updates, scans and reports.
For a realistic quote, send me your site details and I will reply with what your site needs.
FAQ: website security and maintenance
What does your website security and maintenance service include?
In short, it covers PHP version and patch checks, WordPress core, plugin and theme updates, backups, malware and file integrity scans, log review, uptime checks and a short written report after each cycle.
Do you handle new PHP security threats like PHP2Shell?
Yes. When a critical PHP flaw goes public, I first audit every site I look after, confirm the host patch, apply interim hardening if needed, and review logs for exploit signs. Clients get a short report.
Can you upgrade my site from PHP 8.1 or older?
Yes. First, I clone the site to staging, test themes, plugins and custom code on a supported PHP version, fix what breaks, and only then switch production.
Is this a 24/7 security operations service?
No. Instead, it is hands-on maintenance and security work by one developer, with scheduled checks and fast response to published critical threats. I do not sell a hack-proof guarantee, and no honest provider can.
What if my site is already hacked?
Contact me straight away. First, I take a backup of the current state. Then I contain the issue, clean or restore the site, close the entry point and report what I found.
How much does website security and maintenance cost?
It depends on the number of sites, plugins, hosting and how often you want updates and scans. I quote after an initial review of your site, so you pay for what the site actually needs.
Get started with website security and maintenance
Not sure where your site stands after the PHP2Shell disclosure? Contact me for a first look at your PHP version, plugins and backups. You can also browse my other WordPress services, such as the WordPress performance consultant for speed work, the WooCommerce developer service for stores, or the WordPress security consultant for a deeper review.