Is my website secure? 3 emails to send your web designer

Is my website secure, and why should I ask my web designer about PHP now?

On October 21, 2026, the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which "fix two critical vulnerabilities that can allow unauthenticated remote code execution."¹ In plain words: a stranger could make an unpatched server run their own code. The issue became known as PHP2Shell.

The fix lives on the server, not in WordPress. Malwarebytes put it simply: "Updating WordPress or its plugins is not the same as updating PHP."² Newsweek noted that the responsibility to fix it "falls on website operators, hosting providers and organizations running affected PHP installations."³ That's your web designer or your host, so the way to find out is to ask them.

Asking is not an accusation. The Federal Trade Commission's advice to small businesses lists exactly this question for a web host:⁴

Will you keep software updated? If it's my responsibility, how do I do that? — Federal Trade Commission, "Cybersecurity for small business: Hiring a web host"

And there's no need to panic. As of October 23, CISA said it "has not observed successful exploitation of these vulnerabilities in the wild."⁵ Cloudflare, meanwhile, said it had "observed attack traffic targeting our customers."⁶ Calm, but not careless, is the right speed.

Jeensuk's takeMost owners who ask will hear "already done." Asking is how you get to hear it.

Who is responsible for my website's security: my web designer or my host?

Usually both, in layers. Your host runs the server. Your web designer often holds the hosting account and the WordPress login.

Start with the designer who built the site. Even Bluehost's own help pages say "The developer who initially built your site is likely to have the expertise needed to address the issue promptly and effectively."⁷

There's a practical reason too. Bluehost's contact page lists phone and chat, not a support email, and asks callers to have the account details ready.⁸ If the account is in your designer's name, the host may not be able to answer you directly. So email the designer first, and keep the host script in section 04 for later.

It matters to check with outside partners. Verizon's 2026 figures for small businesses say breaches with third-party involvement "now account for 48% of all breaches," and exploiting a vulnerability was the first step in 31% of them.⁹

Jeensuk's takeAsk in this order: the designer who built it, then the host who runs it. Don't skip straight to the host.

What exactly should I email my web designer?

Send three short emails, one question each, or put all three questions in one email if you prefer. Short works: Boomerang's study of millions of emails found the sweet spot is "between 50-125 words," and emails that ask "1-3 questions are 50% more likely to get a response."¹⁰ Replace the names in brackets and send.

Why email 2 asks about the fix and not only the version: Kinsta points out that "The PHP version displayed doesn't necessarily indicate whether a security patch has been applied," because some hosts add security fixes without changing the version number.¹¹ Malwarebytes advises owners to ask providers to "confirm PHP fixes are installed, not just scheduled."²

Why email 3 matters: host backups are often thinner than people think. Bluehost's automatic backup "runs once a week on a random day, and each run overwrites any previous backups. Only one week of backups is kept at a time." Bluehost also calls the service a "courtesy."¹² Other hosts keep more. SiteGround keeps "up to 30 daily backup copies" on shared hosting.¹³ WordPress's own guidance says a backup has two parts, "Database and Files," and should always be made before an upgrade.¹⁴

Jeensuk's takeEmail leaves a written record. Months from now, "who said they'd update PHP" won't be a matter of memory.

What should I say if I call or chat with my web host?

If your designer doesn't reply, or the hosting account is in your name, contact the host directly. Read these three sentences in the chat window or over the phone.

If the host says the account belongs to someone else, that's useful too. It tells you who holds your keys, and that's worth sorting out. Our article on the five website keys every business owner should hold walks through it.

Jeensuk's take"Whose name is the account in?" is a security question too. The answer decides who can fix things in a hurry.

How do I read the replies I get back?

Sort each reply into one of three boxes. You don't need to understand every word, only which box it falls in.

A lower version number with "the fix is applied" can still be fine, for the reason in section 03. When in doubt, ask for the date the fix was applied.

Jeensuk's takeThree boxes, not thirty terms. If you can sort the reply, you've done your part.

What if I get no reply, or a vague one?

Give it two business days, then pick up the phone. People who ignore email often answer a call. If the reply is just "it's fine," send email 2 again and ask for the date.

Watch out for the opposite problem too. UHY, a US accounting and advisory firm, warns about phishing messages that use an "urgent PHP update" as bait.¹⁶ If an email you didn't ask for urges you to log in or pay for a PHP fix, don't click. Contact your designer or host the way you normally do.

If your designer has stopped answering altogether, read "Lost touch with your web developer? Get your site back". If your host sent you its own PHP notice, "Got a PHP email from your web host? How to read it" explains the wording.

Jeensuk's takeA vague answer isn't a bad answer yet. It's a reason to ask one more, more specific, question.