Last updated: 9 November 2026
WordPress runs on PHP, and updating WordPress does not update PHP. Ask your host to confirm in writing that PHP is on a supported, patched version, then keep WordPress, plugins and themes updated, remove what you do not use, and back up before every change.
Who is responsible for what
| Layer | Examples | Normally patched by |
|---|---|---|
| PHP and server software | PHP 8.3 or 8.4, web server, operating system | Your hosting company or server administrator |
| WordPress core | WordPress 6.x | You, your developer or your IT provider |
| Plugins and themes | Page builders, forms, shop and SEO plugins | You, your developer or your IT provider |
| Unsupported PHP (8.1 and older) | No fixes from the PHP project | Move to a supported version |
Six ways to tighten the risk
1. Name an owner
Ask your host or developer: which PHP version do we run, who applies emergency updates, and how will they prove it? One named person should be accountable.
2. Run a supported PHP version
Ask your host to move you off PHP 8.1 and older, and plan ahead for 8.2 ending on 31 December 2026. Test forms, logins and checkout after any change.
3. Keep WordPress, plugins and themes current
Turn on automatic updates where safe, and review the rest weekly. Delete plugins and themes you no longer use, because inactive code can still be attacked.
4. Lock down logins
Use multi-factor authentication and named admin accounts, remove old users, and limit login attempts. Stolen logins are an easier way in than most code flaws.
5. Back up and test the restore
Keep backups off the web server and prove you can restore them. Take a fresh one before every update.
6. Watch for signs of compromise
Review logs and look for unexpected files, unfamiliar admin users or unusual traffic. A patch closes the door but does not show whether anyone has already walked through it.
Ask your host these questions
- Which PHP version is our site running today?
- Have the October 2026 PHP security fixes been applied, and can you confirm in writing?
- Do you patch PHP automatically, and how quickly after a release?
- Can you provide logs, and tell us if anything suspicious was found?
- What is our upgrade plan before PHP 8.2 reaches end of life?
Why speed matters
When a patch is published, the vulnerability details usually become public too, and automated scanning for unpatched systems tends to begin quickly. Our PHP security alert explains the October 2026 release. Cyber Essentials expects critical and high-risk updates within 14 days, and a vulnerability assessment shows what is exposed before an attacker finds it.
How ABCOM helps
We check which PHP versions your sites use, coordinate fixes with your host or developer, and include website patching in our managed IT plans.
Quick answers
Does updating WordPress fix a PHP vulnerability?
No. WordPress, themes and plugins sit on top of PHP. The PHP fix is applied at server level, normally by your hosting company.
How do I find out which PHP version my site uses?
In the WordPress dashboard go to Tools, Site Health, Info, Server. That shows what is running today, but not whether your host will patch it or when.
Do I need to take my website offline?
Not usually. Patch as soon as the fix is available. The NCSC advises considering taking a system offline only if it cannot be updated or otherwise mitigated promptly.
What if I do not know who looks after my website?
Establish that today by checking hosting invoices, the domain registrar and the original developer contract. An unowned website is a risk in itself.
Is a security plugin enough?
No. A security plugin helps with logins and known threats, but it cannot replace patching PHP itself. Treat it as one layer, not the fix.
Not sure who looks after your website’s PHP? Book a free 20-minute call.
Related answers and guides
- How often should we patch, and what does the 14-day rule mean?
- What happens when software reaches end of life?
- How do we protect our website, domain and ad accounts?
- Critical PHP security alert
- Vulnerability assessment
- All ABCOM FAQs
Sources and further reading
Related questions
Want this sorted for you?
Talk to our Burgess Hill team about cyber security services. Free, friendly and no obligation.