Is your WordPress site safe? Seven checks after October's PHP flaws
Published · 5 min read
On 21 October the Dutch government took MijnOverheid and DigiD offline as a precaution, after two critical flaws were found in PHP. WordPress runs on that same PHP, and with it a large share of small business websites. Time to check your own.
What happened
PHP is the programming language WordPress, Joomla and WooCommerce shops run on. In late October two serious flaws were found in it. Many organisations took their sites offline for a while until their servers were updated. The good news: a fix came quickly. The bad news: it only helps if someone actually installs it.
1. Does your site run on a PHP version that still gets updates?
Log in to your hosting provider or simply ask them. Each PHP version gets security updates for a few years, and then stops. If your site runs on a version that no longer gets updates, every new flaw stays open. Also ask whether the latest security update for your version has been installed.
2. Is WordPress itself up to date?
Check Updates in your dashboard. WordPress usually installs small security updates on its own, but not always the big versions. If an update is waiting, make a backup first, then install it.
3. Clean up your plugins and themes
Every plugin is someone else’s code on your site. Outdated plugins are one of the most common ways WordPress sites get hacked. Update everything, and delete what you don’t use: a deactivated plugin that’s still on the server can still be a risk. The same goes for old themes.
4. Do you have a backup that isn’t on the same server?
A backup on the same server as your site is gone the moment that server is the problem. Set up an automatic backup stored somewhere else, and try once whether you can actually restore it. An untested backup is a hope, not a plan.
5. Who can log in?
- Remove accounts for former staff, interns and your previous web builder.
- Don’t give everyone admin rights: an editor doesn’t need to install plugins.
- Use a long, unique password and turn on two-step verification for every admin account.
6. Do you know who’s responsible?
Many business owners assume their host or their web builder does the updates, when nobody ever agreed to it. Hosting usually just means the server runs, not that your WordPress and plugins are kept up to date. Look up what your contract says. If it isn’t in there, probably nobody is doing it.
7. Does your site need WordPress at all?
For a shop, or a site you post to every week yourself, a CMS like WordPress is often a fine choice, as long as someone maintains it. But many small business sites change a few times a year. Those can do without a database, without PHP and without plugins: a static site simply has less that can leak. That’s how we build ours, and it’s why this flaw didn’t touch them.
Rather not think about it?
On a site we build, hosting, domain and updates are covered by the Care plan at €49 a month; the details are on our services page. Unsure about your current WordPress site? Send us a message. We’ll tell you honestly whether updating is enough, or whether a rebuild makes more sense.