Your WordPress dashboard may say everything is up to date. That is useful, but it is not the whole picture. The software running underneath your website needs attention too, and responsibility for it may sit with your hosting provider rather than the person who updates your pages.
Why contact your host now?
On 21 October, the NCSC urged urgent PHP updates, prioritising public-facing systems. For a business website, this is a reason to ask a specific question today, not wait for the next routine review.
WordPress explains that PHP runs beneath the site and its version is managed through the hosting provider. Think of PHP as part of the engine: changing a page or updating a plugin is a different job from maintaining that engine.
PHP’s own follow-up on 23 October adds configuration advice; ask your host to review both notices. You do not need to learn coding or change server settings yourself.
Ask for confirmation, not just a version number
A dashboard message about WordPress, themes or plugins does not confirm the position of the underlying hosting software. Equally, a PHP version number alone is not enough to establish whether a provider has applied security fixes to its own supported package.
Ask the host to confirm what applies to your account and what action it has taken. If an agency manages the relationship, give one named person responsibility for obtaining the answer. Forwarding a warning around the office without an owner can leave everyone assuming somebody else has dealt with it.
Not sure who hosts the site? Check the hosting invoice or ask the person who arranged the website. The company that registered your domain name may not be the host. Establish the right contact first, then keep the conversation in one place.
A question you can copy
“Please confirm whether our website’s PHP is covered by the latest security fixes and the follow-up guidance dated 23 October 2026. If action remains, who owns it, when will it happen, and how will you check our website afterwards?”
A practical checklist for the work
- Contact your hosting provider promptly. Include your website address, but do not send passwords by email. Ask for a written answer about your specific hosting account.
- Confirm there is a recent, recoverable backup and that somebody knows how to restore it. A backup is a recovery option, not a substitute for urgent action.
- Ask the host or developer to manage compatibility checks alongside the security work. Do not turn a lengthy testing exercise into an open-ended reason to delay an urgent fix.
- Afterwards, check the tasks visitors actually use: send a test enquiry, complete a booking if applicable, and check that the right person receives the notification.
- Keep the host’s confirmation and record who maintains WordPress, plugins, themes and hosting software. These may be different people; make the boundaries explicit.
If the answer is unclear
Ask for a named technical contact and a clear next step rather than accepting “everything is fine”. If a prompt fix is not possible, seek qualified help on the safest interim approach. Do not improvise changes to unfamiliar hosting controls.
This alert concerns PHP generally; it is not evidence that your particular website is vulnerable or has been accessed. Updating software also does not establish whether an earlier compromise occurred. If you notice unexpected changes, preserve the details and ask a qualified specialist to investigate separately.
The useful outcome is straightforward: a clear answer, an accountable owner and a website whose essential functions have been checked. Start with that host enquiry today.
