A plumbing or HVAC company can have a busy schedule and still depend on a website nobody on the team knows how to maintain. The PHP2Shell security disclosure makes that gap worth fixing now.
My recommendation for contractors using WordPress is straightforward: ask the hosting provider to confirm that the PHP security fix is active on the live site, then test the paths customers use to call and request service. Updating WordPress alone does not address this issue. A working homepage does not establish that the server is patched.
This guidance reflects the public information available on October 22, 2026. The technical repair belongs with the host or a qualified administrator. The owner’s job is to make sure someone accepts responsibility and confirms completion.
What PHP2Shell means for a WordPress website
PHP2Shell refers to two critical vulnerabilities in PHP, the software that runs WordPress on the server. Under affected conditions, an attacker can execute code without logging in. The PHP Foundation’s October 21 explanation describes flaws in memory management and error handling, below the WordPress application itself.
That distinction matters to a business owner. A website maintenance report showing updated plugins can be accurate while leaving the underlying PHP question unanswered. I would ask for separate confirmation of the server-side fix.
Wiz’s published research demonstrated attacks against WordPress and other applications. Those demonstrations establish a serious vulnerability; they do not prove that a particular contractor’s website has been compromised. I would avoid treating a headline as a diagnosis of an individual business.
Four checks make the response manageable:
- Confirm which provider manages PHP for the live website.
- Obtain confirmation that the relevant security fix is running.
- Have the website manager test customer contact and booking functions.
- Assign a person to handle unresolved exposure or signs of compromise.
Ask the host for evidence tied to the live site
The hosting provider should identify the PHP build serving the actual website and confirm that it includes the fix. A general message saying that security is taken seriously does not answer that question.
The PHP project’s October 21 advisory lists fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It also explains that some operating-system distributors and long-term support vendors supply backported fixes. An older-looking version number therefore needs a provider explanation, rather than an automatic verdict.
I would send the host the site address and ask for written confirmation covering the live environment, the installed fix, and any remaining action. If several websites or landing-page subdomains run on separate hosting accounts, include each one. Patching a staging copy does not establish the status of production.
WordPress.com and a separately hosted WordPress installation also have different operators. Automattic said on October 21 that its WordPress.com, WordPress VIP, WP Cloud, Pressable and Tumblr platforms were protected. That statement applies to those platforms. Another hosting company needs to answer for its own environment.
Keep temporary protection separate from the completed fix
A temporary protection measure can reduce exposure without completing the repair. PHP’s advisory says an update is the complete solution and explains that the listed mitigations cover specific attack paths.
I would leave server settings to the administrator. Copying emergency configuration advice into a live contractor website can introduce another problem if nobody checks what the site depends on. File uploads, estimate forms and other functions may need particular handling.
If the host cannot complete the update immediately, ask what protection is active, what remains exposed, who owns the next step and when they will provide another status update. A dated answer is more useful than a support ticket left open without an owner.
For broader website and discoverability concerns after the security issue is handled, Revved’s SEO audit can help assess search visibility. It should not be treated as proof that a server has received this security patch.
Test the route into the office after the update
A completed patch should be followed by a practical check of the website’s customer functions. I want the office to receive a usable service request, not merely see that the website loads.
Consider a hypothetical roofing company whose estimate form accepts property photos. After the host changes PHP or applies temporary restrictions, the website manager should submit a clearly labeled test request with a permitted photo. The office should confirm receipt, readable contact details and the attachment. This is a proposed acceptance test, not a claim that the update breaks roofing forms.
For a plumbing company, I would also test the mobile phone link and check that it reaches the expected number. If the website uses online booking, complete a permitted test through to the office’s normal system, then remove the test appointment so it cannot consume a real slot.
The principle is the same as routing contractor website forms to a responsible person: a customer action needs to arrive somewhere the team can act on it.
I would record the test time and mark test inquiries clearly. Otherwise, a maintenance check can enter the marketing report as a real lead. The distinction between a recorded event and a booked job also matters when measuring contractor marketing outcomes.
Make advertising decisions from the site’s actual condition
Advertising changes should follow verified website conditions. The disclosure alone does not establish that every WordPress business needs to stop its campaigns or replace its website.
If a destination is unavailable, visibly altered or failing to accept requests, I would review the affected campaigns with the website manager immediately. Continuing to send prospects into a confirmed broken path creates avoidable waste. Where a verified alternative contact route exists, the team can assess whether it is appropriate while repairs continue.
If the host confirms the patch and the contact tests pass, I would keep monitoring through the normal operating process. Suspected compromise needs a separate investigation by a qualified security professional. Installing an update should not be represented as evidence that earlier unauthorized changes never happened.
My next step would be to put the host’s confirmation and the contact-test results in one place, with a named person responsible for any open item. For an established contractor that needs clearer ownership across its website, advertising and lead handling, book a growth call to review how those responsibilities fit together.
