This week governments, hospitals and big companies took websites offline to avoid being hacked. The cause is two serious flaws in PHP. That’s the software running quietly behind most websites, including every WordPress site. Attackers can use them to take over a website, and they’re already trying. The fix is out. But it only protects you once it’s been applied. If your firm’s website runs on WordPress, here’s what to do this week: - Find out who hosts your site (your web designer will know) - Ask your host to confirm your site has had this week’s PHP security update - If you’re on an old version of PHP (8.1 or earlier), ask to upgrade... those won’t be fixed - Make sure you have a recent backup first - Update WordPress, your plugins and your theme - Remove any plugins or old sites you no longer use If you’re on Squarespace, Wix or similar, the platform looks after this for you. Not sure what to say to your host? Ask ChatGPT or Claude to write the email for you. Mention “this week’s PHP vulnerabilities” and ask them to confirm your site is patched. Most firms I speak to don’t know what their website is built on. Do you? 👇