# Secure a WordPress or PHP site: 10 things to check | Fokuus [Home](https://fokuus.be/en/) [Blog](https://fokuus.be/en/blog/) Secure a WordPress or PHP site: 10 things to check # Secure a WordPress or PHP site: 10 things to check Secure a WordPress or PHP site: ten points, from a supported PHP version to an emergency plan, and who does each: you, your web developer or your host. [Anton Pycarelle](https://fokuus.be/en/about/) 22 October 20267 min read time ## In this article - [First, the agreement](https://fokuus.be/#eerst-de-afspraak) - [What your web developer does](https://fokuus.be/#wat-je-webbouwer-doet) - [What your host does](https://fokuus.be/#wat-je-host-doet) - [What is up to you](https://fokuus.be/#wat-bij-jou-ligt) - [Only got an hour?](https://fokuus.be/#heb-je-maar-een-uur) Who presses the update button for your site if a flaw turns up in PHP, WordPress or one of your plugins tomorrow? The answer differs per layer, which is why this list organises ten points by who does them: your web developer, your host or you. As for the October 2026 flaw itself: [what happened back then](https://fokuus.be/en/blog/php2shell-php-lek/) and [how to check whether your site was affected](https://fokuus.be/en/blog/website-getroffen-php-lek/) are covered in separate articles. This one is about what you put in place for the long term. Who does what differs per contract. That is why point 1 is at the top. With a static site, without PHP on the server, points 2, 3, 4 and 6 largely fall away. I explained which sites are better off that way in [how much maintenance your website really needs](https://fokuus.be/en/blog/website-onderhoud-hoeveel-nodig/) . ## First, the agreement ### 1. Who presses the update button? A WordPress site has three layers that receive updates: PHP on the server, WordPress core, and the plugins and themes. With ordinary shared hosting, the host installs the PHP patches, but it usually doesn't update your plugins. So send one email to your web developer and your host: Who installs the updates for PHP, WordPress and the plugins on our site? How quickly does that happen in the case of a critical flaw? And how can I see that it has happened? For the sites we maintain, our time tracking answers that last question for the work we do: the client can see what work was done and how much time it took ([hosting and maintenance](https://fokuus.be/en/hosting-onderhoud/) ). ## What your web developer does ### 2. A PHP version that still gets security updates Each PHP version gets two years of active support, followed by two additional years of support for critical security issues only ([php.net](https://www.php.net/supported-versions.php) , accessed on 22 October 2026): PHP version Security updates until 8.5 31 December 2029 8.4 31 December 2028 8.3 31 December 2027 8.2 31 December 2026 8.1 and older none If you run a version without updates, every fix depends on your vendor, your host or your Linux distribution, as is also pointed out by [php.net](https://www.php.net/archive/2026.php#2026-10-21-5) . Ask your host if and when it updated, and for how long it will keep doing so for your version. WordPress itself says [PHP 8.3 or higher](https://wordpress.org/about/requirements/) is recommended. Your host installs the patches within your version. On shared hosting, you can usually switch to a newer version yourself in the control panel; testing is work for your web developer. An old theme or an outdated plugin can break in the process, so update those first, then switch, then check your forms. With us, such a switch works like any other change: agree the work and price in advance, carry it out, and check that everything works as agreed. ### 3. Let WordPress core update itself Open Dashboard > Updates in WordPress. If it says "This site will not receive automatic updates for new versions of WordPress", ask who does that work instead. If it says "This site is automatically kept up to date with ...", then at least the automatic security updates are on. Automatic updates have existed since WordPress 3.7; since 5.6, new installations also get the major versions by default. You can switch off the automatic maintenance and security updates, but according to [the documentation](https://developer.wordpress.org/advanced-administration/upgrade/upgrading/) the developers strongly advise against it. ### 4. Update plugins, and get rid of what you don't use On plugins, the [WordPress security guide](https://developer.wordpress.org/advanced-administration/security/hardening/) is brief: keep them updated, and remove any plugin you don't use. Just deactivating it is not enough, because the code stays on your server. For a free plugin, look it up on wordpress.org: under "Last updated" you see when the maker last worked on it, and under "Tested up to" which WordPress version it was tested with. A plugin that has been dormant for years is best replaced. Since WordPress 5.5, you can switch on automatic updates per plugin; by default WordPress runs them twice a day and emails what was updated ([documentation](https://wordpress.org/documentation/article/plugins-themes-auto-updates/) ). My advice: decide per plugin deliberately, and write down who updates the others by hand. ## What your host does ### 5. Backups that have been restored at least once Ask whoever makes your backups three questions. Are both the database and the files included? You need both to restore a WordPress site completely. Are there copies in more than one place? The [WordPress documentation](https://developer.wordpress.org/advanced-administration/security/backup/) recommends three to five recent backups in different locations; a copy in the same hosting account is within reach of whoever breaks into that account. And when was one last restored? That same documentation also says to check your automatic backups every now and then with a manual one. ### 6. A firewall in front of your site, as an extra layer A web application firewall blocks suspicious requests to your site. It exists as a plugin, on the web server, or as a service that you put in front of your hosting via your DNS ([WordPress](https://developer.wordpress.org/advanced-administration/security/hardening/) ). Which form you have makes a difference. A firewall plugin that filters inside WordPress runs in PHP itself and only starts while WordPress is loading. With the October 2026 PHP flaw, an attack on mod_php could, according to php.net, start before any application code ran; a plugin like that does not help there. A firewall at your host or in front of your site can intercept known attack patterns before they reach PHP, but it does not replace the update: according to php.net, updating is the only safe choice. Ask your host what is already active in your package. ## What is up to you ### 7. One account per person, with a second lock If an employee who knew the password of a shared administrator account leaves, everyone gets a new password. With a separate account per person, you simply delete that one. Give nobody more permissions than needed, and don't choose "admin" or "webmaster" as a username; WordPress advises against that too. For two-factor verification, WordPress points to plugins from the official plugin directory, such as Two-Factor. Choose an authenticator app as the second step. As [the WordPress documentation](https://developer.wordpress.org/advanced-administration/security/mfa/) points out, SMS is not a secure channel, and [Safeonweb@work](https://atwork.safeonweb.be/nl/news/bescherm-accounts-met-multifactorauthenticatie) , from the Centre for Cybersecurity Belgium, calls it the least secure option. ### 8. Domain, DNS and email in your company's name Whoever gets into your mailbox can reset the password of almost any other account. Whoever gets into your registrar can point your domain name to a different server, with your email included. Besides your email, Safeonweb@work also names the management of your DNS and of your hosting provider as examples of access for which you should make two-factor verification mandatory. Put those accounts in your company's name, with an email address that you read. You can look up who currently holds your domain name as described in [our article on hosting](https://fokuus.be/en/blog/wat-is-hosting/) . For .be domains there is also Domain Guard: your registrar then cannot change, transfer or delete anything about your domain name unless DNS Belgium first calls someone you designated. Not every registrar offers it; you ask the registrar for the price ([DNS Belgium](https://www.dnsbelgium.be/nl/beveiligen/domain-guard) ). ### 9. Search Console as an alarm Google Search Console is free and emails you, as a verified owner, when Google suspects that your site has been hacked ([Google](https://support.google.com/webmasters/answer/6347750?hl=nl) ). If someone adds themselves as an owner, all existing owners receive a notification ([Google](https://support.google.com/webmasters/answer/7281924?hl=nl) ). Do check which address those notifications go to: according to Google, some hackers change that setting to stop you from receiving messages. Put in an address that you read, not just your web developer's. ### 10. An emergency plan on one sheet If your site gets hacked, you don't want to start by looking up who to call. Put this on one sheet, kept outside your site and your mailbox: - your web developer and your host, with phone and customer numbers; - where the logins are kept, preferably in a password manager that a colleague can also access; - where the latest backup is and who restores it; - who decides to take the site offline temporarily. For the sites we manage, it is agreed in advance through which channels we can be reached and which arrangements, if any, apply in the event of an incident. Ask whoever manages your site about this too. If your site stores requests from your contact form and those leak, you report it without undue delay and, where feasible, no later than 72 hours after you became aware of it, via the notification portal of the [Belgian Data Protection Authority (GBA)](https://www.gegevensbeschermingsautoriteit.be/professioneel/acties/gegevensinbreuk) . That is not required if the breach is unlikely to pose a risk to the individuals concerned. ## Only got an hour? Then do these three, without a web developer. First send the email from point 1. Then turn on two-factor verification on your mailbox, your hosting account and your registrar, the mailbox first, because that is how you reset the rest. Finally, check who is listed as an owner in Search Console and which address the notifications go to. The other seven you plan with whoever replies to that email. If you would rather have us go through the ten points, that is ad hoc work at 80 euros per hour excl. VAT. Website security WordPress Website maintenance Hosting Share [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffokuus.be%2Fen%2Fblog%2Fphp-wordpress-site-beveiligen%2F) [DotsApp](https://wa.me/?text=WordPress-%20of%20PHP-site%20beveiligen%3A%2010%20dingen%20om%20op%20te%20letten%20https%3A%2F%2Ffokuus.be%2Fblog%2Fphp-wordpress-site-beveiligen%2F) [Email](mailto:?subject=WordPress-%20of%20PHP-site%20beveiligen%3A%2010%20dingen%20om%20op%20te%20letten&body=https%3A%2F%2Ffokuus.be%2Fblog%2Fphp-wordpress-site-beveiligen%2F) ## Get Fokuus updates. New articles and Fokuus's updates in your mailbox. You can unsubscribe at any time. ## Anton Pycarelle Founder of Fokuus Anton builds and optimizes websites for Belgian SMEs from Kortrijk. He writes about choices and experiences from real projects. [More about Fokuus](https://fokuus.be/en/about/) ## Keep reading. [All articles](https://fokuus.be/en/blog/) Maintenance & Technique · 6 min reading time ### PHP2Shell: what the PHP flaw means for your website PHP2Shell: two critical vulnerabilities in PHP, the language WordPress runs on. What happened hour by hour, who saw exploitation and which versions contain the fix. [Maintenance & Technique · 6 min reading timePHP2Shell: what the PHP flaw means for your websitePHP2Shell: two critical vulnerabilities in PHP, the language WordPress runs on. What happened hour by hour, who saw exploitation and which versions contain the fix.](https://fokuus.be/en/blog/php2shell-php-lek/) Maintenance & Technique · 7 min reading time ### Is my website affected by the PHP flaw? How to check Does the October 2026 PHP flaw affect your website? Five steps to check whether your site runs on PHP, which version, whether your host has already patched and whether there are traces of an attack. [Maintenance & Technique · 7 min reading timeIs my website affected by the PHP flaw? How to checkDoes the October 2026 PHP flaw affect your website? Five steps to check whether your site runs on PHP, which version, whether your host has already patched and whether there are traces of an attack.](https://fokuus.be/en/blog/website-getroffen-php-lek/) [Bron](https://fokuus.be/en/blog/php-wordpress-site-beveiligen/) · [Agentdocumentatie](https://fokuus.be/developers/)