
Website Design for Australian Small Business (2026)
What a small business website costs in Australia in 2026, with real published prices, plus .com.au rules, GST, hosting, privacy and a hiring checklist.
Website Security
After the PHP security fixes of 21 October 2026, many site owners cannot update PHP themselves and are looking for help. This guide shows when hiring makes sense, what a safe job contains, which signs should make you walk away, and what to ask. Sources read 22 October 2026.
Not always. Match your situation to the right route first.
| Your situation | Best first move |
|---|---|
| Your host shows a PHP switch and you are comfortable with backups | Do it yourself, using our guide to updating PHP on WordPress |
| Your host runs everything for you (managed hosting) | Ask the host for written confirmation, as covered in who patches PHP |
| You run a shop or take bookings | Hire, because a broken checkout costs more than the fee |
| You do not know your PHP version, or it looks like 7.x | Hire, since old PHP often means old plugins as well |
| You manage client sites as an agency | Hire or partner, because several sites at once is a scheduling problem |
The news behind all this is covered in our main PHP guide: two critical flaws, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, per php.net.
WordPress.org's own advice for a PHP change is to back up, update everything first, check compatibility and contact your host if unsure. A paid job should cover at least that, and more.
| Step | Why it matters | What you should receive |
|---|---|---|
| Full backup of files and database | Gives you a way back if a plugin fails | A note that the backup exists and where it is stored |
| Update WordPress, themes and plugins first | Old code is the usual cause of breaks | A list of what was updated |
| Compatibility check of plugins and theme | Finds problems before visitors do | A list of anything flagged |
| PHP switch, ideally on a staging copy first | Keeps the live site safe while testing | The new version number |
| Fix or replace what breaks | The switch alone can leave a broken page | A note of each repair |
| Test pages, forms, login, admin and checkout | These fail quietly, so someone must click them | A short test list |
| Host confirmation of the security fix | A version label can mislead when a vendor backports a fix | The host's written answer |
| Before and after report | It is your record, and your own clients may want it | One page with both PHP versions |
These are judgment calls, not rules from any standard, but each one is a reason to pause.
Paste these into a message. A good provider answers each one in plain words.
Hello, I want my WordPress site moved to a supported PHP version after the 21 October 2026 security release. 1. Which PHP version will you move me to, and what if my host does not offer it? 2. Do you take a full backup first, and how do I restore it? 3. Will you test on a staging copy, or on the live site? 4. What do you test afterwards, and do I get a list? 5. What happens if a plugin stops working? 6. What do you need from me, and how will I give you access safely? 7. Will you send a before and after report?
Page count matters less than people expect. These things set the time:
| Factor | Effect |
|---|---|
| The jump in PHP versions | A move from 7.4 to 8.3 is a bigger leap than 8.1 to 8.3, so more can break |
| Age of plugins and theme | Abandoned plugins may need replacing |
| A shop or booking system | Checkout and payments need extra testing |
| Host access | A host that offers staging and a PHP switch saves time |
| A recent backup | If none exists, creating one is the first task |
| Signs of a past hack | This becomes cleanup work and is quoted separately |
At Amariq, we offer this as a fixed-scope service on Fiverr. You can order the WordPress PHP update gig by site size, with extras for online shops, staging tests and written host confirmation. For every site we take a full backup first, update WordPress, plugins and theme, move PHP to 8.3 or newer where your host offers it, fix what breaks, test the main pages, forms, login and admin, and send a short before and after report. We ask for an administrator invite, never a password in chat, and your domain, hosting and analytics accounts stay in your name. A site that was already hacked, or one built on abandoned plugins, is quoted separately, and we say so before you order. If you would rather leave PHP behind altogether, Webflow migration moves a WordPress site across with its URLs, and our WordPress development page covers ongoing work. Our guide to website maintenance costs shows where this sits in a yearly budget.
Often yes. If your host gives you a PHP setting and you take a backup first, WordPress.org describes the steps. Hire help if you run a shop, do not know your PHP version, or would rather not risk the site breaking.
Check Site Health in WordPress, under Info and Server, for the PHP version. Then ask your host to confirm the security fix in writing, because a vendor can fix a flaw and keep the old version number. Our guide to what to ask your host lists the questions.
No. Your pages and settings live in the database, and a PHP change does not alter them. A broken plugin can still make pages show errors, which is why a backup comes first.
A good provider moves you to the newest version your host supports and tells you so. If the host only offers old versions, the honest advice may be to change host.
Sometimes, but it is a different job. The NCSC advises checking for signs of compromise and backdoors if you stayed exposed, and that takes more than a version change. Say so before you order, so the work is scoped correctly.
It can be, as long as you judge the seller the way you would anyone else. Read what each package includes, use the questions above, and avoid anyone who asks for passwords in a message. Fiverr publishes its own buyer rules on its site, so read those before you order.
WordPress.org says no WordPress update is required or planned for these flaws. Updating WordPress, plugins and theme before the PHP change is still good practice, because it removes known problems before you switch.

What a small business website costs in Australia in 2026, with real published prices, plus .com.au rules, GST, hosting, privacy and a hiring checklist.

What a website redesign costs in 2026: ranges from ten published guides in USD, AUD and GBP, why they disagree, and a sheet to make quotes comparable.

What web design costs in the UK in 2026: published ranges from four UK guides side by side, the VAT question most skip, first-year budgets and a quote sheet.