Website Design for Australian Small Business (2026)
What a small business website costs in Australia in 2026, with real published prices, plus .com.au rules, GST, hosting, privacy and a hiring checklist.
Website Security
What to Ask Your Web Host About the PHP Security Fix
Most site owners cannot patch PHP themselves, so the useful move is a clear message to the host. This page gives the questions, a short email you can paste, and how to read the answer, based on php.net, WordPress.org and the NCSC. Sources read 22 October 2026.
Key takeaways
- Ask for confirmation, not reassurance. A host that says "we are on it" has not told you a version or a date.
- A version number alone can mislead. Vendors of Linux distributions and extended support got the patches early, per php.net, so a fixed PHP can still wear its old version label.
- Name the CVEs. CVE-2026-109618 and CVE-2026-109619 are the two flaws, and the four fixed releases are the fixed releases.
- Hosts may already be working on it. WordPress.org says your web host may be updating PHP and adding web application firewall rules, and that you should still check.
- Ask about old PHP. PHP 8.1 and older get no updates from the PHP project, so ask what the host does for those plans.
- Get it in writing. An email gives you a record and a date to follow up on.
Why asking is the right first move
PHP runs on the server that your host controls. php.net says the risk is to every PHP installation serving web requests, and WordPress.org tells owners to check for updates from their host and, if needed, update PHP themselves. On shared and managed hosting the host usually holds the switch, so your job is to make sure someone has used it.
The NCSC adds a second reason. It tells organisations to find all systems that run PHP, internet-facing ones first, including products that bundle PHP as a component. For a small business, that means asking about every site and tool you pay for, not only the main website.
The questions
Copy the ones that fit your setup.
| # | Question | Why it matters |
|---|---|---|
| 1 | Which PHP version and patch level does my site run on right now? | The branch and patch number show whether you are at 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later |
| 2 | Is my plan patched against both CVEs yet, and on what date? If not, what is the expected date? | Gets a status and a date |
| 3 | Is the fix a PHP update or a backport on an older version? | Backports can keep the old number |
| 4 | Is my site on mod_php, PHP-FPM or LiteSpeed? | php.net rates mod_php as highest risk |
| 5 | Are there firewall rules on my account for these flaws, and are they your whole answer? | A host filter can help, though the owner is still told to update |
| 6 | What do you do for plans stuck on PHP 8.1 or older? | The PHP project offers them no official patch |
| 7 | Can I choose a newer PHP in my control panel, and can I roll back? | Gives you control and a way back |
| 8 | Do you have signs of attack on my account, and can you check my logs? | The NCSC advises looking for evidence of compromise if you stayed exposed |
| 9 | Do you run PHP in other services I pay for, such as a mail or booking tool? | The NCSC says products can bundle PHP |
A message you can paste
Hello, After the 21 October 2026 PHP security release (CVE-2026-109618 and CVE-2026-109619), please tell me three things for my account [domain name]: 1. The PHP version and patch level my site runs on now. 2. Whether the fix is applied, and the date. If not yet, the date you expect. 3. If it will not be applied by backport or update, what you advise. If you offer a newer PHP in the control panel, please tell me how to switch, and whether I can switch back. Thank you.
Short and specific works better than a long worried message. It also gives the support person one thing to answer.
How to read the answer
| What the host says | What it means | Your next move |
|---|---|---|
| "Your site runs 8.3.36 or newer, updated on [date]" | The fix is in on that branch | Note the date, and check the version in your dashboard |
| "We have applied the fix as a backport" | Possible, since vendors received patches in advance | Ask which package or build, and the date |
| "We will update in the next maintenance window" | Not done yet | Ask for the date and what protects you until then |
| "We added firewall rules" | A mitigation, not the fix | Ask when the update comes. WordPress.org still says to update |
| "Your plan uses PHP 8.1 or older" | No official fix from the project | Ask about backports or extended support, or move to a supported PHP |
| No reply in a day | Unknown status | Follow up, and think about whether the host suits a site you rely on |
If you manage the server yourself
php.net lists temporary measures for people who cannot update at once, including memory_limit=-1, a low post_max_size, session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0. It also says that these only reduce exposure and that the update is the complete fix. Our main guide on the PHP vulnerability of October 2026 sets them out with the caveats. If you run WordPress, see how to check and update your PHP version.
What a good host relationship looks like
A host that answers in the first day, names versions, and tells you where to click to switch PHP is a good sign for the next advisory too. A reply that does not say which version you are on is a reason to keep asking. The sum that matters is the cost of a bad week against the cost of better hosting, and our guide to website maintenance costs sets hosting and updates alongside the other recurring bills. Related reading: who patches PHP, Cloudflare's free WAF and Webflow security.
How we help
At Amariq, your name holds the domain, hosting and analytics accounts, so you can always ask the host directly and nobody stands between you and the answer. We can read the reply with you, test the site after a PHP change, and look after updates through Webflow maintenance or WordPress care. If you want to leave PHP hosting behind, Webflow migration moves the site with its URLs.
Frequently asked questions
Should I contact my host or fix PHP myself?
Contact the host first, because PHP is installed on their server. WordPress.org suggests some hosts are already moving PHP forward, and still asks owners to look for themselves and update where they can.
How do I find out which PHP version my host runs?
In WordPress, go to Tools, then Site Health, then Info, then Server. Many hosts also show it in the control panel. Ask them for the patch level too, such as 8.3.36.
Is a firewall rule enough?
No. WordPress.org says hosts may put web application firewall rules in place, and still tells owners to update PHP. PHP's own advisory says the update is the only complete fix.
What if my host will not update?
Ask for a written reason and a date. If your PHP is older than 8.2, WordPress.org's note for self-managed servers is to consider taking the site offline during the update. A host that keeps PHP current may be worth moving to.
What if the host says it was already patched in advance?
That can be true, since distribution and support vendors were sent the patches ahead of release. Ask for the package or version and the date, and compare it with your dashboard.
Does this apply to Webflow, Shopify or Wix?
Hosted builders run their own servers, so you have no PHP version to change. Webflow's Trust Center notice of 21 October 2026 describes its core services as unaffected. Shopify, Wix, Squarespace and Framer had no statement that we could find, so ask them directly.
What should I do if I think my site was hacked?
The NCSC says to look for signs of compromise and hidden backdoors, with help from an incident response provider if you are unsure. WordPress.org has an FAQ called "My site was hacked" for WordPress owners.
What Is Remote Code Execution? A Plain Guide for Owners
Remote code execution (RCE) lets a stranger run commands on your server. Learn what it means, why it scores critical, and how it differs from a data leak.
PHP End of Life Dates for 7.4, 8.1 and 8.2: What to Do
PHP 7.4 and 8.1 are end of life, and 8.2 security support ends 31 Dec 2026. See every date from php.net and what to do for your WordPress site.