The one number that decided whether you had a bad week.
Last week a leaked bug in PHP, called PHP2Shell, put a huge share of the web at risk. PHP runs every WordPress site. The NSA told organisations to update or go offline.
When I started working with a fit-out company last year, the first thing I checked was their website's security. They were on an old version of PHP, so they couldn't update their plugins. Bots were hammering the site and the contact forms had quietly stopped working. Getting their host to upgrade meant moving hosting. Then I updated every plugin, closed the holes bots were using and fixed the forms.
Most business owners never find out until something breaks. This is the check I run first, and AI does most of the work.
Only check websites you own or manage. Testing someone else's site without permission can be illegal.
What You'll Need
Your WordPress login (or access to your hosting dashboard)
Claude or ChatGPT (any paid plan)
Your hosting company's or web agency's contact details
About 30 minutes
Step 1: Find Your PHP Version
In WordPress, go to Tools → Site Health → Info → Server. The PHP version is listed there.
No WordPress? Look in your hosting dashboard (cPanel and Plesk both show it), or ask your host.
This test site runs PHP 7.4. That one needs an upgrade.
Now compare it with the fixed versions:
8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer in the same line: Patched. Carry on to Step 2.
An older 8.2 to 8.5 release: Ask your host to update now.
8.1 or older: No longer supported. You need an upgrade, or written confirmation your host has applied a backported fix.
Step 2: Let AI Check Your Plugins
Go to Tools → Site Health → Info, click Copy site info to clipboard and paste it into Claude or ChatGPT with this prompt:
I run a small business website. Below is my WordPress Site Health info.
1. Tell me my PHP and WordPress versions and whether they're affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619; fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35).
2. List every plugin and theme with its version. Flag any that are out of date, abandoned (no update in over a year) or have a known exploited vulnerability. Check these in particular: Rank Math PRO 3.0.123, UpdraftPlus/UpdraftCentral, Bricksforge below 3.1.8.10, Ninja Forms.
3. Search the web to confirm each flag, and give me the source link.
4. Give me a short to-do list in priority order. Plain English, no jargon.
[PASTE SITE HEALTH INFO HERE]Use a model with web search switched on, so it checks current advisories instead of guessing. Open the links it gives you and check the important ones yourself.
Claude even spotted this was a test copy, not a live site. Upgrading PHP still made the top three.
Step 3: Check Your Free Protection
If your site runs through Cloudflare, it has added rules that block the known PHP2Shell attacks, on every plan including free. On the free plan they're on automatically, so you're just checking.
Log in to Cloudflare and open your website.
Go to Security → Security rules and look for the notice saying Cloudflare is helping protect your site against PHP2Shell.
Not on Cloudflare? Ask AI: "Is my host [HOST NAME] protecting customers against PHP2Shell, and how do I check?"
This buys you time. It doesn't replace updating.
Cloudflare's notice on the free plan. Protected for now, but it doesn't patch PHP.
Step 4: Get Your Host or Agency to Fix It
Most people stall here because they don't know what to ask. Let AI write it:
Write a short, polite email to my hosting company / web agency.
My website is [DOMAIN]. It runs PHP [VERSION] and WordPress [VERSION].
Ask them to:
1. Confirm whether my site is patched against PHP2Shell (CVE-2026-109618 / CVE-2026-109619), and if not, upgrade PHP to a supported, patched version.
2. Tell me what PHP version I'll be on afterwards and whether any plugins need updating first.
3. Confirm when my last working backup was taken and how I'd restore it.
Keep it under 150 words and ask for a reply within 48 hours.If they can't upgrade you, that's your answer: it's time to move hosting.
Step 5: Close the Easy Doors
Ask AI to turn your Step 2 results into a checklist, then work through it:
Update every plugin and theme you keep, and delete the ones you don't use
Turn off comments if you don't use them (a favourite way in for spam bots)
Check Users for admin accounts you don't recognise
Switch on two-factor login for every admin
Make sure backups run automatically and are stored off the server
Test your contact form. Broken forms lose enquiries silently.
Step 6: Make It a Weekly Check
Set up a scheduled task in Claude or ChatGPT that runs every Monday:
Every Monday, search the web for new security issues affecting PHP [VERSION], WordPress and these plugins: [YOUR PLUGIN LIST]. If anything needs action, tell me in three bullet points with links. If nothing, reply "All clear".Two minutes of reading a week instead of finding out from a customer.
Where This Actually Drives Business
Trust: A hacked site, a spam redirect or a browser warning loses work before anyone calls you.
Tenders and contracts: Bigger clients increasingly ask about cyber security, and many UK public sector contracts require Cyber Essentials. A patched, documented website is part of that story.
Enquiries: Fixing broken forms is often the fastest marketing win there is.
Troubleshooting
I can't find Site Health: You may not be an administrator. Ask whoever built the site for admin access, or ask the host for your PHP version.
The AI says everything is fine, but I'm not sure: Ask it for source links and check them. If it can't link to a source, don't rely on it.
My host says they can't upgrade PHP: Plan a move to a host that supports current PHP versions, ideally with automatic updates and daily backups.
An update broke my site: Restore last night's backup and update plugins one at a time to find the culprit.
Final takeaway
You don't need to be technical to know whether your website is safe. You need your PHP version, a current plugin list and someone accountable for fixing what's wrong.
If you'd rather have someone check and fix it for you, a security review is part of every audit I do at metalabs.global.
Found this helpful? Forward it to whoever looks after your website.