Protect my website without being technical

2Send this message to whoever looks after your site

It's their job to fix this. Copy the message, fill in the square brackets and send it by email. Ask for a written reply.

Hello,

Two critical security flaws in PHP were fixed on 21 October 2026 ("PHP2Shell", CVE-2026-109618 and CVE-2026-109619, severity 9.2/10). They let an attacker take control of a server remotely.

For my website [your website address], could you please confirm in writing:
1. which PHP version it currently runs;
2. that it has been updated to a fixed version (8.2.35, 8.3.36, 8.4.27, 8.5.12 or later, or a distribution package that includes the fix);
3. if this hasn't been done yet, the date when it is planned;
4. that a full backup was made before the work.

Thank you,
[Your name]

Still no reply after 48 hours, even after a phone call? Then choose "I pay a hosting company" above (or "I have my own server" if your invoice mentions a VPS) and deal with it yourself.

2Make a backup

Most hosting companies already make an automatic backup every day. To make one yourself just before you act:

• With WordPress: in the dashboard, go to Plugins → Add New Plugin, search for "UpdraftPlus", click Install Now and then Activate. Then go to Settings → UpdraftPlus Backups and click Backup Now.
• Otherwise: in your hosting account, look for "Backup".
• No Plugins menu in WordPress? Your account is not an administrator. Ask your hosting company for the backup, using the message further down.
• Can't manage it? Ask your hosting company, using the message further down. They will do it for you.

3Find your PHP version

PHP is the "engine" that runs your website. You need its full version number, with three numbers (for example 8.3.36).

Option A, if your site is built with WordPress (the easiest): in the dashboard, go to Tools → Site Health, open the Info tab, then open the Server section. The "PHP version" line shows the full number. No Tools menu? Your account is not an administrator. Go to option B.

Option B: in your hosting account, look for "PHP version", "PHP selector" or "PHP configuration". If it only shows two numbers (for example "8.3"), that's not enough. Go to option C.

Option C: ask your hosting company, using the message further down. They will reply with the exact number.

You don't need to download or install anything on your site for this. If someone offers you a "test file" or a "detection tool", say no.

4Read the result

Look at the first two numbers (the "series", for example 8.3), then at the third one:

Hello,

I'm looking for someone to do urgent work on my [WordPress / other] website: [your website address], hosted by [hosting company name] on the [plan name] plan.
The person who built it can no longer be reached.

Following the "PHP2Shell" PHP security flaws (CVE-2026-109618 and CVE-2026-109619, 21 October 2026), my site runs PHP [version shown in Site Health], which will not get a fix.

Could you send me a quote and a timeframe for:
1. a full backup of the site;
2. checking that the site and its plugins are compatible, then moving to PHP 8.3 or 8.4;
3. checking that the site has not been hacked since 17 October.

I will give you the logins by phone, not by email.

Thank you,
[Your name] – [phone number]

Message to send to your hosting company

Send it from the "Support", "Help" or "Open a ticket" section of your hosting account.

Hello,

Following the "PHP2Shell" PHP security flaws (CVE-2026-109618 and CVE-2026-109619) fixed on 21 October 2026, could you please confirm:
1. the exact PHP version (with all three numbers) used by my website [your website address], hosted on the [plan name, shown on your invoice] plan;
2. that it includes the fix, or if not, the date when it will be updated;
3. that a recent backup of my website exists;
4. whether any suspicious activity has been detected on my hosting since 17 October.

Thank you,
[Your name]

Want step-by-step guidance? Go to the prompt generator.

Two precautions all the same:

• If you have another website (a blog, an old site) hosted somewhere else, go through this guide again for it.
• Be wary of emails asking you to "update PHP" by clicking a link. They are most likely a scam.

2First check the PHP version, without a terminal

If your site is built with WordPress: Tools → Site Health, Info tab, Server section, "PHP version" line.

Hello,

I'm looking for a professional to do urgent work on a VPS server [provider name, e.g. OVHcloud] that hosts my [WordPress / other] website: [your website address].
The person who set it up can no longer be reached.

Following the "PHP2Shell" PHP security flaws (CVE-2026-109618 and CVE-2026-109619, 21 October 2026), my site runs PHP [version shown in Site Health], which will not get a fix.
A backup (snapshot) was made on [date].

Could you send me a quote and a timeframe for:
1. immediate temporary protection;
2. upgrading the server, or moving to an up-to-date server, with a fixed PHP version;
3. checking that the server has not been hacked since 17 October.

I will give you the logins by phone, not by email.

Thank you,
[Your name] – [phone number]

To find a professional: your national cybersecurity agency, a local web agency, or a freelance "Linux / WordPress administrator". In a non-profit or a company, this choice and its cost often need to be approved (by the board or management).

3Make a backup

In your provider's customer account, open your VPS and look for "Snapshot" (a complete "photo" of the server) or "Backup".

• This option sometimes costs extra (a few euros or dollars a month, with an "Order" button). It's money well spent, but it may need to be approved.
• No password for the customer account? Use "Forgot password" with the email address that receives the invoices.
• Check that the snapshot shows today's date and time. If something goes wrong, the "Restore" button puts the server back in that state (any orders or bookings received in the meantime would be lost).

4Let an AI guide you, one command at a time

We do not provide any script. Never run a program you don't understand on your server, wherever it comes from.

Instead, the prompt generator below prepares a message that asks the AI to have you type short, standard commands, one at a time, that only read information (for example php -v, which shows the PHP version). Before each command, the AI must explain what it does. You paste the result back to it, and it tells you what to do next.

Your first connection to the server (SSH)

Your "SSH access" details are often in an old email that contains an IP address (numbers like 51.75.12.34), a username (for example debian) and a password.

• In the terminal, you type the real address and the real password. You only hide the address in what you paste to the AI (replace it with MY-IP).
• The first time, a question appears (Are you sure you want to continue connecting). Type yes.
• When you type the password, nothing appears, not even asterisks. That's normal.
• Only type the password when the line password: is shown. Never at any other time, and never in the AI chat.
• To leave the server, type exit.

Comfortable with a terminal? The developers page lists the diagnostic commands one by one, with a table to read the results.

2Let's find out who looks after your website

• Look through your invoices or bank statements for a monthly or yearly payment to Hostinger, IONOS, Bluehost, GoDaddy, OVHcloud, Wix, Shopify… or to a web agency.
• Search your emails for "hosting", "domain name" or "renewal".
• Ask the person who built the site.

You know it's OVHcloud, but not which plan? Log in to your OVHcloud account. If your site appears under Web Cloud → Hosting plans, choose "I pay a hosting company". If it appears under Bare Metal Cloud ("Virtual private servers" or "Dedicated servers"), choose "I have my own server".

Once you've found out, go back to question 1. In the meantime, the prompt generator can also help you look.