What six technology professionals told us about PHP, website security and the responsibilities nobody explains when you buy a website.
Have you ever built a website, paid someone to build one or inherited responsibility for keeping one running?
Congratulations. You might be an accidental developer.
You don’t necessarily write code. You might be a business owner, marketer, designer, volunteer or administrator. Nevertheless, you’re responsible for a piece of technology that your organisation depends on.
That responsibility can be surprisingly difficult to understand.
On Friday 23 October, Suffolk Developers, supported by EMPOWERUS, brought together six experienced technology professionals to discuss the recent concerns surrounding PHP and website security.
Our objective was simple: explain what’s happening, understand the risks and help people work out what to do next.
What emerged was a conversation about something much bigger than one programming language.
1. First, what actually is PHP?
PHP is a programming language used to create and operate websites and web-based applications.
It’s particularly associated with platforms such as WordPress, Drupal and Joomla.
When you visit a website, you see the finished pages, images, buttons and content.
Behind the scenes, software processes information, retrieves content and helps assemble what appears in your browser.
PHP is one of the technologies that can make this happen.
Tom Wake, a web developer and technical consultant, explained that many website owners won’t even know PHP is running because it’s hidden beneath the platform they use.
Gary Rayner offered an even simpler explanation: think of PHP as a language that computers use to carry out instructions.
The important point is that PHP isn’t WordPress.
WordPress is one of many systems built using PHP. Other websites and business applications also depend on it.
That means problems affecting PHP can potentially have implications beyond the websites we immediately recognise.
2. Why are people concerned about PHP security?
Like other software, PHP can contain vulnerabilities.
A vulnerability is a weakness that could potentially allow somebody to make a system behave in a way its developers never intended.
Some vulnerabilities are minor. Others can be serious.
The discussion explored recent concerns about PHP security, the availability of patches and the difficulties organisations face when updating systems.
Our contributors also made an important distinction:
A serious vulnerability doesn’t automatically mean every website using that technology has been compromised.
The actual risk depends on factors including the version being used, how the system is configured, whether the vulnerable functionality is exposed and what protections are already in place.
That is why technical assessment matters.
The appropriate response isn’t to panic or start changing settings at random.
It’s to establish what you’re running, whether you’re affected and what action is needed.
3. Your website is not a one-off purchase
This was probably the strongest message of the morning.
Richard Maly, who has spent nearly three decades developing software, compared websites to cars.
You wouldn’t buy a car and expect it to operate safely for ten years without maintenance.
You arrange servicing, replace worn components and investigate unusual noises.
Websites need the same ongoing attention.
That includes:
Keeping software and plugins updated
Checking that backups are working
Reviewing security alerts
Monitoring for unusual activity
Making sure somebody is responsible for maintenance
A website might look perfectly normal while problems are developing behind the scenes.
The absence of an obvious problem is not evidence that everything is secure.
4. The first question isn’t technical. It’s about ownership.
Who is responsible for your website?
It sounds obvious, but our contributors described how frequently businesses struggle to answer it.
Perhaps somebody built the website five years ago.
Perhaps your marketing agency originally managed it.
Perhaps the person who knew all the passwords has left.
Perhaps you pay for hosting every year and assume that means somebody is maintaining everything.
Those are very different arrangements.
Martin Roche, who works with businesses on SEO, advertising and digital performance, explained how website maintenance often falls between responsibilities.
A marketing specialist might inherit a website while working on a campaign, even though ongoing technical maintenance was never part of the agreement.
His advice was to establish who is responsible and make sure they have the necessary access.
Start by answering five questions:
Who owns our website and domain name?
Who provides our hosting?
Who has administrator access?
Who is responsible for updates and security?
Who would we contact if something went wrong?
If you can’t answer those questions, that’s your starting point.
5. Don’t blindly click Update
It’s tempting to hear about a security problem, log into WordPress and start updating everything.
Please be careful.
Updating software is important, particularly when security patches are available.
However, websites contain interconnected components. An update to PHP, WordPress, a theme or a plugin can sometimes cause compatibility problems.
The panel emphasised the importance of checking backups and understanding what you’re updating.
Before making significant changes:
Confirm that you have a recent, working backup.
Check whether your hosting provider has already applied the necessary security updates.
If you’re uncertain about compatibility, speak to somebody who understands the technology.
A short conversation with a developer may prevent a much longer and more expensive problem.
6. Hosting is about more than finding the cheapest price
Tom Wake, founder of Trailwave, explained why he uses managed hosting providers for the business websites he looks after.
During the recent PHP concerns, he was able to contact his hosting providers and establish what protective measures had been implemented and when updates would be applied.
That reassurance has value.
Managed hosting can provide services such as security monitoring, backups, technical support and software maintenance, although the precise responsibilities vary between providers.
Tom also discussed Cloudflare, a service that can provide an additional protective layer between visitors and a website.
These services can reduce risk, but they aren’t substitutes for maintaining the underlying software.
The cheapest hosting isn’t necessarily the best value, and expensive hosting isn’t automatically secure.
The important question is what support and protection you’re actually buying.
7. A website can be compromised without looking broken
This was one of the more unsettling parts of our discussion.
Many people imagine a cyberattack as a website suddenly displaying an alarming message or refusing to work.
That can happen, but not every compromise is immediately visible.
Gary Rayner explained that attackers may have reasons to remain unnoticed, particularly if they want to access information or use a compromised system for other purposes.
He introduced the idea of indicators of compromise.
Think of your house.
You might not see somebody entering it, but you might notice that something has moved or that something unusual has happened.
Technology systems can produce similar warning signs.
Examples might include unexpected activity, unusual server resource usage, unfamiliar accounts or suspicious changes.
Monitoring helps identify those signs.
It doesn’t guarantee that an attack will be detected, but it gives somebody a better chance of recognising when something is wrong.
The question for website owners is:
Who is watching for those warning signs?
8. Think beyond your website
Your website may be only one part of your digital infrastructure.
Perhaps it collects enquiries, processes orders or connects to a customer database.
Perhaps it integrates with payment providers, stock management, marketing software or other business systems.
John Nicholson, an experienced software engineer and technology leader, explained that the consequences of a security problem depend partly on what a system does and what information it handles.
A simple information website presents a different risk profile from a system processing transactions or storing sensitive customer information.
Tony Craven, whose background includes decades of software engineering and infrastructure management, also highlighted the challenges of maintaining interconnected systems, particularly where updating one component isn’t straightforward.
The lesson is to understand not just your website, but what it connects to.
That doesn’t mean becoming a software engineer.
It means knowing enough to ask the right questions.
9. Your website security checklist
If you’re responsible for a website but don’t have a technical background, start here.
☐ Identify your website owner and technical contact.
Make sure somebody has clear responsibility for maintenance and security.
☐ Find out who hosts your website.
Understand what they maintain automatically and what remains your responsibility.
☐ Confirm that you have administrator access.
Keep access secure and avoid sharing passwords unnecessarily.
☐ Check which software your website uses.
If it’s WordPress, Drupal or Joomla, establish which versions are running, including the underlying PHP version where applicable.
☐ Ask whether security updates are current.
Don’t assume that paying for hosting means everything is patched.
☐ Check your backups.
Find out when the last backup was made, where it’s stored and whether it can be restored.
☐ Review plugins, themes and integrations.
Unused or outdated components can introduce unnecessary risks.
☐ Enable appropriate monitoring and security protections.
Ask your provider what alerts, logging and protective services are available.
☐ Review access when staff or suppliers change.
Remove accounts that are no longer needed and make sure essential access isn’t held by one person.
☐ Put a recurring maintenance review in the diary.
A monthly check is a sensible starting point, alongside prompt attention to important security alerts.
If you don’t know how to carry out these checks, ask for help rather than experimenting on a live business website.
10. What about AI?
Our discussion also touched on artificial intelligence.
AI tools are increasingly capable of helping people write software, identify problems and analyse existing systems.
That creates opportunities, but also new responsibilities.
As Richard and Tony observed, making software easier to create doesn’t remove the need for engineering knowledge, testing and maintenance.
A website generated quickly still needs to be secure, reliable and maintained.
Being able to build something isn’t the same as being able to operate it safely.
That’s an important distinction for anyone considering AI-assisted website development.
11. Where do we go from here?
The conversation began with PHP, but it revealed a much wider challenge.
We’ve made technology increasingly accessible without always making the responsibilities that come with it equally clear.
Small businesses are expected to operate websites, manage customer information, connect software platforms and make technical purchasing decisions.
Yet many have never been taught how the underlying systems work.
That knowledge exists.
It’s held by experienced developers, engineers, security specialists, marketers and technology professionals.
The challenge is making it accessible.
That’s why we brought Suffolk Developers together.
Through EMPOWERUS, we’re building a network of 39 sector advisers who can help connect businesses with relevant knowledge and expertise.
We’ll be using this session to create further practical guides, answer common questions and organise more conversations.
Our aim isn’t to turn every business owner into a developer.
It’s to help people understand enough about the technology they depend on to make informed decisions and know when to ask for help.
One final question
If you inherited responsibility for your organisation’s website tomorrow, would you know who maintains it, how it’s protected and what to do if something went wrong?
If the answer is no, you’re exactly the person we want to help.
Suffolk Developers | Supported by EMPOWERUS
With thanks to Gary Rayner, Martin Roche, Tom Wake, John Nicholson, Tony Craven and Richard Maly for generously sharing their knowledge and experience.
This article summarises a community discussion held on 23 October 2026. It provides general guidance rather than a technical assessment of any particular website. Specific vulnerabilities and appropriate patches should always be checked against current official security advisories.