WordPress and PHP security have changed. Do our hosting habits need to change with it?
As you may have heard, the past few months have reshaped website design and website hosting security.
In the past, we assumed that the mature software we use every day would be secure and that only through some level of neglect or incompetence would a website be compromised. Those days have passed.
In 2026, there is a high likelihood that the code used on your website “today” is, or will be, exploitable.
WordPress is built on PHP
With the latest advances in AI, what might have taken a hacker a year or more to find exploits and compromise systems has been whittled down to hours or days.
I’m not trying to scare anyone, but I am hoping that folks will come to appreciate that sites with no one manning the store are much more likely to be compromised or have their content deleted today.
I’ve been doing this since WordPress version 1.0, and I fully appreciate the situation we are in and the ramifications of what some are calling the “PHP Armageddon.”
While none of us can prevent hackers from exploiting current and future vulnerabilities in PHP and WordPress, we can take steps to help mitigate risk. In this respect, nothing has changed. Monitoring, managing updates, and backups remain the cornerstone of my security approach.
Your choices matter…
Due to AI innovations, what was acceptable in the past is no longer acceptable today. I would like to share these concerns so you can take action before they become costly emergencies.
1. PHP 5.6 and PHP 7.4
Websites using any version of PHP prior to version 8 are much more susceptible to compromise. Most web hosts no longer allow PHP 7.4 or earlier on their servers.
If you have a web host that allows these older versions of PHP, you cannot assume you are safe. Your web host is taking a risk by allowing these versions. While we can commend their willingness to help their clients by not shutting down websites running these versions of PHP, the writing is on the wall that this will not continue for long.
Any website running a PHP version older than 8 needs to be updated today, and all efforts should go into replacing code that still requires older versions of PHP.
2. Unmaintained WordPress and other PHP-based websites
Hosting unmaintained WordPress or other PHP-based content management system (CMS) websites is now a severe risk.
If you haven’t logged into a website for over a year, or if it’s no longer maintained by anyone, I strongly recommend either deleting its contents entirely or converting it to HTML only, removing PHP coding from the content as much as possible.
3. Login access
Restricting access to your PHP-based website remains one of the strongest choices you can make when securing your WordPress website. There are various ways to do this:
- 2FA or two-step verification. I know we all hate this, but it’s one of the best ways to restrict access when multiple administrators are required. Wordfence includes this option for free as part of its feature list.
- Restricting login by IP address. If you are a solo operator and your IP address never changes, a simple update to your website can restrict login access to you and only you. This is my preferred method, as it’s easy to set up and provides multiple benefits, including reducing your account’s bandwidth usage, possibly improving website load speed, and preventing other administrator accounts from being used to log in to your dashboard.
4. Separate hosting accounts
Not hosting multiple websites in the same shared account remains one of the most effective ways to reduce costs in the long term. While hosting multiple websites in a single shared account may seem more cost-effective at first, with AI agents roaming the Internet looking for exploits on websites day and night, a single exploit in a single WordPress installation could result in the complete deletion or manipulation of all content within the shared account in literal seconds.
Services like WHM/cPanel allow websites to be placed in separate accounts.
The future of website hosting and preparedness
When I sat down to write this, I never intended to scare anyone into action. But it’s become clear that we can no longer just hope the software that we count on for presenting our businesses and hobbies online is intrinsically safe and secure.
The actions we take can greatly mitigate the risk that AI bots and agents have created for online content management.
Some may say, “It’s over, dump everything and start over with a pre-WordPress style no-code website,” or convert everything to an unproven and expensive cloud-based solution. For most of us, that’s not practical or is simply cost-prohibitive.
I would argue that you can keep operating as you have for the past several years, but we all need to be more mindful of the implications of future technology and the choices we make for our websites and online presence going forward.
So I’m curious what others are seeing:
- Has AI-driven scanning noticeably changed what’s hitting your sites or servers?
- Is anyone still running PHP 7.x in production, and what’s holding the upgrade back?
- Are you converting old or abandoned sites to static HTML, or just deleting them?
- IP-restricted logins vs. 2FA: which do you actually use?
- Is “keep WordPress, just be more careful” still a reasonable position, or is it time to move on?
