WordPress Security: PHP Updates and Safer Hosting | TVCNet

The situation

As you may have heard, the past few months have reshaped website design and website hosting security.

In the past, we assumed that the mature software we use every day would be secure and that only through some level of neglect or incompetence would a website be compromised. Those days have passed.

In 2026, there is a high likelihood that the code used on your website “today” is, or will be, exploitable.

WordPress is built on PHP

With the latest advances in AI, what might have taken a hacker a year or more to find exploits and compromise systems has been whittled down to hours or days.

I’m not trying to scare you, but I am hoping that you’ll come to appreciate that folks who have no one manning the store are much more likely to have their sites compromised or their content deleted today.

You have the unique advantage that I have been doing this since WordPress version 1.0, and I fully appreciate the situation we are in and the ramifications of what some are calling the “PHP Armageddon.”

While I can’t prevent hackers from exploiting current and future vulnerabilities in PHP and WordPress, we can take steps to help mitigate risk. In this respect, nothing has changed. Monitoring, managing updates, and backups remain the cornerstone of my security approach with HackGuard.com.

Your choices matter…

Due to AI innovations, what was acceptable in the past is no longer acceptable today. I would like to share these concerns with you so you can take action before they become costly emergencies.

1. PHP 5.6 and PHP 7.4

Websites using any version of PHP prior to version 8 are much more susceptible to compromise. Most web hosts no longer allow PHP 7.4 or earlier on their servers.

If you have a web host that allows these older versions of PHP, you cannot assume you are safe. Your web host is taking a risk by allowing these versions. While we can commend their willingness to help their clients by not shutting down websites running these versions of PHP, the writing is on the wall that this will not continue for long.

Any website running a PHP version older than 8 needs to be updated today, and all efforts should go into replacing code that still requires older versions of PHP.

I now provide a low-cost service for updating scripts to work with later versions of PHP. Please contact me if you need help with this.

2. Unmaintained WordPress and other PHP-based websites

Hosting unmaintained WordPress or other PHP-based content management system (CMS) websites is now a severe risk.

If you haven’t logged into a website for over a year, or if it’s no longer maintained by my HackGuard service or another provider, I strongly recommend either deleting its contents entirely or converting it to HTML only, removing PHP coding from the content as much as possible.

I likewise provide a low-cost service to convert websites that don’t require e-commerce functionality to HTML only. Please contact me if you need help with this.

3. Login access

Restricting access to your PHP-based website remains one of the strongest choices you can make when securing your WordPress website. There are various ways to do this:

• 2FA or two-step verification. I know we all hate this, but it’s one of the best ways to restrict access when multiple administrators are required. Wordfence, which is installed for all HackGuard service clients, includes this option for free as part of its feature list.
• Restricting login by IP address. If you are a solo operator and your IP address never changes, a simple update to your website can restrict login access to you and only you. This is my preferred method, as it’s easy to set up and provides multiple benefits, including reducing your account’s bandwidth usage, possibly improving website load speed, and preventing other administrator accounts from being used to log in to your dashboard.

4. Separate hosting accounts

Not hosting multiple websites in the same shared account remains one of the most effective ways to reduce costs in the long term. While hosting multiple websites in a single shared account may seem more cost-effective at first, with AI agents roaming the Internet looking for exploits on websites day and night, a single exploit in a single WordPress installation could result in the complete deletion or manipulation of all content within the shared account in literal seconds.

Services like WHM/cPanel allow websites to be placed in separate accounts. If this is something you would like to consider, please contact me, and I’ll help you further secure your setup this week.

The future of website hosting and preparedness

When I sat down to write this letter, I never intended to scare you into action. But it’s become clear that we can no longer just hope the software that we count on for presenting our businesses and hobbies online is intrinsically safe and secure.

The actions we take can greatly mitigate the risk that AI bots and agents have created for online content management.

Some may say, “It’s over, dump everything and start over with a pre-WordPress style no-code website,” or convert everything to an unproven and expensive cloud-based solution. For most of us, that’s not practical or is simply cost-prohibitive.

I would argue that you can keep operating as you have for the past several years, but we all need to be more mindful of the implications of future technology and the choices we make for our websites and online presence going forward.