FREE WORDPRESS SECURITY CHECK
Is your WordPress site patched?
Two critical security holes were found in PHP, the code that runs WordPress. Send me your web address and I'll check your site for free.
Free, no strings. Rob Holmes, Vinegar Creative, Hampton.
Free WordPress
security check
- PHP versionCheck
- WordPress coreCheck
- Plugins and themeCheck
- SSL padlockCheck
- Malware and blacklistsCheck
- BackupsCheck
WHAT HAPPENED
Two critical holes in PHP
On 21 October 2026, PHP released an emergency security update. PHP is the code that runs WordPress and millions of other websites.
The update fixes two critical flaws. On a site that hasn't been updated, they could let an attacker run their own code on the server, without a password.
On 26 October, the US cyber security agency CISA added both flaws to its list of ones being used in real attacks.
Fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older no longer get official updates. The flaws are CVE-2026-109618 and CVE-2026-109619. Sources: PHP's official notice and the UK National Cyber Security Centre.
WHY IT MATTERS
Old software leaves the door open
Old PHP
Lots of WordPress sites still run old versions of PHP. Old versions don't get security fixes any more.
Old plugins and themes
Plugins and themes that haven't been updated can leave gaps too, even when WordPress itself is up to date.
Nobody watching
Many sites haven't been looked at since the day they launched. Problems can sit there for months without anyone noticing.
WHAT I CHECK
What I'll check, for free
I check what can be seen from the outside. You don't need to give me any passwords.
PHP version
Whether your site seems to run an old version of PHP. If your server hides it, I'll tell you who to ask.
WordPress core
Whether WordPress itself is up to date.
Plugins and theme
Which plugins and theme I can see, and whether any look out of date.
SSL padlock
That your padlock (SSL certificate) is working and isn't about to run out.
Malware and blacklists
Whether Google or the main security lists have flagged your site as unsafe.
Backups
Whether you have a recent backup you could get your site back from. I'll ask you or your host.
You'll get a short email in plain English: what I found, and what to do next.
ALREADY LOOKED AFTER?
Where does your site live?
Hosted with me?
Relax. The fix went on at server level before the news even broke. Your site was protected automatically. There's nothing you need to do.
On Squarespace?
No need to worry either. Squarespace looks after all the security behind the scenes for you.
Somewhere else?
Ask whoever looks after it one question: has it been patched? Not sure? Send me your web address and I'll check.
Website management from £99 per month
Want someone to keep an eye on it? I can look after your website every month, so you don't have to think about it.
FREE, NO STRINGS
Get your free check
Send me your web address. I'll check it and email you what I find.
- Set up in 2012 and based in Hampton since 2014
- Squarespace Gold Partner
- Rob Holmes, Vinegar Creative, Hampton, south-west London
Your website, looked after.
Rob Holmes, Vinegar Creative.