Your Website After PHP2Shell: A 5-Point Security and AI-Readiness Checklist

The NSA told PHP sites to patch or go offline. Here's what business owners should check now — security first, then AI search readiness.

On October 21, 2026, the NSA warned every organization running PHP — the language behind roughly 70% of websites, including every WordPress site — to patch immediately or take their sites offline. Several governments did.

The fix shipped fast. But if you own a business website, "it's probably fine" isn't a plan. Here's what to check this week.

1. Confirm PHP is patched

Ask your host, in writing, which PHP version your site runs and whether it includes the October 2026 security release. If they can't answer clearly, that's your answer.

2. Update everything that runs on PHP

WordPress core, your theme and every plugin. Remove plugins you don't use — every one is another door.

3. Stop advertising your software versions

Many servers announce their exact PHP version to anyone who asks. Turn that off. It's a free head start for attackers.

4. Check your backups actually restore

A backup you've never restored is a hope, not a backup. Confirm you have a recent full copy of your files and your database, stored off the server.

5. Check how AI sees your site

Google's AI answers, ChatGPT and AI agents read structured data — the hidden labels that say who you are, what you sell and which social profiles are yours. If those labels are missing or contradict each other, you're invisible where customers are now searching.

The bigger picture

Our founder, Chris Slater, made a five-minute, plain-English video on what this moment means for business websites — and why the platform under your site is now a business decision:

Want a second set of eyes?

All Clear Digital will run a free post-PHP2Shell website check: patch status, exposed versions, backups and AI-readiness. Request your free check →

Sources & Further Reading