If you have a WordPress or WooCommerce website, contact your hosting company or whoever looks after your site today.

Ask them:

• Are you going to apply the upcoming PHP security patch to my site?
• How long will it take after the release?
• Is there anything I need to do?

The PHP security team has announced a release to address two critical vulnerabilities. It’s scheduled for overnight tonight, 1am Thursday, 22 October, Melbourne and Sydney time, although the team may release it earlier.

PHP is the software that runs WordPress on your server. Updating WordPress or your plugins is not the same as patching PHP. Don’t assume that because your WordPress dashboard says everything is up to date, this is covered.

Get confirmation from whoever manages your hosting. The affected versions and full details will be published with the release.

Why I moved off WordPress

This is one of the main reasons I wanted to move my own site off WordPress.

PHP and WordPress have been great systems. They’ve helped an enormous number of businesses get online, mine included. But there are a lot of moving parts.

You’ve got WordPress itself, PHP underneath it, the database, your theme and whatever plugins you need to make the site work the way you want. Those things need to be maintained, patched and kept working together. They also give people trying to hack websites more places to look for a way in.

For my site, I didn’t want to keep dealing with all of that.

I also wanted to be able to update it quickly without logging in, opening a page editor and clicking my way through changes. Now I tell my agents what I want changed, and they can update the site in seconds.

The site itself is static. That doesn’t mean the content is stuck there forever. It means the pages are already built when someone visits. There’s no WordPress installation or PHP application running behind them to generate each page.

So I can keep changing the site whenever I want, without keeping that whole WordPress setup running.

The peace of mind is a big part of it for me. There’s no WordPress admin login sitting on the site, no collection of plugins to keep updated and no PHP runtime to patch.

Does that remove every security issue? No. Hosting accounts, the tools that publish the site and any connected services still need to be secured. But there are fewer things to maintain and fewer opportunities for someone to get in.

For a business website that mainly explains what you do, publishes content and brings in enquiries, it’s worth looking at.

A WooCommerce store, membership site or something with more complicated functionality needs a separate assessment. You can’t simply turn a checkout into a static page and expect it to keep working.

If you’re interested in moving off WordPress, here’s how our agent-managed websites work. Or just reply with your website address and we’ll let you know whether it’s a good fit.

In the meantime, get that patching question answered. Moving later doesn’t protect the site you’re running today.

Jim