Who’s Keeping Your Website Secure?
You probably know who to call when your website needs a new headline or a landing page for your next campaign. But if a critical security alert landed in your inbox tomorrow, would you know who was checking your site, applying the fix, and making sure everything still worked afterward?
In late October 2026, critical vulnerabilities in PHP, a programming language used by many websites, including WordPress and Drupal, prompted urgent calls to patch. According to CERT-EU’s advisory, fixes released on October 21 addressed two vulnerabilities, each assigned a CVSS severity score of 9.2 out of 10. On October 23, PHP disclosed a third issue affecting an unusual configuration, with mitigation guidance ahead of a regular release.
For business owners and marketing teams, the immediate challenge was figuring out whether their websites were affected and who was handling the response. If your site uses PHP and you haven’t confirmed its status, ask your hosting provider or technical team to check today.
Your website can look great, collect leads, and load without a hitch while the software behind it needs attention. Knowing who handles that work is a useful first step toward protecting it.
A Website Can Have Plenty of Support and Still Have Gaps
Your hosting company keeps the server running. Your developer builds new features. Your marketing team manages content and campaigns. With several people involved, it’s easy to assume security is covered somewhere along the way.
The trouble is that each provider may be responsible for a different piece. A maintenance agreement might cover WordPress and plugin updates while leaving server software to the hosting provider. Your developer might handle security fixes when requested, without monitoring for new vulnerabilities between projects.
The first step is to find out where those responsibilities begin and end. These five checks can help you uncover gaps before an urgent alert sends everyone searching through old contracts.
1. Know Who Owns the Response
When a security alert arrives, someone needs to determine whether it affects your website and coordinate the next steps. If that responsibility is shared vaguely between your team, developer, and hosting company, you can lose valuable time while everyone waits for someone else to act.
Choose one person to coordinate the response, even if the technical work belongs to an outside provider. That person should know who receives alerts, who can authorize urgent work, and who confirms the issue has been resolved. Have a backup contact, too, because security problems rarely check anyone’s vacation calendar.
Put it into practice: Name your internal website owner, technical provider, and backup contact. Confirm who receives security alerts, who can approve urgent work, and how to reach them outside normal business hours. Keep those details somewhere your team can find without logging into the website itself.
2. Find Out What Gets Updated
Your website is a collection of connected systems, and ‘up to date’ can mean different things depending on who says it. Your content management system, plugins, themes, and server software are separate layers, and they may be maintained by different people.
Think of it like maintaining an apartment: replacing the door lock doesn’t repair the building’s wiring. Updating WordPress or a plugin doesn’t confirm that the server software underneath it has received the necessary security fixes.
The PHP project’s announcement highlights another important question: is your software still supported? Older PHP versions may require vendor-provided fixes or an upgrade, so your provider needs to verify your environment rather than assume routine updates have covered it.
Put it into practice: Ask what your maintenance plan covers and how urgent updates are handled. Have your provider confirm your PHP version, its support status, and whether applicable patches and mitigation steps have been completed. Request the completion date so you have a clear record.
3. Check Who Still Has the Keys
Website access tends to accumulate. A freelancer needs a login for a project, an employee changes roles, or an agency relationship ends, and those accounts can remain long after the work is finished.
Periodically review who can access your website, hosting account, and domain registration, along with the permissions they have. Someone publishing blog posts may not need administrator access, and a former vendor probably shouldn’t retain the ability to change your site. Individual accounts make access easier to manage and help your team understand who made a change.
Put it into practice: Schedule a short access review with your provider. Remove accounts that are no longer needed, reduce unnecessary permissions, and enable multifactor authentication wherever available. Confirm that your business controls the primary accounts and recovery details, especially for hosting and your domain name. Update employee exit processes to include account revocation steps to keep access secure after your review.
4. Make Sure Your Backup Can Bring You Back
A backup notification is reassuring, but it doesn’t tell you how recovery would go. The more useful question is whether someone has successfully restored a recent backup and checked that the recovered website works.
Find out what your backups include, how frequently they run, and where they’re stored. A site that collects orders or inquiries throughout the day may need a different schedule from a site whose content changes once a month. Your provider should also explain how they would choose a clean backup if a security problem had gone unnoticed for several days. A backup taken after an intrusion may contain the same malicious changes, so restoring the newest copy could bring the problem back.
For WordPress sites, WP STAGING, UpdraftPlus, and Duplicator offer backup and restoration tools. UpdraftPlus and Duplicator both have free versions, giving you a starting point to explore. Ask your website provider which option fits your setup, whether you need paid features, and how backups will be stored and tested. Whichever tool you choose, a successful recovery test matters more than a backup notification.
Put it into practice: Ask when your last successful restoration test took place. If nobody knows, arrange a test in a separate environment and check important functions such as forms and checkout. Use that exercise to establish how long recovery could take and how much recent data could be lost.
5. Have a Plan for the First Hour
An unexpected redirect, a browser warning, or an unfamiliar administrator account deserves investigation. Your team needs a clear way to report those signs, along with someone qualified to decide what should happen next.
A short response plan can prevent a stressful situation from becoming a guessing game. Your provider should guide decisions about restricting access, keeping a record of what happened, and investigating the cause. Assign someone on your side to coordinate business decisions and communication, including whether campaigns need to pause while the website is assessed.
Put it into practice: Walk through a simple scenario with your team: “A customer tells us our website is sending them to an unfamiliar page. What happens next?” Confirm who contacts your provider and who decides whether to pause marketing campaigns. Before normal activity resumes, assign someone to check important customer journeys, including forms and checkout, and confirm that tracking works.
A Few Questions Now Can Save a Scramble Later
You don’t need every technical answer yourself, but you should know where to get one. Clear responsibilities, verified updates, sensible access, tested backups, and a response plan give your business a stronger starting point when the next alert arrives.
Start by taking these five checks to your team or website provider. If the answers reveal gaps, schedule a call with Anala to discuss your website setup, maintenance responsibilities, and the next steps that need attention.
By Mike Reall
By Rebecca Streeter