As you may have heard, the past few months have reshaped website design and website security.

In the past, we assumed that the mature software we use every day would be secure and that only through some level of neglect or incompetence would a website be compromised. Those days have passed.

In 2026, there is a high likelihood that the code used on your website "today" is, or will be, exploitable.

WordPress is built on PHP

With the latest advances in AI, what might have taken a hacker a year or more to find exploits and compromise systems has been whittled down to hours or days.

I'm not trying to scare anyone, but I am hoping that folks will come to appreciate that sites with no one manning the store are much more likely to be compromised or have their content deleted today.

I've been doing this since WordPress version 1.0, and I fully appreciate the situation we are in and the ramifications of what some are calling the "PHP Armageddon."

While none of us can prevent hackers from exploiting current and future vulnerabilities in PHP and WordPress, we can take steps to help mitigate risk. In this respect, nothing has changed. Monitoring, managing updates, and backups remain the cornerstone of my security approach.

Your choices matter…

Due to AI innovations, what was acceptable in the past is no longer acceptable today. I would like to share these concerns so you can take action before they become costly emergencies.

1. PHP 5.6 and PHP 7.4

Websites using any version of PHP prior to version 8 are much more susceptible to compromise. Most providers no longer allow PHP 7.4 or earlier on their servers.

If your provider still allows these older versions of PHP, you cannot assume you are safe. They are taking a risk by allowing them. While we can commend their willingness to help their clients by not shutting down websites running these versions of PHP, the writing is on the wall that this will not continue for long.

Any website running a PHP version older than 8 needs to be updated today, and all efforts should go into replacing code that still requires older versions of PHP.

2. Unmaintained WordPress and other PHP-based websites

Running unmaintained WordPress or other PHP-based content management system (CMS) websites is now a severe risk.

If you haven't logged into a website for over a year, or if it's no longer maintained by anyone, I strongly recommend either deleting its contents entirely or converting it to HTML only, removing PHP coding from the content as much as possible.

3. Login access

Restricting access to your PHP-based website remains one of the strongest choices you can make when securing your WordPress website. There are various ways to do this:

• 2FA or two-step verification. I know we all hate this, but it's one of the best ways to restrict access when multiple administrators are required. Wordfence includes this option for free as part of its feature list.
• Restricting login by IP address. If you are a solo operator and your IP address never changes, a simple update to your website can restrict login access to you and only you. This is my preferred method, as it's easy to set up and provides multiple benefits, including reducing your account's bandwidth usage, possibly improving website load speed, and preventing other administrator accounts from being used to log in to your dashboard.

4. Separate accounts

Not running multiple websites in the same shared account remains one of the most effective ways to reduce costs in the long term. While keeping multiple websites in a single shared account may seem more cost-effective at first, with AI agents roaming the Internet looking for exploits on websites day and night, a single exploit in a single WordPress installation could result in the complete deletion or manipulation of all content within the shared account in literal seconds.

Tools like WHM/cPanel allow websites to be placed in separate accounts.

The future of website security and preparedness

When I sat down to write this, I never intended to scare anyone into action. But it's become clear that we can no longer just hope the software that we count on for presenting our businesses and hobbies online is intrinsically safe and secure.

The actions we take can greatly mitigate the risk that AI bots and agents have created for online content management.

Some may say, "It's over, dump everything and start over with a pre-WordPress style no-code website," or convert everything to an unproven and expensive cloud-based solution. For most of us, that's not practical or is simply cost-prohibitive.

I would argue that you can keep operating as you have for the past several years, but we all need to be more mindful of the implications of future technology and the choices we make for our websites and online presence going forward.

So I'm curious what others are seeing:

• Has AI-driven scanning noticeably changed what's hitting your sites or servers?
• Is anyone still running PHP 7.x in production, and what's holding the upgrade back?
• Are you converting old or abandoned sites to static HTML, or just deleting them?
• IP-restricted logins vs. 2FA: which do you actually use?
• Is "keep WordPress, just be more careful" still a reasonable position, or is it time to move on?

I know. That's not what we've been telling everybody for years.

But a new one making the rounds is a good reminder that sometimes the problem isn't an outdated plugin.

Sometimes the attacker is holding something your site already trusts.

Here's what's being reported. Starting around October 18, attackers were sending commands through UpdraftCentral, the remote management side of UpdraftPlus, and using them to install malicious plugins on WordPress sites.

The commands were passing authentication. That's the part that got my attention.

It doesn't look like a typical "vulnerable plugin" hack. It looks like the attacker got their hands on legitimate management keys.

So you could have:

- WordPress updated

- UpdraftPlus updated

- Strong passwords

- Nothing obviously wrong

…and still have someone installing malware on your site.

:: Updating may not fix it.

Normally my first question is "Is there a patch?" Here, a patch may not cancel a key the attacker already has.

If you use UpdraftCentral, the safest move right now is to disconnect the existing connection until the vendor gives clear guidance. Your regular backups aren't affected by that.

:: Don't trust the Users screen alone.

The malware can create an account that looks like a plain Editor while quietly holding extra admin powers. If you're only hunting for a new "Administrator," you could walk right past it. [hint]

Once a site is compromised, I don't take WordPress's word for what's going on. I want to see the database and the files. The dashboard is helpful, but it isn't evidence.

:: The bigger lesson:

Our sites now connect to backup tools, management dashboards, CDNs, email services, payment systems and, more and more, AI tools. Every one of those trusted connections is another door.

And sometimes the attacker doesn't pick the lock. They steal the key.

If anything on your site has acted strangely since October 18, have someone look at it. Updating the plugin won't remove malware that's already in.

And treat any outside service that can change your site remotely like you'd treat an admin password.

⚠️ WordPress 7.1.3 is now available and fixes 7 security vulnerabilities in WordPress Core, along with 4 additional bugs.

The most important fixes include:

🔹 Stored XSS through pending comments
Malicious code could potentially run when an administrator opens the Comments moderation screen.

🔹 SQL injection in the WordPress export system
Malicious input could remain hidden until someone runs a WordPress export.

🔹 Private comments exposed
Comments on private or unpublished posts could potentially be viewed by visitors who were not logged in.

🔹 Additional fixes
WordPress also patched an Imgur embed XSS issue, a denial-of-service bug, and several permissions-related vulnerabilities.

Interestingly, Anthropic reported 3 of the 7 vulnerabilities, with others reported by Trail of Bits, Patchstack, independent researchers, and the WordPress security team.

There are currently no known reports of these 7.1.3 vulnerabilities being actively exploited.

Still, I recommend updating sooner rather than later.

✅ Update WordPress Core to 7.1.3
✅ Confirm your backups are current
✅ Check older WordPress installations carefully, since some security fixes are still being backported

If automatic Core updates are enabled, your site may already be updated. See:
Dashboard → Updates

Stay patched!