Guide · Website security
Website security for small businesses
Most small-business websites were built once and never looked at again. In October 2026 that stopped being a theoretical problem. This is what to check, in plain English, and what to do about it.
Why this month is different
On October 21, 2026 PHP shipped emergency releases (8.5.12, 8.4.27, 8.3.36 and 8.2.35) for two critical flaws in the PHP engine itself, CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell. Both are rated 9.2 out of 10. Because the flaws are in PHP rather than in any one website, an unpatched PHP server can be attacked with no password and no mistake in your own code.
The US Cybersecurity and Infrastructure Security Agency told organisations to patch immediately, and to take PHP systems offline if they cannot, or if they still run PHP 8.1 or older, which will not be fixed. WordPress, WooCommerce, Joomla, Drupal and Magento all run on PHP.
The fastest way to know where you stand is a free Feli-Scan: 19 passive checks in under 30 seconds, including PHP2Shell exposure.
The checks that matter, in order
From most to least urgent for a typical small-business site:
- Is the server on a patched PHP release? If the version is hidden, ask your host for it today.
- Is there a firewall or CDN in front of the site? It is the same-day stopgap while you patch.
- Are the CMS and plugins current? Outdated plugins are still the most common way WordPress sites are taken over.
- Are secrets exposed? A public
.gitfolder,.envfile or config backup hands over passwords. - Can anyone reach the admin login and XML-RPC? Both invite password guessing around the clock.
- Is HTTPS enforced, with HSTS and a valid certificate?
- Are the browser security headers set? CSP, frame protection, content-type and referrer policy.
- Can someone send email as your domain? Without SPF and DMARC, anyone can.
Fix, then keep it fixed
One clean-up is not enough: the next flaw will not announce itself any more than this one did. The durable answer is a firewall in front of the site, weekly re-scans, patches applied within a day of release, daily off-site backups and someone accountable for all of it.
That is exactly what Feli-Scan Protect does: a Deep Scan & Fix within 24 hours, then continuous protection. If a site is too old to patch, a secure rebuild is usually cheaper than nursing it along.
Where AI fits into website security
Attack tools now use AI to find targets, write convincing phishing in your name, fill forms and probe for weaknesses at scale. That changes the economics: a small site is no longer too small to bother with, because finding it costs an attacker almost nothing.
The same technology works for defenders. Feli-Scan uses automated checks and AI-written explanations so a business owner sees what matters in plain English, and a certified professional reviews anything critical before action is taken.
Questions people actually ask
Before you call
How do I know if my website is affected by PHP2Shell?
If it runs PHP on any version from 5.4 to 8.5.11 it is affected until patched. Run a free Feli-Scan to see whether PHP is detectable and whether the version is disclosed, then confirm the exact version with your host.
Is my site too small to be a target?
No. Automated scanners find vulnerable sites by address range, not by size or fame, and an AI-assisted attack costs almost nothing to run against thousands of sites at once.
What does a website security fix cost?
For a typical small-business site the Feli-Scan Deep Scan & Fix covers the scan, clean-up, patching and hardening, with continuous protection after; see Feli-Scan Protect for current pricing. Sites that need substantial rework are quoted before any extra work.
Is a free online scan enough?
It tells you what anyone on the internet can see, which is what attackers see first. It cannot see inside your server, so it cannot find a backdoor left by an earlier compromise. That takes an authorised deep scan.
In this guide
- What is PHP2Shell, and how do I fix it?Two critical flaws in PHP itself. Here is what they mean for your website and the order to fix things in.
- A WordPress security checklist you can finish in an afternoonWordPress is safe when it is maintained. Most compromised WordPress sites were not maintained. Here is the sho
- Can someone send email pretending to be my business?Yes, unless two small DNS records are in place. This is one of the most common gaps a Feli-Scan finds, and one
Want this applied to your business?
A short call, and an honest read on whether it is worth doing.