Author: Liam Jenkins

If your website runs PHP, there is an important security update to check. PHP, short for PHP: Hypertext Preprocessor, is programming software that runs on a web server and powers many websites behind the scenes. The PHP project, the group that maintains PHP, has announced two critical flaws known as php2shell. They can let a remote attacker make a vulnerable web server run commands without logging in.

Here is the simple version of how one attack path works. A specially formed upload request reaches a flaw while PHP is handling the request. On one demonstrated server setup, the flaw can be triggered before the website’s own code gets a chance to run its usual checks. It is a bit like a delivery being let into a building before reception has checked it. The PHP team says the risk is highest on that particular setup, but recommends that all PHP installations serving websites are updated. The issue is in the server software, not automatically in the words on your website, its theme or its WordPress version.

That is serious, but it does not mean every small business site has been hacked. The National Cyber Security Centre (NCSC), the UK authority for cyber security, urges organisations to take immediate action because the flaws could allow attackers to run commands on web servers running PHP. The Cybersecurity Service for the European Union institutions, also known as CERT-EU, says early demonstrations of the flaws have started to circulate. A demonstration is not proof that attacks have succeeded, but it makes a prompt check sensible. At the time of its alert, the US Cybersecurity and Infrastructure Security Agency (CISA), the US government body responsible for cyber security guidance, said it had not observed exploitation. The practical next step is to ask whoever runs your hosting to confirm the fix is in place.

What to ask

You do not need to change server settings yourself. Contact your web host, managed website provider or the person who looks after the site. You could send this:

“Could you confirm whether the PHP server running my website was affected by CVE-2026-109618 or CVE-2026-109619, and whether the security fix has been applied? Please tell me the PHP version or vendor security update now in use, and whether I need to do anything.”

The PHP project lists fixed versions as 8.2.35, 8.3.36, 8.4.27 and 8.5.12. If you use WordPress, the number shown for WordPress itself is different from the PHP version. Some hosting companies use their own package numbers, so ask them to confirm that their package includes the fix rather than relying on a number alone.

If you have a WordPress site

You can check the PHP version without changing anything. In your WordPress dashboard, go to Tools, then Site Health, choose the Info tab, open Server and look for PHP version. If you are not comfortable doing that, ask your website person to check it for you.

If the version is one of the fixed releases above, that is a good sign. If it is older, that does not by itself tell you whether your host has applied a backported fix. Ask the host to confirm. PHP 8.1 and older are no longer supported by the PHP project, although some hosting companies and software vendors may provide their own security fixes. Ask whether the version is patched and what their plan is for moving you to a supported release.

If your site is on a managed platform

If your site is built and hosted entirely on a managed platform such as WordPress.com, Wix or Squarespace, the provider looks after the server software, so you usually will not update PHP yourself. Ask the provider to confirm this security fix has been applied and whether you need to do anything.

Check where your site is actually hosted. Sometimes a website uses a separate host, or one part of it runs on another server. In that case, ask the company responsible for that server too. Wix sites do not run PHP directly, but if you use a separate server or custom service alongside Wix, ask whoever runs that part.

If you manage the hosting yourself, or do not know who does

If you rent web hosting or a shared server and manage it yourself, contact the host promptly and ask them to update the PHP package or confirm that an equivalent security patch is installed. Do not copy server commands from a social post or change settings you do not understand. An incomplete temporary measure is not the same as installing the fix.

If you are unsure who hosts the site, check the hosting bill, your domain or website account, or old emails from the person who built it. Your domain registrar may not be the company hosting the website. If no one is looking after the site, find a reputable web developer or managed hosting provider and ask them to identify the host, check PHP, apply the security fix and confirm what they changed.

The main thing is to get a clear answer from whoever runs the server. If you manage your own WordPress site and want help understanding the version number, send me a message and I can point you in the right direction.

Featured image: Brett Sayles on Pexels

A useful website should work for as many people as possible, including people who use a keyboard, zoom in, or rely on a screen reader. You do not need specialist software to spot some common barriers. These checks are a starting point, not a full accessibility audit or proof that a site meets a standard.

Try moving around without a mouse

Open a page and use the Tab key to move through its links and controls. The focus should be visible as you move. Check that you can reach the main menu, buttons and form fields, and that the order makes sense. Press Enter or Space to activate a control, and use Shift plus Tab to move back. If you get stuck, cannot see where you are, or a control only responds to a mouse, note the page and what happened.

Zoom in and check the layout

Increase the browser zoom and make the text larger. Look for text that overlaps, disappears, or forces you to scroll sideways to read ordinary page content. Check that buttons and links remain visible and usable. A page does not need to look identical at every size, but its content should still be accessible.

Check the headings

Headings help people scan a page and understand its structure. Read the page headings on their own. Do they describe the sections that follow? A heading should be a real heading in the page, not just a line made to look larger or bolder. If several sections have no clear heading, add or rename headings so the order is easy to follow.

Look at images and links

Ask what each important image adds. If it carries information, its text alternative should explain the useful point, rather than simply say “image”. If it is only decoration, it should not add distracting words for someone using a screen reader. Read links out of context too. “Read our opening hours” says more than “click here”.

Test a form from start to finish

Can you tell what each field is for before typing? Labels should remain clear when a field is filled. Try leaving a required field blank and submitting the form. Any error should explain what needs fixing and where, without relying on colour alone. Check that the message is readable and that the form can be completed with a keyboard.

A practical first pass

• Use Tab and Shift plus Tab to check keyboard access and visible focus.
• Zoom in and check that content still fits and remains readable.
• Scan the headings and make sure they describe the sections.
• Check the purpose of important images and links.
• Send a test form and read the labels and error messages.
• Write down the exact page and issue, then fix the clearest barrier first.

These quick checks can help me spot some common issues, but they cannot tell me whether a website is fully accessible. I would treat them as a first pass, not a full accessibility audit. If you would like a hand checking your own site, get in touch.

There’s a lot a Google Business Profile can do for a local business. It can help people find you on Google Search and Maps, show practical details such as your opening hours, contact information, photos and reviews, and give them a way to call, get directions or visit your website.

It doesn’t do everything, though. It works best as one part of how you show up online.

What your profile is good at

Think of your Google Business Profile as your shop window on Google: a useful snapshot for someone searching for a business like yours nearby. You can keep the details people need up to date, add photos and respond to reviews.

• Opening hours and contact details
• Your location or service area
• Photos of your work, products or premises
• A link to your website, social page or booking details

It’s worth checking those details from time to time as a customer would see them. If your hours are out of date or it isn’t clear how to reach you, someone may move on before they get in touch.

What it doesn’t do

A profile isn’t a switch that puts you at the top of every local search. I’d think of local visibility as coming down to how well your profile matches the search, how close the searcher is, and how prominent your business is. Where the person searching is matters, and there’s no way to pay Google for a better local ranking. Check your profile from time to time in search and Maps, because the results can vary depending on who’s looking and where they are.

You don’t have complete control over everything people see on the profile either. Google can use information from other sources, and customers can add photos and reviews. Keep your own details accurate and check what appears publicly.

Your profile is one part of your presence on Google. It may point people to Instagram or Facebook, but it doesn’t give you the same space as your own website to bring a menu, service details and a clear way to enquire together in one place. Social media is useful for showing what you’re doing now; older posts can be harder for someone new to find.

Give people a clear next step

If you mainly use Instagram or Facebook, you don’t need to replace them. A simple one-page website can sit alongside your profile and social pages, bringing together what you do, where you work or trade, what people can expect and how to get in touch.

You can link to your website from your Google Business Profile. That gives someone who finds you on Google somewhere clear to go next, while your social posts can keep doing what they do best.

Start by checking your profile on your phone. Is it clear what you offer, where to find you and what to do next? If not, that’s a good place to start.

And if you’d like a hand setting up or tuning your profile, that’s one of the marketing services I offer to local businesses.

You don’t need a full website audit to spot something that needs fixing. Set aside five minutes, open your website on your phone and try these checks as if you were a new customer.

This is a quick first look, not a test of everything your website does.

1. Can you tell what you offer?

Look at the first screen before you scroll. Does it say what you do, who it’s for and where you work, if location matters? Read it without relying on what you already know about your business. If the answer is buried further down, make it clearer near the top.

2. Is the next step obvious?

Try to find out how to enquire, book or buy. Use the route that fits your business. Can you find it without hunting through the menu? A button saying “Send an enquiry” tells someone more than “Learn more” when the next step is a contact form.

3. Can you read and tap everything?

Scroll through your main page. Look for text you have to zoom in to read, buttons that are awkward to tap and content cut off at the edge. Open the menu too. Check your most important pages, not just the homepage.

4. Does your enquiry form work?

On your own website, send a short message clearly marked as a test. Can you complete the fields on your phone? Does the page tell you it has been sent? Then check that it reaches the inbox or system where you normally receive enquiries. A success message alone doesn’t check that last step.

5. Are the details still right?

Check your services, contact details and any opening hours, prices or booking links you show. Tap the links rather than assuming they work. Remove uncertainty for the reader by keeping those details current.

Start with what gets in the way

Write down what you found. I’d start with anything that stops someone contacting you, then work through the smaller fixes. You don’t have to rebuild the whole website to tackle a specific problem.

If you’d like help checking your website or sorting the fixes, send me an enquiry.