When news breaks about a website security issue, business owners understandably have questions.
Does this affect us? Has someone checked our website? Do we need to do anything? And who is actually dealing with it?
The recent PHP security alert is a reminder of why those questions should have clear answers before something happens.
What happened?
On 21 October, the National Cyber Security Centre issued an alert about critical vulnerabilities in PHP, software used behind the scenes to run many websites. Under certain conditions, these could allow an attacker to run code on an affected server. Security fixes were released, and organisations were urged to act. NCSC advisory
You don’t need to understand all the technical detail. You need to know whether your website is affected and that someone capable is taking responsibility.
What did we do at EBY?
Because we have an in-house developer and manage our websites in-house, we were able to respond quickly.
All affected customer websites have now been safely updated to the patched version. We’ve completed our checks and confirmed that everything is operating as expected. No further action is required from those customers in relation to this issue.
That’s the reassurance we want our clients to have: a clear answer, action taken and checks completed.
Who is looking after your website after launch?
A new website usually gets plenty of attention. There’s the design, the content, the photography and the excitement of getting it live.
But what happens six months later? Who keeps the software updated? Who checks new security alerts? And when something needs fixing urgently, how quickly will your website receive attention?
Your website can still look perfectly normal while the software behind it needs an important update. Waiting until something visibly goes wrong isn’t a maintenance plan.
It’s worth checking what your support arrangement actually covers. Hosting, development and ongoing maintenance can involve different responsibilities. Knowing who built your website doesn’t necessarily tell you who is looking after it today.
When an urgent fix is needed, you shouldn’t have to start working that out.
Five questions to ask your website provider
- Who is responsible for security updates to our website and its hosting?
- How do you identify and assess new security vulnerabilities?
- How are urgent fixes prioritised, and what response does our agreement cover?
- What checks do you carry out after an update?
- Who should we contact if we hear about a security issue or notice a problem?
You don’t need to become a developer. But you should know who is accountable and what support you can expect.
Regular maintenance, with action when it’s needed
At EBY, all our websites are managed in-house. We carry out monthly security updates, alongside updates when new security patches are issued. Urgent issues need attention when they arise, rather than simply waiting for the next routine maintenance date.
Keeping a website running involves work that clients may never see. This incident shows why that work matters.
No provider can promise that a website will never face a security threat. What matters is having clear responsibility, regular maintenance and people ready to respond.
Our clients should be able to get on with running their businesses, knowing their website is being looked after and who to speak to when they have a question.