WordPress Has a Big Security Issue: What Therapists Should Do Now

If your practice website was built on WordPress, there's a security issue this week that's worth 15 minutes of your time. Here's the simple version.

Your website lives on a computer owned by your hosting company, the business you pay each year to keep your site online. That computer runs a piece of software called PHP, which is what makes WordPress work. You can think of WordPress as your office and PHP as the building it sits in. This week, two serious weak spots were found in that building. Left unfixed, they could let someone get into a website and take control of it without a password.

This is a big one. US government security agencies, including the NSA, told organizations to fix it right away, and people were already trying to take advantage of it before the fix came out.

I'm writing this because most therapists I talk to have never heard of PHP, and they shouldn't need to. You didn't sign up to manage a web server. But a lot of practice websites run on WordPress with a hosting company in the background, and this is one of those times where it's worth knowing who's responsible for what.

Most good hosting companies installed the fix within a day or two, and security researchers now say a successful attack needs specific conditions on the server, so this is far less likely to hit every site than it first looked. The fix is still worth confirming, because your practice website holds client inquiries and your reputation.

The most important thing to know: updating WordPress or your plugins won't fix this. The fix has to be installed on your hosting company's server. The steps below show you how to confirm it's done, and they take about 15 minutes. If you want the full story and facts, they're further down the page.

Who this is for

Before you change anything, make sure this applies to you.

This is for you if:

• Your website is built on WordPress, and you pay a hosting company (like GoDaddy, Bluehost, SiteGround, WP Engine, Kinsta or Hostinger) to keep it online.
• Your site runs on another platform built with PHP, like Drupal or Joomla. The same steps apply.

Using Showit? Your main pages are built in Showit, but if you have a blog, it most likely runs on WordPress behind the scenes. Showit usually hosts that blog for you, so skip Steps 1 and 2. Go straight to Step 3 and send the message to Showit support instead of a hosting company. If your blog is hosted somewhere else, follow all the steps with that host.

This isn't for you if your website is on:

• Squarespace, Wix, Duda or a similar website builder where you never deal with hosting. The platform manages its own servers, so there's nothing for you to update.
• WordPress.com, the hosted version of WordPress. Its parent company says those sites are already protected.
• A directory profile only, like Psychology Today, with no website of your own.

Not sure which one you have? Type your website address followed by /wp-admin into your browser (for example, yourpractice.com/wp-admin). If a WordPress login page appears, this guide is for you. If you get an error page, your site most likely isn't on WordPress.

If someone else built or manages your site, send them this article instead of making changes yourself. Steps 1 to 3 below don't change anything on your website. They're just checking and asking.

What to do today, step by step

Step 1: Find out who hosts your website

Your host is the company you pay to keep your site online. It's often a different company from where you bought your domain.

• Search your email for your hosting invoice or renewal notice.
• Common hosts include GoDaddy, Bluehost, SiteGround, WP Engine, Kinsta, Hostinger and WordPress.com.
• If someone built your site for you, ask them. They may manage the hosting on your behalf.

Step 2: Check which PHP version your site runs

1. Log in to your WordPress dashboard.
2. Go to Tools , then Site Health .
3. Click the Info tab.
4. Open the Server section and find the line that says PHP version .

Compare your number to this list. You're on a patched version if yours is this number or higher:

• Starts with 8.5: patched in 8.5.12
• Starts with 8.4: patched in 8.4.27
• Starts with 8.3: patched in 8.3.36
• Starts with 8.2: patched in 8.2.35
• 8.1 or lower: No official fix. You need to move to 8.2 or newer.

One caution: some hosts install the fix without the version number changing. That's why Step 3 matters even if your number looks old.

Step 3: Ask your host to confirm in writing

Send this to your host's support team by email or live chat. Copy and paste it as is:

Save their reply. If they can't give you a clear yes, that tells you something about your host.

Step 4: If you're on PHP 8.1 or older, upgrade

PHP 8.1 and older no longer receive official updates, so these sites stay at risk until they move to a newer version.

Most hosts let you change your PHP version in your hosting dashboard. Before you change it:

1. Ask your host to take a full backup, or take one yourself.
2. Make sure WordPress, your theme and your plugins are all up to date, since older plugins sometimes break on newer PHP.
3. Change the version, then click through your homepage, contact page and booking links to make sure everything still works.

If anything breaks, your host can switch you back while you sort it out. If this feels like too much, it's a reasonable job to hand to a web developer.

Step 5: Look after your contact form inquiries

This step isn't about the PHP fix. It's about limiting what's sitting on your server if anything ever goes wrong.

• Check whether your form plugin saves submissions inside WordPress. In plugins like WPForms, Gravity Forms or Contact Form 7 with Flamingo, look for an "Entries" or "Inbound Messages" menu.
• If it does, delete old submissions you've already responded to.
• Consider turning off saved entries so inquiries go straight to your email.
• Add a line near your form asking people not to share clinical details until you've connected.

If you're in the US and subject to HIPAA, or in Canada under PHIPA or PIPEDA, check with your privacy officer or professional body about how inquiries should be stored.

If you think your site was affected

Most sites won't be, especially on a hosting company that moved quickly. These are the signs worth a quick look:

• New administrator accounts you didn't create (in WordPress, go to Users and sort by role).
• Pages in Google you didn't write. Search site:yourwebsite.com and scroll through the results.
• Your site sending visitors to another website.
• A warning from your host, Google Search Console or your browser.

If you see any of these:

1. Contact your host right away and tell them you suspect your site was compromised after PHP2Shell.
2. Ask them to check for suspicious files and restore from a backup taken before October 17, 2026, when the first attack attempts were seen.
3. Change your WordPress, hosting and email passwords, and turn on two-factor login where you can.
4. If client information may have been exposed, talk to your privacy officer or professional body about your notification obligations.

Going forward

This won't be the last flaw like this. AI tools are making it faster for researchers to find serious bugs, and for attackers to use them. A few habits make the next one much less stressful:

• Keep a clear answer to the question "who updates my server?"
• Choose a host that publishes security updates and patches without being asked.
• Keep WordPress, your theme and your plugins updated, and remove plugins you don't use.
• Make sure your site is backed up automatically, somewhere other than the same server.

If you'd rather not manage any of this

Some therapists read a guide like this and decide they'd rather never think about servers, PHP versions or plugin updates again. If that's you, there's another option.

At Thriving Mind Marketing, we build therapist websites on Duda instead of WordPress. Here's what that changes for you:

• No server to look after. Duda hosts your site and handles security updates across its whole platform, so there's no PHP version to check and no host to chase for answers.
• No plugins to keep updated. A typical WordPress site depends on plugins from many different companies, and each one needs its own updates. On Duda, the features you need are built in.
• Easy to edit yourself. You can change text, photos, fees or your availability in a visual editor without touching code or worrying about breaking the layout.
• Ready for clients to find you. Mobile-friendly design, a secure connection and SEO settings come included.

No platform can promise it will never have a security issue. What changes is who handles it. On Duda, keeping the platform patched is Duda's job, so you're not the one reading security news at night.

If you'd like to move off WordPress, we take care of the whole switch, including rebuilding your site and setting up redirects so your existing Google visibility carries over. We can also keep driving your marketing after launch with SEO and Google Ads, so the new site keeps bringing in inquiries. Book a free 15 minute fit call and we'll talk through whether it makes sense for your practice.

The story and the facts

If you want the background, here's what happened and why it matters for your practice.

What happened

On October 21, 2026, the team behind PHP released emergency fixes for two critical security flaws. PHP is the programming language WordPress is built on, so nearly every WordPress site runs on it. Security researchers have nicknamed the flaws PHP2Shell.

Both flaws are rated 9.2 out of 10 for severity. If a server hasn't been updated, an attacker can take control of it without a password or login. The flaws were found by researchers at Wiz, OpenAI and Calif, who used AI tools to show how they could be exploited.

The same day, the NSA advised every organization using PHP to update immediately, or take their systems offline until they can. Government websites in several European countries went offline as a precaution. By that afternoon, security researchers were already seeing attackers try to use the flaws.

This isn't a reason to panic. The fix is out, and most good hosting companies are already installing it. It is a reason to check today rather than assume.

Why this matters for therapists

Most therapist websites aren't targeted on purpose. Attackers scan the internet for any server that hasn't been updated, and small practice sites get caught in that sweep.

Three things are at stake for a private practice:

• Client inquiries. Many WordPress contact forms save every submission inside the website. If someone writes about why they're reaching out for therapy, that message can sit on your server indefinitely.
• Your reputation. A compromised site can start showing spam pages or redirecting visitors somewhere else. Someone searching for help finds something that has nothing to do with you.
• Your search rankings. Google can flag or drop hacked sites, and recovering that visibility takes time.

Why updating WordPress isn't enough. Updating WordPress, your theme or your plugins will not fix this. The flaw is in PHP itself, which sits underneath WordPress on your hosting company's server. Only whoever manages that server can install the fix. For most therapists, that's your hosting company.

Need a hand?

If you're not sure who hosts your site, what your PHP version means, or whether your host's reply is good enough, reach out. I'm happy to take a look and point you in the right direction.

Sources

• NSA Advisory: PHP Updates(National Security Agency)
• PHP News Archive, 2026(PHP)
• PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws(The Hacker News)
• NSA warns organizations to patch critical PHP flaws(The Hill)
• PHP2Shell FAQ(watchTowr)
• PHP2Shell: what to do on your WordPress site(Meow Apps, host status tracker)