Is Your Website Safe From the Latest Attacks? A PHP and WordPress Security Audit Checklist

Step 1: check the software versions

Start with the layers attackers target most. In WordPress, Tools, then Site Health, then Info shows your WordPress version and, under Server, the PHP version. In a custom PHP application, ask your developer or host, or look in the hosting control panel. Compare against the fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and the latest WordPress (7.1.3 or newer in October 2026).

Then open the Plugins and Themes screens and update everything. Delete any plugin or theme you are not using, because deactivated code is still on the server and still reachable. Pay particular attention to page builders, form plugins and anything that handles file uploads: those were behind the biggest WordPress attacks of 2026.

Step 2: look for signs you were already hacked

Patching does not remove a backdoor someone installed last week. Look at Users and remove any administrator you cannot account for. Check the uploads folder (and plugin upload folders such as uploads/elementor/forms) for .php files; images and documents belong there, code does not. Search Google for site:yourdomain.com and look for pages in languages or on topics you never published, a common sign of SEO spam injection.

Other signs include unexplained redirects on mobile, new scheduled tasks or cron jobs, the hosting company warning about outgoing spam or high CPU, and security plugins reporting changed core files. If you see any of these, stop and treat it as an incident before changing more, so evidence is not lost.

Step 3: lock down access

Turn on two-factor authentication for every administrator, hosting, domain and email account. Replace shared logins with individual accounts so you can see who did what and remove people who leave. Rotate passwords for the database, FTP or SFTP, hosting panel and any API keys stored in the site, especially if the site ran an unpatched PHP version in October.

Limit who can reach the admin area: an IP allow-list, a firewall rule or at least login rate limiting stops most automated attacks on wp-admin and custom admin panels.

Step 4: harden the server and PHP

Hardening limits the damage if something does get through. Disable PHP execution in upload folders, turn off dangerous functions you do not use, hide PHP version headers, set sensible upload and memory limits, and make sure the web server cannot write to the application code. Use HTTPS everywhere with security headers. Our PHP security hardening checklist lists the exact settings.

Step 5: make sure you can recover

A backup you have never restored is a hope, not a plan. Keep daily backups of files and database off the server, keep several days of history so you can go back to before an infection, and test a restore to a staging site at least once a quarter. Add uptime monitoring and file-change alerts so you hear about a problem from a tool, not from a customer.

What a professional security audit adds

The checklist above catches the most common problems. A professional review goes further: scanning for known vulnerabilities across every component, reviewing custom PHP code for SQL injection, file upload and access-control bugs (the OWASP Top 10), checking server configuration, and looking for indicators of compromise in logs and files. You get a written list of findings ranked by risk, with fixes.

WebsNexus security reviews start from $100 and full penetration tests from $800. We can patch what we find, clean up a hacked site, or, if the site is on unsupported PHP that cannot be upgraded cleanly, plan a migration to a modern stack. Message us on WhatsApp at +92 326 6379003 with your website address to get started.