Why WordPress sites get attacked so often
WordPress itself is well maintained. The problem is extensions: in 2025 alone, 11,334 new vulnerabilities were found in the WordPress ecosystem, 91% of them in plugins. Almost half had no patch when they became public, and serious flaws are mass-exploited a median of just five hours later.1 If you don’t maintain your site every day, it will almost inevitably become vulnerable at some point.
PHP2Shell: when the problem sits underneath WordPress
On 21 October 2026 the PHP team fixed two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, each 9.2 out of 10). They let attackers run their own code on the server without logging in, whether it runs WordPress, Joomla or anything else. Only PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or newer are safe.2 For PHP 7.4 to 8.1 there are only source-code fixes, no finished releases, and older versions stay unpatched. Linux distributions often backport fixes without changing the version number, so the number alone is no proof.3
What the check looks at
- PHP version: if your server reveals it, we compare it with the PHP2Shell fixes.
- Visible plugins and WordPress version: anything in the page source can be matched against vulnerability databases automatically.
- xmlrpc.php: an old interface often used to brute-force passwords.
- REST API user list: if usernames are public, attackers only need the password.
- HTTPS and security headers: HSTS, Content-Security-Policy and friends make many browser attacks harder.
What the check can’t do
An third-party check only sees what’s lying around in the open. Whether a plugin really has an exploitable flaw, whether passwords are strong or whether the server is configured cleanly can’t be determined this way. Treat the result as a hint, not an audit.
The alternative: a website without an attack surface
Most business, practice and club websites don’t need PHP, a database or plugins. getmind rebuilds your existing WordPress site 1:1 as a static website: same content, same URLs, no updates. Changes? Just tell the AI. More on PHP2Shell in PHP2Shell: what the PHP vulnerability means for your WordPress site.
FAQ
Is the WordPress security check free?
Yes, no sign-up. To prevent abuse, each visitor can run six checks per ten minutes.
Do you attack my website?
No. We only request the home page and four public WordPress addresses (xmlrpc.php, wp-login.php, the REST API user list and readme.html), just like a normal visitor. No login attempts, no exploits.
Can the check tell whether my site is affected by PHP2Shell?
Only if your server reveals its PHP version in a header. We then compare it with the fixed versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Because Linux distributions often backport fixes, that is a hint, not proof. According to Censys, around 54% of PHP servers hide their version entirely. If the version is hidden, ask your host whether PHP has been updated since 21 October 2026.
My result is green. Is my site secure?
Not necessarily. Green only means nothing suspicious is visible from outside. Outdated plugins without a visible version, weak passwords or server flaws can’t be seen by any third-party check.
Do you store the address I check?
No. The service keeps no log of addresses or results, only anonymous counters (number of checks, how many ran WordPress).
What can I do if the check finds problems?
Keep WordPress, plugins and PHP up to date, remove unused plugins, block xmlrpc.php and the REST API user list, and set security headers. Or move to getmind: we rebuild your site 1:1 as a static website without PHP, database or plugins.