What to do about PHP2Shell

My site runs WordPress

WordPress runs on PHP, so almost every WordPress site is affected until the PHP underneath it is updated. The usual WordPress routine won't fix this one.

What won't fix it

• Updating WordPress, themes or plugins. Still worth doing, but the flaw is in PHP, not in WordPress code.
• Security plugins such as Wordfence, Sucuri or Solid Security. These run inside WordPress. A PHP2Shell attack can be triggered before WordPress even loads, so the plugin never gets a chance to block it.
• Changing passwords. The attack needs no login.
• Maintenance-mode plugins. PHP still runs behind the holding page. If you need the site off, take it offline properly.

What will

1. Check your PHP version. In WordPress go to Tools, Site Health, Info, Server, and check the number.
2. Get PHP updated. On most hosting, including managed WordPress hosting, your host does this. Send them this email. If you run your own server, see the server guide.
3. Add a firewall in front while you wait. A service that filters traffic before it reaches your server does help. Cloudflare's free plan has emergency PHP2Shell rules.
4. Check nothing got in. Attacks started before the fix was public. See was I hacked?

If your site is on old PHP

If Site Health shows PHP 8.1 or older, there's no official fix, and you need to move to PHP 8.2 or newer unless your host has applied a vendor patch. Older themes and plugins sometimes break on newer PHP, so do it carefully:

1. Take a full backup, including the files and the database.
2. Make a staging copy of the site. Many hosts offer this with one click.
3. Switch the staging copy to PHP 8.2 or newer in your hosting panel.
4. Click through the important pages and forms, and check for errors. Update or replace any plugin or theme that breaks.
5. Switch the live site, then check it again.

If a key plugin or theme won't run on PHP 8.2, that's a sign the site needs work anyway. It's no longer getting security fixes either.

Managed WordPress hosting

Managed WordPress hosts usually update PHP across all their servers quickly, without you doing anything. Check our host status page, then confirm your version in Site Health.