PHP2Shell WordPress Checklist: Patch, Protect and Check Your Site
Short answer
To protect a WordPress site from PHP2Shell, check your PHP version (Tools, Site Health, Info, Server), make sure your host has installed a fixed release (8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer), add firewall protection if the patch is not live yet, then check for signs of compromise such as unknown admin users or PHP files in the uploads folder. WordPress, plugin and theme updates do not fix this flaw on their own.
Key takeaways
- ✓Check the PHP version in Site Health.
- ✓Ask your host for the patch date in writing.
- ✓Use a WAF while you wait.
- ✓Check for compromise after patching.
WordPress PHP2Shell checklist
| Step | How |
|---|---|
| Check PHP version | Tools > Site Health > Info > Server |
| Confirm patch | Ask host which PHP build is live |
| Temporary protection | Cloudflare or host WAF rules |
| Admin users | Look for accounts you did not create |
| Uploads folder | Look for .php files |
| Integrity | Verify core and plugin files |
| Passwords | Rotate if anything is suspicious |
Step-by-step
- Take a fresh backup.
- Check your PHP version in Site Health.
- Contact your host and request the patched PHP build.
- Enable firewall rules if available.
- After patching, review admin users and recent file changes.
- Scan uploads for PHP files.
- Rotate passwords and API keys if needed.
Want this applied to your brand?
We will find the psychology behind your lost sales and show you what to fix first.
Book a Growth AuditQuestions to ask your host
- Which PHP version is my site using right now?
- Has the PHP2Shell fix been installed?
- If not, when?
- Is a web application firewall active?
- Can you move me to PHP 8.3 or newer?
- Do you keep clean backups I can restore?
A worked example
Imagine a Dubai e-commerce store on WordPress and WooCommerce. The owner finds PHP 8.2 in Site Health and asks the host, who confirms 8.2.35 is installed. The owner then removes an unused plugin, checks admin users, and turns on the host firewall. The store keeps selling with less risk.
How Husbar helps
Husbar audits WordPress sites for security, speed and conversion, and works with your host or developer to fix issues. Our funnel and sales page team can take this on end to end, or support your in-house team. book a free Growth Audit.
Questions to ask before you start
- Who manages our hosting?
- Do we have backups?
- Who has admin access?
- Which plugins are unused?
- Is a firewall active?
Key terms
- Site Health: WordPress tool showing server and configuration details.
- WooCommerce: WordPress e-commerce plugin.
- Web shell: malicious file that gives attackers control.
Mistakes to avoid
- Relying only on security plugins.
- Not checking after patching.
- Leaving old PHP versions running.
Why a fast, secure website is a sales tool
Your website is often the first serious impression a buyer gets. A slow, broken or hacked site loses trust in seconds, while a fast, clear and secure one quietly turns visitors into enquiries. Security, speed and conversion are not separate projects: they are all part of making the site earn its keep.
Background: PHP2Shell explained. Also see the website security checklist and AI agents hacking websites.
How do I check my PHP version in WordPress?+
Go to Tools, Site Health, Info, then Server.
Do WordPress updates fix PHP2Shell?+
No, the fix is a PHP update on the server.
Can Cloudflare protect my site?+
Cloudflare reported deploying WAF protections; patching is still required.
What if I find a suspicious file?+
Restore a clean backup, patch PHP and change all passwords.
Is managed WordPress hosting safer?+
Often patched faster, but always confirm.
Does Husbar build websites?+
We plan conversion-focused site structures and build landing pages, sales pages and funnels, and we can work alongside your developer on the rest.
How do I get a website review from Husbar?+
Book a free growth audit and we will review your site for clarity, speed, tracking and lead capture.
Sources
- [Recorded Future: PHP2Shell exploitation explained](https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation)
- [watchTowr: PHP CVE-2026-109618 FAQ](https://watchtowr.com/intelligence/php-cve-2026-109618-faq/)
- [xCloud: PHP2Shell and WordPress emergency checklist](https://xcloud.host/php2shell-wordpress/)
Team Husbar
Husbar Editorial
Team Husbar is the strategy, psychology and research team at Husbar, a psychology-led growth agency headquartered in Dubai. Together we have worked with 100+ brands over 10+ years.
Want this applied to your brand?
We will find the psychology behind your lost sales and show you what to fix first.
Book a Growth Audit