hello@kootenaymade.ca
Castlegar, BC. Serving the Kootenays and beyond.
5 min read
Key takeaways
- Your host installs the fix on most shared hosting, so your job is to ask the right questions.
- Good answers are specific. They name a version, a date or a person.
- Ask when the last backup was restored to test it, which is different from when it was taken.
- Keep the answers on file and ask again after the next alert.
On this page
Why ask your web host anything after an alert?
Because on most hosting, the fix is in their hands. PHP2Shell is a good example. In October 2026, two critical flaws in PHP, the language under WordPress and much of the web, got fixed releases on October 21. Every site on PHP needed its host to install the fix and restart the server.
On shared hosting, the owner has no way to install that fix. What the owner can do is ask, and a few clear questions get a clear picture fast. If PHP2Shell is the alert that brought you here, my guide on how to check whether PHP2Shell affects your website has a short message you can copy and send today.
What are the best questions to ask your web host?
These six questions to ask your web host work for any alert, this one and the next. Each one comes with what a good answer sounds like and what a worrying answer sounds like.
- 01
Which version of the software does my site run?
A good answer. They name the exact version, such as PHP 8.3.36, and the version of WordPress or whatever runs on top of it.A worrying answer. “The latest” or “it’s all handled,” with no number attached.
- 02
Is the fix already in place, and if not, when will it be?
A good answer. A yes with the date it went in, plus confirmation the server was restarted. If the fix is not in yet, they give a clear date for it.A worrying answer. “We are looking into it,” days after the fixed releases came out, with no date given.
- 03
Who watches for security alerts?
A good answer. A team or a named person reads the advisories and applies updates without waiting for you to ask.A worrying answer. “You should keep an eye on that,” when you pay them to host the site.
- 04
How do backups work, and when was the last one tested?
A good answer. How often backups run, how long they are kept, where they are stored, and the date somebody last restored one to check it worked.A worrying answer. “We take backups,” and nothing more. Or nobody remembers ever restoring one.
- 05
What happens if my site is broken into?
A good answer. The steps they take, what they clean or restore, what it costs, and how quickly they tell you.A worrying answer. “We would suspend the account,” with nothing about cleanup, cost or how you would hear about it.
- 06
Who do I call?
A good answer. A phone number or support line with stated hours, answered by someone who can see your account.A worrying answer. A general inbox with no stated response time.
The backup question is the one most people skip. Nobody knows a backup works until somebody restores it. Ask for the date of the last test restore, and ask how long a restore takes.
Good answers name a version, a date or a person.
What if my host’s answers worry me?
One vague answer is a reason to ask again in writing. Several vague answers are a reason to plan a move, because the next alert will likely land the same way.
Before you move anything, make sure the domain is registered in your name. My guide to who owns your website and domain walks through how to check.
Then look at how many things on your site need patching at all. A hosting platform that patches its own servers takes part of the job off your list. A site with fewer moving parts takes off more. I explain how I approach that in small business website security, and how I build with fewer ways in.
What should I keep on file?
Write the answers down where you can find them during a bad day. The middle of an emergency is the wrong time to search old emails for a support number.
- The date you asked, and the host’s reply word for word.
- The software versions they named, so you can compare them next time.
- The support phone number and hours, somewhere other than your email.
- Where the backups live and how to ask for a restore.
- Who holds the logins for your hosting, your domain registrar and your email.
Read the file again after the next alert. If the versions are the same as last year, ask why.
Sources and further reading
- Rapid7: critical unauthenticated remote code execution in PHP
Checked October 23, 2026. The PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, and the fixed releases from October 21.
- Patchstack: PHP major vulnerability alert, October 2026
Checked October 23, 2026. The PHP2Shell timeline for site owners and hosts, including the October 21 fixed releases and restarting every worker after the update.
Frequently asked questions
How often should I ask my web host these questions?
Once when you sign up, once a year after that, and again whenever a big alert like PHP2Shell is in the news. Keep the answers on file so you can compare them each time.
Is it rude to ask my host about security?
No. These are ordinary questions about a service you pay for, and a good host expects them after a big alert. A short, specific message usually gets a short, specific reply.
What if I do not know who my web host is?
Look for the company you pay for hosting on your card statement or in your email receipts. If a designer or an agency set the site up, ask them. If nobody knows, that is worth fixing before the next alert, starting with who holds the logins.
Do Wix, Squarespace and Shopify owners need to ask these?
Mostly not. On those platforms the company runs the servers, so the version and fix questions answer themselves. It is still worth knowing how to reach support and what they do if your account is taken over.
Related pages
Kootenay Made Digital
I build websites, local presence, and calm AI setups for Kootenay small businesses. Prices are published, and the work is built to make you easier to find and easier to choose.
