Why What Your Website Is Built On Matters More Than How It Looks

Most business websites sit on top of PHP

PHP is the programming language underneath roughly 70 percent of the websites on the internet, according to W3Techs data. WordPress runs on it. So do Drupal, Joomla, and most of the template and page-builder sites small businesses bought over the last twenty years.

The important detail about this week's flaws is where they live. They are not in a plugin, a theme, or anything you did wrong. They are in PHP itself, in code that has been there for about fourteen years. The PHP project's own advisory says there are no complete workarounds: updating is the only safe choice. Keeping WordPress updated would not have protected a site whose server was still running an unpatched version of PHP. The fix had to happen one level below the website, on the server, by someone with the access and the skill to do it.

W3Techs: PHP usage statistics

Wiz Research: PHP2Shell, critical RCE vulnerabilities in PHP

PHP 8.5.12 security release announcement

Every PHP site has a person on the hook for nights like this

An emergency like this one always lands on a person. Someone has to hear about the advisory, log in to the server, apply the update, restart the service, and check that the site still works afterward. For a lot of small businesses, that someone is a hosting company they have never spoken to, or a web designer they pay a monthly retainer.

That retainer is worth understanding. A large part of what it buys is exactly this: standing watch over a stack that needs constant patching. WordPress sites need core updates, plugin updates, theme updates, PHP updates, and database maintenance, forever, because the software is always running and always reachable. When the watch is kept, a week like this one is an inconvenience. When it is not, the site sits exposed. Attackers were already probing for these flaws before the fixes were public, and security firms recorded hundreds of thousands of attempts in the first day after disclosure.

UK National Cyber Security Centre: critical security issue affecting PHP

Wiz Research: PHP2Shell, critical RCE vulnerabilities in PHP

What a KodeCite build removes from the picture

KodeCite builds websites the way modern software is built: as code, compiled ahead of time into finished pages, and served from Vercel's global network. There is no PHP in the stack. There is no WordPress, no plugins, no database connected to the site, and no server waiting for someone to patch it at midnight.

That does not make a website magically safe, and you should be suspicious of anyone who promises that. What it removes is the entire category of emergency that happened this week. The flaws were in a runtime our sites do not use. There was nothing to patch, nothing to take offline, and no retainer standing between our clients and a fix. When a site is finished pages instead of running software, most of the maintenance treadmill simply does not exist.

The honest limits

A code-built site still has accounts to protect with strong passwords and two-factor sign-in. A contact form still sends data somewhere, and that somewhere still has to be reputable. No website is unhackable, and anyone who tells you otherwise is selling you something.

The claim here is narrower, and it is the one that matters for a business owner: your website should not depend on a fourteen-year-old flaw in software you never chose, patched on an emergency schedule by a person you may not have. The platform decision is a risk decision, and it is made once, at the start, whether you make it on purpose or not.

Three questions to ask whoever built your site

1. What does my website run on?

2. When a critical flaw like this week's is announced, who patches my site, and how fast?

3. What am I paying monthly, and how much of it is just keeping the software safe to run?

If the answers are vague, you have learned something important about what you bought. A website you own should be an asset that sits there and works, not a liability that needs guarding every night.