WordPress after PHP2Shell: patch, harden or move?
After PHP2Shell, a free WordPress audit: PHP patch check, plugin and theme review, and a clear call on hardening WordPress or moving off it.
- Bilingual team
- EN/FR
- Bilingual team
- Typical turnaround
- 5 days
- Typical turnaround
- To move our own 600-page site
- 1 night
- To move our own 600-page site
Patch first. Then decide.
On October 21, 2026, Wiz Research disclosed PHP2Shell, critical flaws in PHP itself. Wiz showed attackers taking over WordPress, Drupal and Joomla sites without logging in. PHP released a patch the same day, and patching is the only complete fix.
The audit starts there, then looks at everything around it and tells you plainly whether to harden WordPress or move off it:
- PHP version and patch status, checked with your host or IT team
- Plugins and theme: what is outdated, abandoned or no longer needed
- Pages, sitemaps, metadata and redirects you need to keep
- Effort for each path: harden WordPress, or move to Ploy or another platform that fits
If WordPress is still the right fit for you, the report says so.
We moved our own 600-page site in one night
Sengo's own site ran on WordPress for two years. Plugins and security upkeep ended up costing more attention than the site was worth, so we moved it to Ploy. Sengo is an official Ploy partner.
About 600 pages left WordPress in one night. Before anything changed, Ploy's agent read every sitemap and all the metadata and found about 50 issues already on the live site, in about an hour. Our one condition was to keep our visibility in search and AI answers. The new site went live after a few evening sessions.
Read the full story in Ploy's case study.
Get Your Free Audit
Submit the form. Get clarity and momentum.
Frequently asked questions
Is our WordPress site affected by PHP2Shell?
Wiz Research reports that every PHP version released in the last decade is affected by at least one of the flaws, so assume yes until your PHP version is patched. The flaw is in PHP itself, so updating WordPress or its plugins does not close it on its own. Ask your host or IT team today, or include it in the audit.
Do we have to leave WordPress?
No. Patching PHP fixes PHP2Shell. Moving makes sense when keeping WordPress, its plugins and its server up to date costs more than the site is worth to you. The report compares both paths for your site.
Where would we move to?
To the platform that fits your needs, budget and team. Sengo is an official Ploy partner, and Ploy is what we chose for our own site. We also work with Optimizely, Sitecore, Kentico, Umbraco, Contentful and other platforms.
Will we lose search rankings if we move?
Not if the move is planned. The report lists your pages, sitemaps and redirects so every URL has a destination. Keeping our visibility in search and AI answers was our one condition when we moved sengo.com.
Does this cover Drupal or Joomla too?
PHP2Shell affects any site running an unpatched PHP version, including Drupal and Joomla. Name your CMS in the form and we will adapt the audit.
