Your website isn't finished when it launches

Last week's PHP security flaw had a lot of people asking questions about website security. It’s a good moment to talk about something most businesses only think about when it goes wrong: how do you look after a website once it’s live?

One flaw, millions of websites

PHP runs underneath around 70% of websites, including every WordPress site. The flaw wasn't in anyone's website. It was in the shared code underneath.

A typical WordPress site is built from parts that other people write and look after: PHP, WordPress itself, a page builder and a set of plugins. When a weakness turns up in one of them, the same trick works on every site using it.

It's why the most stolen cars tend to be the popular models. Work out how to open one and you can open thousands.

Think of it like running a car

When you buy a car, the price on the forecourt isn't what it costs to drive it. There's tax, insurance and servicing on top, and nobody expects to skip them. A website works the same way.

• Hosting is your road tax. You can't use the road without it. Your website has to live on a server somewhere, and that server needs paying for, powering and keeping up to date. Cheap hosting is fine until you need help.
• Security software and backups are your insurance. You hope you never need them. Server-level security, such as Imunify360, scans for malware and blocks known attacks. Regular backups mean that if something does go wrong, the site can be put back to the last safe point instead of rebuilt from scratch. Ask your host what they run and how often they back up.
• Maintenance is your service and MOT. This is the regular check that keeps everything roadworthy. On a WordPress site, that means updating PHP, WordPress and every plugin, then checking none of them now clash with each other. It also means checking the site still works from a visitor's point of view: pages load, forms send, nothing important has disappeared. Skip a service and the car still runs for a while. Then something fails, and it costs more to fix than the servicing would have.
• A firewall is your paint protection. It's an extra layer on the outside that takes the small knocks before they reach the bodywork. Not every car has it, but it saves a lot of hassle when the roads get rough. Right now, the roads are rough.

Nobody spends their whole budget on the car and leaves nothing to run it. Plenty of businesses do exactly that with their website, putting every pound into the launch and nothing into keeping it on the road.

What a WAF does

A web application firewall (WAF) checks every visit before it reaches your website. Normal visitors get through. Anything that looks like an attack is blocked.

It works like a doorman. It can't fix a weakness in your site, but it can stop people getting in to use it. During the PHP flaw, Cloudflare added blocking rules before the official fix was out, protecting sites behind its firewall while their owners waited to patch.

Budget around 10% a year

A useful rule of thumb is to set aside about 10% of your website's build cost each year for maintenance and security. A £15,000 site would need around £1,500 a year. Treat that as a guide. It can be more if your site holds customer data or pulls data in from other systems.

Why it matters more now

The PHP flaw was found with the help of AI. That cuts both ways. The people trying to break in have the same tools, and old, widely used code is being picked through faster than ever. Expect more of these over the next few years, with less time between a flaw being found and someone using it.

Worth thinking about at your next rebuild

The quickest and cheapest way to launch is WordPress with a page builder and plugins. For lots of businesses that's the right call. The trade-off is more parts to keep updated, every month, for the life of the site.

The alternative is a site built from its own code, using a modern framework such as Next.js. It costs more up front, but there are far fewer third-party parts, and a flaw in someone else's plugin can't reach it. It still needs updates and monitoring, because nothing on the web is maintenance-free. But whoever builds it owns every line of the code, and is accountable for it.

If you'd like a second opinion on how your site measures up, get in touch with our digital team on 01782 618324 or gavin@starbots-creative.co.uk.