Your host controls the layer that was attacked. These seven questions show how well it is covered.
- Which PHP version do I run? It should be 8.2 or newer.
- Is the October 2026 PHP security fix applied to my account?
- Do you have firewall rules against these attacks? Useful as a shield, not a replacement for patching.
- How often are backups taken, and where are they stored? Off-server, at least daily.
- Have you tested a restore? Ask for the last test date.
- Who monitors my server, and how quickly do you respond? Get a time in writing.
- What exactly are you responsible for, and what am I? Server, code, plugins, content.
If the answers are vague, that is information too. NNT Mart can host and maintain your store with these points agreed in writing, along with an Android and iOS app if you need one.
Why your host matters more than you think
When a language flaw like the October 2026 PHP release appears, the first line of defence is whoever controls the server. On a managed plan the host may already have upgraded PHP and added firewall rules before you hear about it. On a basic shared plan you may have to choose the new version yourself. On a virtual or dedicated server the responsibility is entirely yours. Most store owners do not know which of these situations they are in, and that gap is where problems start.
The questions below turn a vague feeling of “my host looks after it” into clear, written facts. Ask them by email so you have a record, and keep the replies somewhere safe.
The seven questions in detail
1. Which PHP version does my account use?
You want an exact version, not “the latest”. It should be 8.2 or newer. If it is older, ask what the plan is to move you and by when. Also ask whether different sites on your account use different versions, because a forgotten test site on an old version can still be a way in.
2. Is the October 2026 PHP security fix applied to my account?
Ask for the answer to be specific about the version number. A good reply names the PHP release you now run and the date it was applied. A vague answer such as “we monitor security” is not confirmation. If your host backports fixes to an older branch instead of upgrading, ask them to say so explicitly and explain which flaw numbers are covered.
3. What firewall protection is in front of my site?
Some hosts add web application firewall rules to block known attack patterns while customers upgrade. Ask whether such rules are active for your account, whether they were updated for this release and whether they can produce a report of blocked attempts. Treat a firewall as a shield that buys time, never as a replacement for patching.
4. How often are backups taken, and where do they live?
A good answer is at least daily for an active store, with copies kept away from the server itself. If backups sit on the same machine that was compromised, they may be compromised too. Ask how long backups are kept so you can go back far enough if a problem is discovered late.
5. When did you last test a restore?
A backup nobody has restored is a guess. Ask for the date of the last successful test and how long a full restore takes. For a store that makes money every hour, restore time matters as much as backup frequency.
6. Who monitors my server, and how fast do they respond?
Find out whether anyone watches the server outside office hours, how you reach them in an emergency and what response time they commit to in writing. Ask whether they alert you about unusual activity such as sudden traffic spikes or outgoing spam.
7. What are you responsible for, and what am I?
Responsibilities often differ from what owners assume. Many hosts look after the physical server and the operating system but not your code, plugins, themes or content. Ask them to list in writing who handles PHP updates, WordPress and plugin updates, malware scanning, clean-up after a break-in and restoring from backup. Anything marked “customer” is yours to arrange.
How to read the answers
Good signs: specific version numbers and dates, written commitments, named contacts, off-server backups and a described restore test.
Warning signs: long delays, generic marketing replies, refusal to confirm versions, backups only on the same server, no emergency contact and responsibilities that stay vague when you push.
If several answers are warning signs, the safest step is not to wait for the next alert. Plan a move to a provider or partner who can meet these points in writing.
Extra questions for more demanding stores
If you take large volumes of orders, run a B2B portal or serve customers in many countries, add these:
- Do you offer a staging environment where I can test updates before they go live?
- Can you roll back a PHP version quickly if an update causes problems?
- Do you provide isolated environments so one compromised site on the account cannot affect another?
- Where are the servers located, and does that meet the data rules of my customers’ countries?
- Do you support two-step login for the hosting panel itself?
- How do you notify customers about security incidents, and how quickly?
Questions to ask your developer as well
The host controls the server, but your developer controls the code. Ask them which plugins and libraries your store depends on, which are no longer maintained, how updates are tested and who is available if an update breaks checkout. If your store has a mobile app, ask where its API runs, which language it is written in and who patches it. An app that talks to an unpatched server exposes every user of the app.
A one-page record to keep
Create a simple document with these headings and fill it in from the replies:
- Host name and plan type
- PHP version and date of last update
- Firewall status
- Backup frequency, location and last restore test
- Monitoring and emergency contact with response time
- Responsibility split between host, developer and you
- Date you last reviewed all of the above
Review it every quarter. It takes ten minutes and turns the next security alert into a short checklist instead of a scramble.
When a managed partner is the better answer
Many small businesses do not want to manage servers, patches and backups at all. They want to sell. A technical partner that builds, hosts and maintains the store as one service can answer all seven questions with a single agreement. NNT Mart builds custom online stores and Android and iOS apps on one back end and agrees support terms in writing, including patching, backups and monitoring. Send us your current host’s answers, or your website address, and we will tell you where the gaps are. Use the contact form or WhatsApp and we reply within minutes.
A sample email you can send today
Copy this and adapt it. Short, specific messages get better answers than long worried ones.
“Hello, I run an online store on your hosting plan for the domain [your domain]. Following the October 2026 PHP security release, please confirm in writing: (1) the exact PHP version my account uses; (2) whether the security fix is applied and on what date; (3) whether firewall rules protect my site; (4) how often backups run and where they are stored; (5) the date of your last successful restore test; (6) your emergency contact and response time; and (7) which tasks are your responsibility and which are mine. Thank you.”
Send it from the email address registered on the account so the host can verify you. If you do not hear back within a business day, follow up by phone or chat and write down the name of the person and the time.
Common failure patterns
These are general patterns that security teams and hosts describe often, not specific cases.
Forgotten test copies. An old staging site on a subdomain keeps running an outdated PHP version and nobody updates it. Delete test copies you do not use or put them behind a password.
Backups on the same server. If backup files sit on the machine that gets compromised, an attacker can remove or encrypt them too. Keep at least one copy elsewhere.
Assumed responsibility. Many hosts cover the server but not your website files, plugins or content. Clean-up after a break-in may be your cost unless the contract says otherwise.
Slow answers in an emergency. A support team with no written response time may reply days after you need it. Ask for the commitment before you need it.
What you can do yourself in ten minutes
Even before your host replies, you can improve your position. Log in to the hosting panel and turn on two-step login if it is offered. Delete test and staging copies you do not use. Check that your backups exist and download one to your own computer or cloud storage. Remove unused WordPress plugins and themes. Update the plugins that have updates waiting. These small steps shrink the surface an attacker can reach.
How NNT Software can help
NNT Software hosts and maintains NNT Mart stores on cloud infrastructure with automated deployments, off-server backups and monitoring, and puts responsibilities and response times in writing. Send us your host’s answers to the seven questions and we will point out the gaps, whether or not you ever move to us.