Should I Take My Online Store Offline Because of the PHP Flaw?

When a critical flaw is being exploited, “keep selling” and “shut down” both feel risky. Use this guide.

Keep selling if

• Your host confirms in writing that PHP is patched.
• You use a supported PHP version, 8.2 or newer.
• You have backups and a person who can watch the store.

Consider going offline if

• You run PHP older than 8.2, which gets no fixes from the PHP project.
• You manage your own server and cannot patch today.
• You see signs of a break-in.

WordPress.org’s notice says to consider taking the server offline in that case, and it points to the UK National Cyber Security Centre giving similar advice where immediate fixes are not possible.

How to do it without losing customers

1. Put up a maintenance page with a WhatsApp number and email.
2. Pause ads and email campaigns.
3. Patch, test checkout, payments and emails.
4. Bring the store back and watch for errors.

Need help moving fast? Message us on WhatsApp and we will review your setup.

The honest trade-off

Every hour your store is offline you lose sales. Every hour it stays online with an unpatched server you take a risk that grows with the number of automated attacks. There is no free choice, only a choice you make with your eyes open. This guide gives you a framework so you can decide in minutes rather than panic for hours.

The advice from WordPress.org and several national cyber security agencies is consistent in one respect: patch as soon as you can, and where you cannot patch immediately, consider isolating the system. The UK National Cyber Security Centre says organisations should consider taking a system offline until it can be fully mitigated when immediate remediation is not feasible. That wording is careful. It does not say every store must close. It says closing is a serious option when you cannot fix the problem quickly.

A simple decision framework

Answer these questions honestly.

Question 1: Is my PHP version patched, or has my host confirmed it in writing? If yes, keep selling and verify. If your host manages PHP for you and has confirmed the fix, there is no reason to close.

Question 2: Am I running a PHP version older than 8.2? The PHP project no longer supplies security updates for those versions. If you also manage your own server, WordPress.org advises considering taking it offline while you prepare an upgrade.

Question 3: Can I patch within hours? If yes, a short planned maintenance window is better than staying exposed all week.

Question 4: Is there any sign of a break-in? Unknown admin users, strange files or redirects mean you should isolate the store immediately and move to the recovery steps in our hacked-store guide.

Question 5: What does my store hold? A brochure site with an enquiry form carries lower risk than a store with customer accounts, saved addresses and order history. The more personal data you hold, the stronger the case for caution.

If you answered yes to question 1, keep selling. If you answered yes to question 2 or 4 and cannot fix it quickly, plan to go offline. If you are somewhere in between, patch first and decide after.

What offline can look like

Going offline does not need to mean a blank page. There are several levels, and you can choose the lightest one that protects you.

• Maintenance page only. The store is hidden behind a clear message while you patch. Customers see a friendly notice and your contact details.
• Catalogue only. Browsing stays available while cart and checkout are disabled. This protects the sensitive parts and keeps you visible in search.
• Orders by chat. Replace the checkout with a WhatsApp and email prompt so existing customers can still reach you and order manually.
• Full shutdown at the server. The safest option when you suspect a break-in or cannot patch an old server. Use it for as short a period as possible.

How to protect sales while the store is down

1. Write a clear, honest message. Say you are applying an urgent security update and give an expected return time. Customers trust honesty.
2. Publish a contact path. Show a WhatsApp number with country code, an email address and a phone number if you have one. Check each yourself.
3. Pause ads and campaigns. Paid clicks that land on a maintenance page waste money. Pause email broadcasts too.
4. Tell regular customers directly. A short message to your best buyers or distributors prevents confusion and lost orders.
5. Take urgent orders manually. Record them in a spreadsheet, confirm payment through your gateway’s own dashboard and enter them once the store is back.
6. Keep a short checklist so you can return quickly when the work is done.

Will downtime hurt my Google ranking?

A brief planned outage does little damage if the server tells search engines it is temporary. A properly configured maintenance page returns a temporary-unavailable response, which asks crawlers to come back later. Problems arise when the site is down for days, when it returns errors on every page or when it shows a normal page with no products. Keep the outage short, use a real maintenance response and check Google Search Console afterwards for new errors.

The patch plan while you are offline

Use the time well so you can reopen with confidence.

1. Take a full backup of files and database and store it off the server.
2. Upgrade PHP to a supported, patched release.
3. Update WordPress, the theme and all plugins, and remove anything unused.
4. Scan for signs of a break-in and review user accounts.
5. Change passwords and keys if there is any doubt.
6. Test the full customer journey: browse, cart, pay by each method, receive emails, refund.
7. Reopen, then monitor the first day of orders and errors closely.

When you cannot afford any downtime

Some businesses, such as wholesale suppliers or high-volume retailers, cannot simply close. If that is you, there are ways to reduce exposure without a full shutdown. Put a web application firewall in front of the site, ask your host to apply any available temporary protections, disable features that are not essential, such as file uploads and public forms, and apply the interim setting PHP suggested to block one of the attack paths while you prepare the full update. None of these replaces the real fix, so schedule the patch as soon as possible and treat the interim measures as a bridge.

A longer-term answer to the dilemma

The reason this decision is painful is that the store runs on a stack nobody watches around the clock. A purpose-built platform with a named team handling patching, backups and monitoring turns an emergency into a routine task: the team applies the fix, tests it and tells you when it is done. If this week left you uneasy about who is responsible for your server, that unease is useful information. It is worth fixing before the next alert.

Talk to us

NNT Mart can review your current setup and tell you quickly whether to stay online, go offline or move. We also build custom stores and Android and iOS apps on one shared back end, with support terms written down. Message us on WhatsApp or send the contact form and we reply within minutes.

A worked example

Imagine a clothing store with a WooCommerce shop on its own virtual server. It receives about forty orders a day, mostly in the evening. The server runs PHP 8.1. On the morning of the alert the owner reads the WordPress.org notice and checks Site Health.

Using the framework: the PHP version is older than 8.2, the owner manages the server and cannot be sure of a quick fix, and there are no signs of a break-in. The sensible plan is to take a backup, switch on a maintenance page at the start of the quiet morning window, upgrade PHP and plugins on a copy, test, and reopen before the evening rush. The total downtime is about four hours, in the quietest part of the day, with a WhatsApp number on the maintenance page for urgent orders. Compared with a week of exposure, the cost is small.

Now take a different store: a hosted plan where the provider confirmed in an email that PHP was patched the day before. The owner verifies the email, checks the PHP version in the dashboard and keeps selling. No downtime is needed.

Communicating with customers

People forgive a short, honest notice. A good message sounds like this: “We are applying an urgent security update to keep your data safe. Our store will be back by 6 pm. For urgent orders, message us on WhatsApp.” Avoid technical jargon, avoid blame and avoid promising a time you cannot keep. When the store returns, thank customers for their patience and tell them what you did in one sentence.

After you reopen

The first day back is when problems show up. Watch for failed payments, missing emails, error pages and unexpected drops in traffic. Place a test order yourself in the morning and again in the evening. Keep the maintenance page ready in case you need to pause again. Then write a short note of what you did and when, so the next alert is quicker.

How NNT Software can help

If you need to decide quickly, send us your website address and hosting details. We can tell you whether to keep selling, put up a maintenance page or go offline, then handle the patching and testing so you can reopen safely. Longer term, an NNT Mart store on managed cloud infrastructure puts patching and monitoring into a written support plan.