# PAGE-COPY · Site security subscriptions Drafted Thu Oct 22, 2026, ~3:00 PM PT for json's local crew. Hand-off only: nothing built, deployed, posted or set up in Stripe. Legend: `[PILL]` small all-caps label, `[BUTTON]` call to action, `[NOTE TO CREW]` not for the page, `{curly}` = placeholder or DECISION json fills before launch. House rules: no em dashes, straight quotes, US spelling, only studio figure "about fifty live sites", no testimonials, no deal copy, no fear copy, no countdowns, no guarantees. Pills and buttons ALL CAPS, no "!", no prices, no vendor names in pills. --- ## 0. Meta - Slug: `{/services/site-security/, DECISION D10; alternate /services/website-security/}` - Title (≤60): `Website Security Plans for WordPress | JKCA Studio` (50) - Meta description (≤160): `Patching, backups with restore tests, and plain-English monthly reports for WordPress and PHP sites. Start with a free site check from a Seal Beach studio.` (155) - One H1. JSON-LD: one `Service` node with `provider` `https://jkca.studio/#org`, an `OfferCatalog` of the four offers, no prices until json sets them. FAQPage optional; if used, it must match the visible FAQ word for word. --- ## 1. Hero [PILL] SITE SECURITY # Keep your WordPress site patched, backed up and checked We keep PHP, WordPress and plugins up to date, test that your backups actually restore, and send you a short monthly report in plain English. A small studio in Seal Beach, looking after about fifty live sites. [BUTTON] BOOK A FREE SITE CHECK → `/contact/?topic=site-security` [BUTTON] SEE THE PLANS → `#plans` Small line: No one can promise a site will never have a problem. We can promise to tell you plainly what we checked, what we changed and what we couldn't see. [NOTE TO CREW] Calm hero, same template as the other /services/ pages. No red, no alert bar, no countdown. --- ## 2. Why now, briefly [PILL] OCTOBER 2026 ## The October 2026 PHP fixes On Oct 21, 2026 the PHP project fixed two serious flaws in PHP itself, known as php2shell (CVE-2026-109618 and CVE-2026-109619). Every WordPress site runs on PHP, so the fix is a PHP update on the server, not a WordPress or plugin update. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older 8.1, 8.0 and 7.4 sites can get an official minimal patch from their host; the version number stays the same, so the thing to check is a PHP build dated Oct 21, 2026 or later. If you only want help with this one fix, see [PHP patch help]({/services/php-patch/}). If you want it handled every month from here on, read on. --- ## 3. Plans [PILL] PLANS ## Four ways we can help Anchor: `id="plans"` [NOTE TO CREW] Card layout like care-plans. Prices and promises stay as `{DECISION}` until json sets them. No "most popular" badge unless json asks. No strike-through prices. ### One-time patch check [PILL] ONE-TIME {Price: DECISION D1} For any WordPress or PHP site. We check your PHP, patch it or get your host to, restart it, confirm it from the live site, and look through the logs we can reach for signs of trouble. You get a short written note. - PHP patched and confirmed from a live page - WordPress, plugin and theme updates listed - One look through your logs for known warning signs - If your host controls PHP, we ask them in writing and tell you their answer {Turnaround: DECISION D2} [BUTTON] BOOK A FREE SITE CHECK ### Watch [PILL] MONTHLY {Price: DECISION D3} For owners whose host or team does the updates and who want an outside eye. - Uptime and certificate checks, with a person reading every alert - Weekly check of PHP, WordPress and plugin updates waiting - We confirm your backups exist and are recent - Monthly plain-English report - No updates applied by us [BUTTON] ASK ABOUT WATCH ### Patch [PILL] MONTHLY {Price: DECISION D3} For small-business sites that want updates handled and checked. - Everything in Watch - WordPress, plugins and theme updated weekly, after a fresh backup - PHP security releases applied and confirmed, or chased with your host in writing - Daily offsite backups, with a test restore every quarter - Cloudflare set up in front of your site, if you want it - {Incident hours: DECISION D3} a month for looking into anything odd [BUTTON] ASK ABOUT PATCH ### Harden [PILL] MONTHLY {Price: DECISION D3} For sites that take payments, bookings or logins. - Everything in Patch - Updates tested on a copy of your site first - Daily log checks and file-change alerts - Server and WordPress settings tightened, and checked each month - Test restore every month - Firewall rules kept current as new advisories come out - {Incident hours: DECISION D3} a month, plus an optional quarterly call [BUTTON] ASK ABOUT HARDEN Small line under cards: Per site, month to month. 30 days notice to stop. Extra work is {hourly rate, DECISION D12}, quoted before it starts. {DECISION D3: annual billing yes/no} Small line: Would you rather stop running WordPress? Our [care plans](/services/care-plans/) host your site with no login page and no database, and we can [move it for you](/services/wordpress-migration/). --- ## 4. What we don't do [PILL] PLAIN TERMS ## What's not included - Promises that a site can't be broken into. No one can honestly make one. - Cleanup after a confirmed break-in, beyond your plan's included hours. We stop, explain what we found, and quote before doing more. - Forensic investigations, breach notices or legal advice. - Custom code, redesigns or content edits (see [care plans](/services/care-plans/) or ask for a quote). - Hosting fees and paid plugin or Cloudflare licenses. ## When your host controls PHP On a lot of shared and managed hosting, only the host can update PHP. When that's the case we check everything we can from outside and inside WordPress, ask your host in writing which PHP build is live, and put their answer, with the date, in your report. We never say a site is patched until the host confirms it in writing or we see it on a live page. --- ## 5. How it works [PILL] HOW IT WORKS ## From first check to first report 1. **Book a free site check.** Send the address and who hosts it. We run a few public, read-only checks: PHP version if shown, certificate, security headers, and whether the WordPress version is on display. 2. **We reply in writing** with what we saw and which plan fits, if any. {Reply time: DECISION D2} 3. **You say yes.** We send a quote or a payment link. Nothing starts before that. 4. **You give us access** through your own invites, so you can remove it any time. No passwords by email. 5. **We take a backup, then do the first pass:** patch, restart, confirm, and look for warning signs. 6. **You get your first report**, including what we couldn't see. [BUTTON] BOOK A FREE SITE CHECK → `/contact/?topic=site-security` --- ## 6. Outside view (optional, DECISION D11: Critic recommends cut) [PILL] THE BASICS ## Why we focus on the basics > "as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)" > > Jason D. Clinton, Deputy Chief Information Security Officer at Anthropic, on X, Oct 22, 2026. [Post](https://x.com/JasonDClinton/status/2113325263157395456) He was writing to security leaders at large companies. The part we take from it for a small business is the last line: the basics. Patched software, backups that restore, and someone reading the logs. [NOTE TO CREW] Quote is verbatim, including his lowercase. Only the X post is linked (no news article). Don't trim it into a scarier sentence, don't make it a headline, don't put it in the hero. If kept, add "Quote checked {date}" and the X link to the sources block. Critic's view: the quote's "a lot worse" and "right now" read as fear and urgency on a sales page, and an executive's quote next to our plans can read as an endorsement. --- ## 7. FAQ [PILL] QUESTIONS ## Common questions ### Do I need this if my site is on a JKCA care plan? Most care plan sites don't. Our care plans host static sites with no PHP, no login page and no database, so php2shell doesn't reach them. We'll confirm it for your site and tell you. Store sites on WooCommerce are different; ask us. ### What's the difference between this and a security plugin? A plugin runs inside WordPress. The October PHP flaws sit underneath WordPress, in PHP itself, so a plugin's firewall can't stop them. Wordfence's help pages describe its firewall as running inside WordPress. We work on the PHP, the updates, the backups and the logs. ### Can you promise my site won't be hacked? No, and be careful with anyone who does. What we promise is the work: updates on a schedule, backups we've actually restored, a person reading alerts, and a written report of what we checked and what we couldn't see. ### My host says PHP is patched. Is that enough? Often it is. We still check it from a live page, and ask the host in writing which build is running. On PHP 8.1, 8.0 or 7.4 the version number doesn't change after the patch, so we check the build date: Oct 21, 2026 or later. ### What warning signs do you look for? For php2shell, the public ones researchers have shared: a scanner user agent named php2shell-scan, upload requests carrying PHP's upload-progress field, bursts of memory errors, PHP starting programs like wget or curl, a file at /tmp/nfs, new PHP files in the uploads folder, and admin users nobody recognizes. A sign isn't proof. We check before we tell you anything is wrong. ### Do you test backups? Yes. Patch includes a test restore to a copy of your site every quarter, and Harden every month. The report says when and whether it worked. ### What happens if you find a real problem? We tell you what we found, in plain words, and what we suggest. Small things come out of your included hours. Anything bigger we quote first. ### How fast do you respond? {DECISION D5 answer}. We're a small studio, not a 24-hour call center, and we'd rather tell you that up front. ### Can I cancel? Yes. Plans are month to month with 30 days notice, like our care plans. You remove our access when we're done. ### Do you only work with Seal Beach businesses? No. We're in Seal Beach and work with businesses across Long Beach and Orange County, and the work is remote, so your site can be hosted anywhere. --- ## 8. Closing CTA [PILL] NEXT STEP ## Not sure where your site stands? Send us the address and who hosts it. We'll run a free, read-only check and tell you what we see. Nothing starts until you say yes. [BUTTON] BOOK A FREE SITE CHECK → `/contact/?topic=site-security` [BUTTON] TALK TO A HUMAN → `/contact/` --- ## 9. Sources (visible, bottom of page) Facts last checked {date and time PT}. - PHP Foundation, Oct 21, 2026: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ - CISA alert, Oct 21, 2026: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching - Plesk, patched 7.4, 8.0, 8.1 builds dated Oct 21, 2026: https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk - CloudLinux alt-php81 changelog: https://changelog.cloudlinux.com/alt-php81 - Sophos advisory, what to look for in logs: https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell - Sophos research blog, indicators (php2shell-scan user agent, /tmp/nfs) and its Oct 22 correction: https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619 - Vendor firewall statements, collected: https://php2shellcheck.com/guides/cloudflare-waf/ [NOTE TO CREW] Curl every link for 200 before launch. Plesk returns 403 to curl (bot block) but loads in a browser; keep it and note it as browser-checked. Wordfence is paraphrased only (no quotation marks): its blog blocks our fetchers, so the "essential" line is secondhand. If a browser check of Wordfence's own post confirms the wording, Critic may allow the quote back.