How do I protect a PHP website from cyber attacks and outages?

Most PHP sites can be protected in a few steps. Keep PHP and every plugin up to date, write code that blocks injection attacks, put a firewall or content delivery network in front of the site, keep tested backups, and know who to call if it goes down.

Why are people searching for PHP and cyber attacks right now?

Google Trends data for the United Kingdom shows several related searches rising together: “cyber attack”, “php websites down”, “php security vulnerabilities”, “php cyber security”, “cloudflare” and “bbc php”. Taken together, they suggest people are trying to find out whether a security problem is taking PHP-based websites offline, and whether Cloudflare or news coverage is involved. The search data does not confirm what happened. It is not known from this source whether there was an attack, a newly disclosed vulnerability, a service outage, or just several unrelated stories at once. This guide does not try to report the event. It explains what site owners can check and do, whatever the cause turns out to be.

What is PHP and why do so many websites rely on it?

PHP is a scripting language that runs on a web server. It builds pages as visitors request them. It has been around since the mid-1990s and sits underneath many widely used content management systems, including WordPress, Drupal and Joomla, as well as many custom shop and booking systems. Because it is so common, small businesses, charities, schools and hobby sites often run PHP without their owners knowing it. That reach is also why attackers pay attention to it. A single flaw in a popular plugin or an outdated PHP version can affect a great many sites at once. Using PHP is not unsafe in itself. Most real-world problems come from old software, poorly written extensions, weak passwords or servers that are set up badly, not from the language.

Why would a website go down during a cyber attack?

A site can become unreachable for several different reasons, and it helps to tell them apart. A distributed denial-of-service (DDoS) attack floods a server with traffic until it can no longer answer real visitors. A compromise is different: an attacker gets in through a vulnerability and changes files, adds malicious code or deletes data, and the host may suspend the account to contain the damage. Defacement replaces pages with the attacker’s own content. Not every outage is an attack, though. Problems at a hosting company, a DNS provider or a content delivery network can take many unrelated sites offline at the same moment. From the outside this can look like a coordinated attack when it is really a technical fault.

How can I tell whether my site is under attack or just having an outage?

Start with the services your site depends on, not with your own code. Check the status pages of your hosting provider, your domain registrar and any content delivery network such as Cloudflare. If they report an incident, the problem is probably not limited to you. Next, look at the error. A 500 error often points to a fault in your application. A 502 or 503 usually means a server further along the chain is overloaded or not responding. Cloudflare-specific errors in the 520 range mean Cloudflare could not get a proper response from your origin server. Then read your access logs for sudden traffic spikes, repeated requests to login pages, or odd query strings. Also look for files that changed recently and that you did not change yourself.

Which PHP security vulnerabilities are most commonly exploited?

The same weaknesses come up again and again:

• SQL injection: user input is placed straight into a database query, so an attacker can read or change data.
• Cross-site scripting (XSS): a page displays unescaped input, so malicious scripts run in visitors’ browsers.
• File inclusion: the code loads a file whose path comes from user input, which can expose or run arbitrary code.
• Unsafe file uploads: someone uploads an executable PHP file disguised as an image.
• Insecure deserialisation: the code unpacks crafted data that triggers unexpected behaviour.

In practice, outdated plugins and themes are one of the most common ways in. Abandoned extensions keep running long after their known flaws stop being fixed.

How do I keep PHP itself up to date?

Each PHP release branch gets active support for a limited time, then security-only fixes, and then nothing at all. The official PHP website publishes a table of supported versions and their end-of-life dates, and it is worth checking. If your site runs on a branch that no longer gets security fixes, plan an upgrade. On shared hosting, you can usually change the PHP version from the control panel. On your own server, update through the operating system’s package manager or a trusted repository. Before switching versions, test the site on a copy. Older plugins and custom code sometimes break on newer releases. Keep the content management system, its plugins and its themes updated as well, and remove any extensions you no longer use.

What code-level habits reduce the risk?

A small set of habits blocks most common attacks:

• Use prepared statements through PDO or MySQLi for every database query, so user input is never treated as part of the SQL.
• Escape output with htmlspecialchars() before showing user-supplied text.
• Store passwords with password_hash() and check them with password_verify(), never with home-made hashing.
• Add CSRF tokens to forms that change data.
• On live servers, turn off display_errors so error messages don’t reveal file paths.
• Check uploaded files by their content, not only their extension, and store them outside the web root.
• Give files and directories the narrowest permissions that still work, so a single flaw can do less damage.

How does Cloudflare or another content delivery network help?

A content delivery network (CDN) or reverse proxy sits between visitors and your server. It can absorb large volumes of DDoS traffic, serve cached copies of pages, and hide your origin server’s real IP address. Many also offer a web application firewall, which filters requests matching known attack patterns such as SQL injection attempts. That gives some protection even before you patch your own code. These services add a dependency, though. If the provider itself has a fault, sites behind it can become unreachable even when their own servers are fine. Also, a CDN cannot repair a site that has already been compromised. It is one layer of defence alongside updates, secure code and backups.

What should I do first if I think my PHP site has been compromised?

Act to contain the damage before you investigate in depth:

1. Put the site into maintenance mode or take it offline, so visitors are not exposed to malicious code.
2. Make copies of the server logs and the current files before changing anything. They may be needed to work out what happened.
3. Change every credential connected to the site: hosting panel, FTP or SSH, database, admin accounts and API keys.
4. Restore from a backup you know was taken before the compromise, then apply all pending updates before going back online.

If you have no clean backup, a specialist cleanup service or your hosting provider may be able to help.

Who should I report a cyber attack to in the UK?

In the UK, the National Cyber Security Centre publishes guidance for organisations and small businesses, and it runs incident reporting routes for significant attacks. Cyber crime in England, Wales and Northern Ireland is reported through the national fraud and cyber crime reporting service run by the City of London Police. In Scotland, it is reported to Police Scotland. If personal data may have been exposed, UK data protection law can require you to notify the Information Commissioner’s Office. For notifiable breaches, this must normally happen within 72 hours of becoming aware of them. You may also need to tell the people affected. Keep a written record of what you found, when you found it and what you did. It makes these reports easier and more accurate.

Sources and further reading

• The PHP Group: the official documentation and the supported versions table for PHP release branches
• OWASP Foundation: published guidance on common web application vulnerabilities and secure coding practice
• National Cyber Security Centre: guidance for small organisations on protecting websites and responding to incidents
• Information Commissioner’s Office: guidance on reporting personal data breaches under UK data protection law

Surfaced from the google:GB signal “PHP website security concerns”. AI-assisted draft, editorially reviewed.