PHP2Shell showed that a vulnerability in PHP core can bypass application code entirely. We harden the server and PHP configuration underneath your site, not just the CMS on top of it.
We lock down PHP and server configuration directly, so individual sites, plugins or themes can't quietly override critical security settings.
Every site, staging copy and microsite on your hosting gets documented and patched on a schedule, so nothing is left running unmaintained.
You work with someone who already knows your hosting setup, not a rotating queue that needs re-briefing every time.
The PHP2Shell vulnerabilities sat in PHP core itself, not in any particular application. Wiz Research demonstrated the bug against a plain "Hello World" PHP page as well as the latest WordPress, Drupal and Joomla images, which is why every PHP site was exposed regardless of what it was actually running, as we covered in our explainer on the vulnerability.
Because the bug was application-agnostic, keeping your CMS updated was never going to be enough on its own. A PHP version still running past end of life underneath a perfectly up-to-date CMS is exactly the kind of gap hardening is meant to close, along with the forgotten staging copies and microsites that quietly share the same server.
Most businesses can name the one website they actively manage. Far fewer can list every staging copy, old campaign microsite or test subdomain still live on the same hosting account - and PHP2Shell didn't care which one you'd forgotten about, because the vulnerability worked against any PHP installation serving web requests.
Website server hardening - locked configuration, a web application firewall, isolated PHP-FPM pools and proper monitoring - reduces how much damage the next vulnerability can do, whatever it turns out to be, rather than reacting to each one individually after the fact.
Secure web hosting for business sold cheaply often means a firewall switched on and little else. Proper hardening is broader than that, and the gap tends to show up at exactly the wrong moment - when a vulnerability in PHP core bypasses the application layer entirely.
A documented list of every live site, staging copy and microsite on your hosting, each on a scheduled patch cycle rather than updated only when someone remembers.
Critical settings applied with php_admin_value at the PHP-FPM pool or Apache level, so individual sites or plugins can't override them, plus request size and field limits enforced at the proxy.
WAF rules in front of every site, with logging and alerting tuned to the signals that matter - unusual worker churn, spikes in server errors, unexpected files appearing.
Each site runs in its own pool with its own permissions, so a compromise on one site can't reach across the server to the others sharing it.
File integrity monitoring and alerting tuned to flag worker churn and sudden spikes in server errors - the kind of signal that shows up before a compromise is obvious to anyone looking at the site itself.
Backups are stored away from the server they protect, so a compromised host can't take its own safety net down with it.
From first conversation to a hardened, monitored hosting setup - our process keeps things simple.
Every site, staging copy and microsite on your hosting gets listed and assessed, including the ones you may have forgotten about.
PHP and server settings are locked down, WAF rules deployed, and PHP-FPM pools separated so one site can't affect another.
File integrity monitoring and alerting are put in place for the signals that actually matter, not just a basic uptime ping.
Critical patches are applied on a documented schedule, and sites nobody needs any more are retired rather than left running.
We start with an inventory - every site, staging copy and microsite on your hosting documented, not just the one you remember to mention.
Critical settings are locked at server configuration level, so individual plugins or sites can't quietly override them later.
We work across WordPress, Laravel, Symfony, Magento and custom PHP, including sites built through our own WordPress website design work and sites we didn't originally build.
A web application firewall and request limits sit at the proxy layer, reducing exposure regardless of which application-level vulnerability turns up next.
PHP-FPM pools are separated per site, so one compromised site can't reach across your server to the rest - and where the underlying issue is simply an end-of-life PHP version, we'll say so and offer to upgrade it properly.
File integrity monitoring and alerting are tuned to the signals that matter, backed by off-server backups as the last line of defence if something does get through.
This ties directly into our Cyber Essentials audit and penetration testing work for businesses that need to evidence their security formally, not just improve it informally.
Every engagement is scoped to your hosting setup and number of sites - here's a rough guide to where most businesses land.
One site or application on shared or dedicated hosting
Several sites, staging copies or microsites on one server
Larger hosting estates or businesses working towards Cyber Essentials
We treat your hosting as infrastructure to secure properly, not a CMS with a firewall bolted on. Here's what sets our hardening apart.
We document every site and microsite on your hosting before hardening anything, so nothing gets left behind.
Critical settings are locked at configuration level, not left for an individual plugin or site to override.
We can fix what the audit finds directly, not just flag it and leave the work to you.
WordPress, Laravel, Symfony, Magento or custom PHP - we harden across all of them, not one narrow stack.
You'll never chase a ticket queue. Every client gets a named point of contact for anything security-related.
Alerting is set up for worker churn and error spikes, the signals that matter, not just a basic uptime ping.
You continue to own your code, content and hosting outright, with nothing proprietary locking you into our service.
You know exactly what's being hardened and monitored before work begins, with nothing added on quietly later.
A clear, plain-English record of what's been found, locked down and monitored, with no jargon-filled changelog.
We deliver website security hardening to businesses across the UK remotely, so your location doesn't change the level of attention your hosting receives. Whether you run WordPress, a custom-built platform or several sites on one server, we scope hardening around your actual setup rather than a one-size-fits-all bundle. Because we also provide broader IT support and managed services, we can look at the full hosting environment around your sites, not just the application layer.
This matters because a compromise rarely announces itself cleanly. Unusual worker churn, a spike in server errors or a malformed session cookie can look like a minor bug right up until it's confirmed as something worse. Hardening that only ever looks at the CMS will miss these signals, which is why we monitor the server and PHP layer underneath as part of any proper hardening relationship, not just the pages a visitor sees.
Businesses generally take one of a few approaches to website security, and it's worth being honest about what each one does and doesn't cover.
CMS updates alone: necessary, but not sufficient - PHP2Shell showed that a bug in PHP core can bypass application code entirely, regardless of how current your CMS and plugins are.
A web application firewall only: useful temporary cover - Cloudflare's emergency PHP2Shell rules were explicitly described as temporary - but not a substitute for fixing the configuration underneath.
DIY server hardening: achievable with the right expertise, but keeping every site on a server inventoried and patched is easy to let slip without someone specifically responsible for it.
Managed website security hardening: ongoing inventory, locked configuration, monitoring and patch cadence handled as one relationship, with retired sites taken offline rather than left running quietly.
Coverage
We harden websites and hosting for businesses across the UK remotely, with London-based on-site availability for businesses that want a face-to-face meeting.
website security hardening
Server and PHP-level hardening, a web application firewall, isolated hosting pools and monitoring that keep your sites secure beyond CMS updates alone.
managed website security uk
Website and web server security hardening delivered remotely across the UK, covering WordPress, custom builds and multi-site hosting.
Got questions about our website security hardening service? We've answered the most common ones below. If you need more detail, get in touch.
An inventory of every site on your hosting, locked PHP and server configuration, a web application firewall, isolated PHP-FPM pools per site, and monitoring tuned to catch unusual activity early.
No - the two work together. PHP2Shell showed that server-level hardening catches what application patching alone can't, but you still need both to be properly protected.
It's a setting applied at the PHP-FPM pool or Apache level rather than in application code, so individual sites or plugins can't override it even if they try - useful for locking down critical security settings server-wide.
Yes - we start every engagement with an inventory of every live site, staging copy and microsite on your hosting, including ones you may have forgotten about.
Yes, WAF rules are deployed in front of every site we harden, alongside request size and field limits enforced at the proxy.
Cyber Essentials requires supported software with critical patches applied within 14 days. Our patch cadence and inventory work directly supports that requirement.
Isolated PHP-FPM pools mean a compromise on one site is far less likely to reach the others on the same server, and off-server backups mean you can restore quickly rather than rebuild from scratch.
Yes - many clients combine hardening with our PHP upgrade service, so the server configuration and the PHP version underneath it are both brought up to date together.
In most cases we work with your existing hosting provider. We'll tell you plainly if your current hosting can't support proper hardening and a move would genuinely help.
Inventory, locked configuration and monitoring, scoped to your hosting
We believe that communication is key to any successful project. Tell us about your hosting setup and one of our team will be in touch to scope the work.
Tell us about your hosting setup and one of our team will be in touch to scope the work
Powered by industry-leading technologies including SolarWinds, Cloudflare, BitDefender, AWS, Microsoft Azure, and Cisco Meraki to deliver secure, scalable, and reliable IT solutions.
22 Oct, 2026
Fixed wireless access delivers business internet over radio rather than a cable into the building, and for many UK businesses it is a genuine primary...
21 Oct, 2026
Row-level security reporting means building dashboards that show each person only the rows of data they are entitled to see their own region, their own team,...
20 Oct, 2026
Good LLM integration architecture is what separates an AI feature that keeps working for years from one that becomes a maintenance burden within months. The...