This week's critical security fix for WordPress sites is not a WordPress update. It's PHP! PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 (21 Oct) fix two remote code execution flaws. WordPress says no WP update is planned. The fix is in PHP itself. What I'd do today per client site: - Check the PHP version: Tools > Site Health > Info > Server. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. - On a managed or shared host? Ask them to confirm the patch. Some Linux distributions patch PHP without changing the version number, so ask rather than guess. - On a VPS , Install the updated packages and restart PHP. That one is on you. - On PHP 8.1 or older? The PHP project no longer ships fixes. Plan the upgrade now and test it on staging first. - Note the version, who patched it and the date. That gives you a two-line client email and a line in this month's report. If your CARE PLAN promises "updates", clients will assume this one is covered too

Your clients might be paying for website maintenance without understanding what they're actually paying for What? Yes! How? 👇 If your agency sells website maintenance plans, check how you're describing them on your website. Many agencies list things like: WordPress updates Backups Security scans Bug fixes But clients don't buy these tasks. They buy peace of mind! Here are 4 ways to make your maintenance plan more valuable 1.Sell the outcome not just the task. Instead of saying "weekly plugin update", explain that you are keeping the website updated to reduce security risks. 2. Make your invisible work visible. Clients rarely see the updates, checks and hardwork you do every month. A short monthly report showing completed work, website uptime, incidents and recommendations gives them a reason to appreciate the service. 3. Mention clearly what's in the maintenance plan and what's not. Explain the difference between daily maintenance, critical bug fixes, content changes and development work. Clear boundaries help prevent awkward billing conversations, remember that! 4. Show clients how you are protecting their website Don't just say we are keeping tab on your website. Show them what it actually means. The best maintenance plans are not the ones with the most tasks. They're the ones where clients understand what they're paying for and why it is important for them Agency owners, What's one thing in your maintenance plan that clients don't appreciate much until something goes wrong?

Review of 374 agency website care-plan pages. 187 of them, almost half don't mention uptime monitoring. But this split surprised me. That doesn't mean those agencies don't monitor. Some probably do it quietly. But if monitoring isn't mentioned in the plan, clients may not know it's included. And if a site goes down without anyone being informed, the client could be the first to notice. A simple fix either way: Already monitoring? Say so on your care-plan page. Not monitoring? Decide how you'll know when a client's site goes down. Already have alerts? Make sure everyone knows who receives them and when the client gets notified. It's a small detail that can make your maintenance service feel a lot more proactive. Agency Owners, do you include uptime monitoring in your care plans, or is it something you handle behind the scenes?

That's how security vulnerabilities infecting whole internet nowadays

PHP2Shell Flaws Threatening Millions of Web Servers. Are you facing any issue too?

When a client site goes down, they don't remember how long it was down. They remember whether they heard it from you first. Two short emails I keep ready: 1. Once you know website is down: "Your site stopped responding at 10:42. We're on it. Nothing for you to do. Next update by 11:15." What happened, when, next update. Don't guess the cause yet. 2. Once it's back: "Down 10:42 to 11:06. Cause: a plugin update clashed with the theme. Rolled back, testing on staging first next time. No data lost."