When you hear about a serious website security issue, taking your WordPress website offline can sound like the quickest way to protect it.
But does that mean installing a maintenance plugin? Hiding your homepage? Asking your hosting company to switch something off?
For a PHP security issue, the important question is whether requests can still reach the vulnerable PHP software.
Let me explain what that means before you start changing your website. If you are still waiting on your host, these WordPress security checks can help in the meantime.
What WordPress maintenance mode actually does
A maintenance plugin usually displays a holding page instead of your normal website content.
It can be useful while you make planned changes. Visitors see a message rather than an unfinished page or work in progress.
However, WordPress and PHP usually continue running behind that message. The server may still process requests, including requests to addresses that visitors do not see on your homepage.
A WordPress maintenance page does not, by itself, isolate vulnerable PHP.
What temporary isolation means
Temporary isolation aims to prevent requests from reaching the affected software until the security fix is in place.
Your hosting provider may block access before PHP runs, stop an affected service or arrange a separate static holding page while the vulnerable service is inaccessible.
This does not usually involve deleting your website. Files and the database can remain stored while access is restricted.
The host needs to confirm that its chosen method provides the intended isolation. The appearance of a holding page alone does not prove that.
What would customers see?
Depending on the arrangement, visitors might see a temporary-unavailable message, a simple holding page or a connection error.
If a static holding page is suitable, it could include your business name, a short message and an alternative way to contact you.
A contact form running through the isolated WordPress website would not be a suitable alternative. A phone number or an email link may be more useful.
Your host can advise whether a temporary-unavailable response can be served without passing requests to vulnerable PHP.
What else could be affected?
Pausing access to WordPress can also pause the things your business uses it for:
- Orders, payments and booking requests.
- Contact forms and email sign-up forms.
- Course, membership and customer logins.
- Connections that send information back to your website.
- Your access to the WordPress dashboard.
Email may continue working if only website access is restricted. Suspending an entire hosting account could affect email and other services too.
Ask what is included before agreeing to a broad account suspension. Your provider should also consider staging sites, subdomains and other PHP applications that could remain accessible.
How do you decide whether isolation is needed?
First, establish whether the PHP serving your website has received the security fixes. A backported fix may mean the displayed version number remains older.
If vulnerable PHP remains in use and cannot be patched promptly, discuss temporary isolation urgently with your host. The US Cybersecurity and Infrastructure Security Agency (CISA) has advised organisations that cannot update immediately to take PHP-based systems offline until they can be patched, and the UK’s National Cyber Security Centre gives similar advice. In Australia, ASD’s ACSC has issued a critical alert recommending that available security updates are applied.
Ask your provider:
- Is my website’s PHP patched, including any backported fixes?
- If it is not, do you recommend temporary isolation?
- How will you prevent requests from reaching vulnerable PHP?
- Which business services would be affected?
- How will you confirm it is appropriate to restore access?
If your PHP is already patched, the announcement alone is not a reason to take the website offline.
After access is restored
Check the features your business relies on, including forms, checkout, bookings and logins. Review any connected services that may have tried to send information during the interruption.
If compromise is suspected, applying the patch alone does not remove existing malicious changes. Investigation and recovery need appropriate hosting or security support.
Need help understanding your hosting advice?
If the reply from your hosting company feels like another language, I can help you work through what it means for your WordPress website.
I offer online WordPress Help to help you understand the next steps, prepare for changes and check important website features afterwards.
Your host handles the server configuration and isolation. I can support you with the WordPress side.
