--- title: The WordPress Maintenance Checklist After October's PHP Emergency description: "PHP's 21 Oct emergency fix isn't a WordPress update: your host applies it. A 10-point monthly WordPress maintenance checklist, plus what's in WordPress 7.2." image: https://aavishkruti.com/hubfs/wordpress-maintenance-checklist-2026.png --- [![aavishkruti-logo](https://aavishkruti.com/hubfs/Aavishkruti%20-%20Theme%20By%20Milan/aavishkruti-logo.svg) ![aavishkruti-logo-white](https://aavishkruti.com/hubfs/Aavishkruti%20-%20Theme%20By%20Milan/aavishkruti-logo-white.svg)](https://aavishkruti.com/) Products ▾ [Unnati ERP](https://aavishkruti.com/unnati) [ScrapZero](https://aavishkruti.com/scrapzero) Services ▾ CMS & Platforms [HubSpot CMS & CRM](https://aavishkruti.com/services/hubspot) [Shopify & Shopify Plus](https://aavishkruti.com/services/shopify) [WordPress Development](https://aavishkruti.com/services/wordpress) Development [Web App Development](https://aavishkruti.com/services/web-development) [Mobile App Development](https://aavishkruti.com/services/mobile-app-development) Digital & Design [UI/UX Design](https://aavishkruti.com/services/ui-ux) Cloud & AI [Cloud & DevOps](https://aavishkruti.com/services/cloud-devops) [AI & Automation](https://aavishkruti.com/services/ai-automation) Resources ▾ [Blogs](https://aavishkruti.com/blog) [Case Studies](https://aavishkruti.com/case-studies) [Company](https://aavishkruti.com/company) [Contact](https://aavishkruti.com/contact-us) [Get a Proposal](https://calendar.app.google/592wc1kjEv794vbw6) [Get a Proposal](https://calendar.app.google/592wc1kjEv794vbw6) [Home](https://aavishkruti.com/) › [Blog](https://aavishkruti.com/blog) › The WordPress Maintenance Checklist After October's PHP Emergency WordPress # The WordPress Maintenance Checklist After October's PHP Emergency PHP's 21 Oct emergency fix isn't a WordPress update: your host applies it. A 10-point monthly WordPress maintenance checklist, plus what's in WordPress 7.2. A Aavishkruti Aavishkruti · Published Oct 2026 On 21 October, PHP released fixes for "two critical vulnerabilities that can allow unauthenticated remote code execution" ([PHP](https://www.php.net/archive/2026.php)). In plain English, an attacker could run their own code on a web server without logging in. WordPress runs on PHP, so most WordPress sites are affected. The awkward part: "No WordPress update is required or planned for these issues" ([WordPress.org](https://wordpress.org/news/2026/10/critical-php-security-release/)). Clicking "Update" in your dashboard won't fix it. Your host has to. That's a good reason to look at the whole maintenance picture, because WordPress has had a busy autumn. ## What happened to WordPress security this autumn? Three things, in eight weeks. - **PHP, 21 October.** Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get fixes from the PHP project. PHP says the risk is highest on servers using Apache's mod\_php, where it has seen a demonstrated exploit. - **WordPress core, three security releases.** 7.1.1 on 17 September, 7.1.2 on 22 September and 7.1.3 on 6 October. The flaw fixed in 7.1.2 was added to the US government's list of known exploited vulnerabilities on 25 September ([CISA](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)). - **Plugins, every week.** In one week alone (5–11 October), Wordfence logged 655 new vulnerabilities across 406 plugins and 100 themes ([Wordfence](https://www.wordfence.com/blog/2026/10/wordfence-intelligence-weekly-wordpress-vulnerability-report-october-5-2026-to-october-11-2026/)). One example shows why updates matter. All-in-One WP Migration, a backup and migration plugin with more than 5 million active installations, fixed a high-severity SQL injection flaw (CVSS 8.8) in version 7.110 on 20 August ([Wordfence](https://www.wordfence.com/blog/2026/09/5-million-wordpress-sites-affected-by-sql-injection-vulnerability-in-all-in-one-wp-migration-and-backup-wordpress-plugin/)), then two more issues in 7.111 ([WPScan](https://wpscan.com/plugin/all-in-one-wp-migration/)). Two months later, WordPress.org's own statistics show about 51% of sites using it still on a version older than 7.110 (as of 22 October 2026). ## Who is responsible for which part of a WordPress site? A WordPress site has four layers, and each one is patched by someone different. ![Who patches which layer of a WordPress site: your host patches server and PHP; core, plugins and backups sit with you](https://aavishkruti.com/hs-fs/hubfs/wordpress-site-layers-who-patches-what.png?width=2400&height=1280&name=wordpress-site-layers-who-patches-what.png) 1. **The server and PHP:** your host, unless you manage your own server. 2. **WordPress core:** minor and security releases usually install automatically; major versions need someone to press update. 3. **Plugins and themes:** whoever looks after the site, unless auto-updates are switched on. 4. **Users, content and backups:** you. **WordPress maintenance** is the routine of checking and updating all four layers on a schedule, so security fixes land within days, not months. Most problems we see on inherited sites aren't exotic hacks. They're a layer nobody thought was theirs. ## What should you check every month? Ten checks. On a typical small business site, most months take about an hour. ![Monthly WordPress maintenance checklist: PHP version and patches, core, plugins, admin users, backups and Site Health](https://aavishkruti.com/hs-fs/hubfs/wordpress-monthly-maintenance-10-point-checklist.png?width=2400&height=1320&name=wordpress-monthly-maintenance-10-point-checklist.png) 1. **PHP version.** Go to Tools \> Site Health \> Info \> Server. PHP 8.2 gets security fixes only until 31 December 2026 ([PHP](https://www.php.net/supported-versions.php)); WordPress recommends 8.3 or newer ([WordPress.org](https://wordpress.org/about/requirements/)). If you're on 8.1 or older, ask your host to upgrade this month. 2. **PHP patch level.** This month, confirm with your host that the 21 October fixes are installed. 3. **WordPress core.** You should be on the latest 7.1.x release. If not, find out why automatic updates are off. 4. **Plugin updates.** Update everything with a pending update, starting with security fixes. 5. **Unused plugins and themes.** Delete them. Deactivated plugins still sit on the server. 6. **Backup and migration plugins.** These have deep access to your site, so keep them on the latest version. For All-in-One WP Migration, that's 7.112 at the time of writing. 7. **Admin users.** Remove old accounts (former staff, past agencies) and turn on two-factor authentication for every admin. 8. **Backups.** Back up before every update. WordPress's own guidance is to keep at least three backups, stored in different places ([WordPress developer docs](https://developer.wordpress.org/advanced-administration/security/backup/)). Once a quarter, test a restore. 9. **Site Health.** Fix anything marked critical in Tools \> Site Health. 10. **Smoke test.** After updates, submit your contact form, load your key pages and, on WooCommerce, place a test order. ## Should you turn on automatic plugin updates? For most small business sites, yes, for well-maintained plugins, and only with backups running. Since WordPress 5.5, you can switch on auto-updates one plugin or theme at a time, and WordPress emails you the results ([WordPress.org](https://wordpress.org/documentation/article/plugins-themes-auto-updates/)). WordPress's own documentation suggests setting up automatic backups before you do. Keep auto-updates off for plugins that run checkout or payments, and update those by hand after testing on a staging copy. ## What's coming in WordPress 7.2? WordPress 7.2 is due on 8 December 2026, with release candidates from 17 November ([Make WordPress](https://make.wordpress.org/core/7-2/)). It's the last major release of the year and brings a new default theme, Twenty Twenty-Seven. Two changes matter for business sites ([WordPress.org](https://wordpress.org/news/2026/10/wordpress-7-2-beta-1/)): - **A Secrets API** for storing API keys and tokens with encryption, so plugins don't keep them in plain text. - **Image resizing, compression and conversion in the Media Library**, which helps with page speed. Test 7.2 on a staging copy during the release candidates, and don't update a WooCommerce store in the week of Black Friday. The 8 December date falls after the weekend anyway. ## Frequently asked questions ### Does a WordPress update fix the October 2026 PHP vulnerabilities? No. WordPress.org says no WordPress update is required or planned for these issues. The fix is a PHP update on the server, which your host applies. Check your PHP version under Tools \> Site Health \> Info \> Server. ### Which PHP version should a WordPress site run in 2026? PHP 8.3 or newer, which WordPress recommends. PHP 8.2 gets security fixes until 31 December 2026, and PHP 8.1 and older get no fixes from the PHP project. ### What should I check on my WordPress site every month? PHP version and patch level, WordPress core, plugin and theme updates, unused plugins, admin users, backups and Site Health, followed by a quick test of your forms and key pages. ### Is All-in-One WP Migration safe to use? Its known issues are fixed in current versions. Its developers fixed a high-severity flaw in 7.110 and two more issues in 7.111, so keep it on the latest version (7.112 at the time of writing). ### When is WordPress 7.2 released? WordPress 7.2 is scheduled for 8 December 2026, with the first release candidate on 17 November. It ships with a new default theme, Twenty Twenty-Seven. ## How we look after WordPress sites We build custom WordPress sites, and we also take over sites other teams built. The security standard we work to includes two-factor authentication, role-based permissions, automatic backups, plugin auditing and malware scanning. We don't ship and disappear: our support retainers cover security and core updates. **Not sure who looks after your WordPress site?** Get a free WordPress audit and we'll tell you what to fix first. [Talk to our WordPress team →](https://aavishkruti.com/services/wordpress) ### Quick answer Once a month, check four layers of a WordPress site: the server's PHP version, WordPress core, plugins and themes, and users and backups. The critical PHP fixes of 21 October 2026 come from your host, not from a WordPress update. Run PHP 8.2 or newer, keep core and plugins current, remove what you don't use, and test a restore. ### Who looks after your WordPress site? Get a free WordPress audit. We'll check your PHP version, core, plugins, users and backups, and tell you what to fix first. [Book Free Audit →](https://www.aavishkruti.com/meetings/ramesh17) More Insights ## Keep Reading ### [![Figma code layers and Motion, 2026: how the designer–developer handoff moves from static specs to code-backed prototypes](https://aavishkruti.com/hubfs/figma-code-layers-motion-design-handoff-2026.png) Blog Figma Code Layers and Motion: What Changes in the Designer–Developer Handoff Oct 21, 2026](https://aavishkruti.com/blog/figma-code-layers-motion-design-handoff) ### [![AI API price cuts, Sep–Oct 2026: GPT-6 Sol at half the price of GPT-5.6 Sol, Claude Opus 5.5 20% cheaper than Opus 5](https://aavishkruti.com/hubfs/ai-api-price-cuts-october-2026.png) Blog AI Models Got Much Cheaper in Three Weeks. Re-Price the Automation You Shelved. Oct 19, 2026](https://aavishkruti.com/blog/ai-api-price-cuts-automation-cost-2026) ### [![SEO vs AEO vs GEO vs LLMO explained: rank the page, lift the answer, cite the source, describe the company correctly](https://aavishkruti.com/hubfs/seo-vs-aeo-vs-geo-vs-llmo-2026.png) Blog SEO vs AEO vs GEO vs LLMO: What Changes in 2026 Oct 14, 2026](https://aavishkruti.com/blog/seo-vs-aeo-vs-geo-vs-llmo) [Read All Posts →](https://aavishkruti.com/blog) ## Ready to Transform YourDigital Landscape? Let's build something extraordinary together. [Start a Conversation →](https://aavishkruti.com/contact-us) [![aavishkruti-logo-white](https://aavishkruti.com/hubfs/Aavishkruti%20-%20Theme%20By%20Milan/aavishkruti-logo-white.svg)](https://aavishkruti.com/) Your end-to-end digital transformation partner. From strategy and design to engineering and deployment — all under one roof. Services - [HubSpot Solutions](https://aavishkruti.com/services/hubspot) - [Shopify Development](https://aavishkruti.com/services/shopify) - [WordPress](https://aavishkruti.com/services/wordpress) - [Web App Development](https://aavishkruti.com/services/web-development) - [Mobile Apps](https://aavishkruti.com/services/mobile-app-development) - [UI/UX Design](https://aavishkruti.com/services/ui-ux) - [Cloud & DevOps](https://aavishkruti.com/services/cloud-devops) - [AI & Automation](https://aavishkruti.com/services/ai-automation) Company - [About Us](https://aavishkruti.com/company) - [Case Studies](https://aavishkruti.com/case-studies) - [Blogs](https://aavishkruti.com/blog) - [Contact](https://aavishkruti.com/contact-us) Contact - [E. hello@aavishkruti.com](mailto:hello@aavishkruti.com) - [T. +91 97376 65212](tel:+919737665212) - Ahmedabad, Gujrat, India © 2026 Aavishkruti Solutions Pvt. Ltd. All rights reserved. [Privacy Policy](https://aavishkruti.com/privacy-policy) [Terms & Conditions](https://aavishkruti.com/terms-and-conditions) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Aavishkruti", "url" : "https://aavishkruti.com/blog/author/aavishkruti" }, "dateModified" : "2026-10-26T12:15:00.664Z", "datePublished" : "2026-10-26T12:15:00.000Z", "headline" : "The WordPress Maintenance Checklist After October's PHP Emergency", "image" : [ "https://aavishkruti.com/hubfs/wordpress-maintenance-checklist-2026.png" ], "mainEntityOfPage" : { "@id" : "https://aavishkruti.com/blog/wordpress-maintenance-checklist-2026", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://aavishkruti.com/hubfs/aavishkruti-logo-english.png" }, "name" : "Aavishkruti Solutions" } } ```