It Was a PHP Problem, Not a WordPress Problem, FFS!

Speaker: 00:00:00

So a week or so ago, a bug in PHP took websites offline all over the world.

Speaker: 00:00:07

Within minutes, some LinkedIn wanker was telling you to bin your WordPress site.

Speaker: 00:00:12

Sit down.

Speaker: 00:00:13

We need to talk.

Speaker: 00:00:17

This is SEO Fucking What.

Speaker: 00:00:18

I'm Nikki.

Speaker: 00:00:19

I've been doing SEO for over 30 years, since before anyone called it SEO, and

Speaker: 00:00:24

I help people like you make money from your website by getting found on search.

Speaker: 00:00:30

Today's episode started life as a LinkedIn post I wrote in a fit of rage, and I've

Speaker: 00:00:35

got more to say than LinkedIn will let me.

Speaker: 00:00:38

It's about the PHP mess, the WordPress panic, and why the people shouting

Speaker: 00:00:42

loudest on social media are so often the last people you should be listening to.

Speaker: 00:00:50

Right, a quick recap of what actually happened because the facts seem to

Speaker: 00:00:53

have gone missing somewhere between the news and your LinkedIn feed.

Speaker: 00:00:56

In the last couple of weeks, PHP released emergency security fixes

Speaker: 00:01:00

for some seriously nasty flaws.

Speaker: 00:01:03

The researchers who found them called it PHP2Shell.

Speaker: 00:01:07

In plain English, the bugs could let an attacker run their own code

Speaker: 00:01:11

on a web server without logging in.

Speaker: 00:01:13

That's bad.

Speaker: 00:01:15

I'm not gonna pretend it wasn't bad.

Speaker: 00:01:16

Websites around the world were taken offline for a while as people patched.

Speaker: 00:01:22

Government sites in France, Denmark, Finland, and the Netherlands.

Speaker: 00:01:25

Wikipedia took systems down as a precaution.

Speaker: 00:01:28

A Japanese airline, a railway company, and one of Japan's biggest

Speaker: 00:01:32

banks suspended some services.

Speaker: 00:01:35

And then what happened?

Speaker: 00:01:36

The patches went out, the hosting companies applied them on their servers,

Speaker: 00:01:40

and for most small businesses on decent hosting, that was it, sorted.

Speaker: 00:01:44

It's possible you didn't have to lift a finger because this was fixed at a

Speaker: 00:01:48

host level, not inside your website.

Speaker: 00:01:51

PHP is a programming language.

Speaker: 00:01:54

It's what an awful lot of the web is built with.

Speaker: 00:01:56

The figure being quoted is, uh, that it runs around 70% of websites.

Speaker: 00:02:00

WordPress uses it, so does Drupal, so does Joomla, so does Magento, which runs

Speaker: 00:02:04

a huge number of online shops, by the way.

Speaker: 00:02:07

The researchers showed the attack working on WordPress, Drupal, and Joomla,

Speaker: 00:02:12

and they said outright that any PHP site on an unpatched version could be

Speaker: 00:02:17

exposed, even a basic one-page site.

Speaker: 00:02:21

So this was a PHP problem, not a WordPress problem, a PHP problem.

Speaker: 00:02:28

Let me put it a little bit more simply.

Speaker: 00:02:32

PHP lives on the server.

Speaker: 00:02:34

Your content management system, whether that's WordPress or Drupal or

Speaker: 00:02:37

Joomla or whatever, sits on top of it.

Speaker: 00:02:40

This was a server problem, not a CMS problem.

Speaker: 00:02:45

Moving your site to a different CMS on the same unpatched server

Speaker: 00:02:49

would have fixed precisely fuck all.

Speaker: 00:02:54

But what happened within minutes of it hitting the news?

Speaker: 00:02:58

WordPress is dead.

Speaker: 00:02:59

You need to move your website off WordPress now.

Speaker: 00:03:02

This is exactly why we built our AI website platform.

Speaker: 00:03:05

Comment "website" and I'll send you the link.

Speaker: 00:03:08

For fuck's sake, did any of these posts mention Drupal, Joomla, Magento,

Speaker: 00:03:14

government websites, a Japanese bank?

Speaker: 00:03:16

Did they bollocks.

Speaker: 00:03:18

Did any of them mention that your host was fixing it on the server while you slept?

Speaker: 00:03:22

Of course not.

Speaker: 00:03:23

Because "PHP has a bug, the host patched it, life goes on" doesn't sell anything.

Speaker: 00:03:29

"WordPress is dead, and I've got the answer" does.

Speaker: 00:03:33

To the people who don't know any better and are sharing this stuff,

Speaker: 00:03:37

you're causing panic for no reason.

Speaker: 00:03:39

Stop it.

Speaker: 00:03:41

It's fucking embarrassing.

Speaker: 00:03:43

To the people who do know better and posted it anyway, you look like a dick.

Speaker: 00:03:48

And I think you know you look like a dick, and you've decided

Speaker: 00:03:51

the engagement is worth it.

Speaker: 00:03:53

And that's what I wanna talk about properly today because

Speaker: 00:03:56

WordPress is a sideshow here.

Speaker: 00:03:58

If WordPress vanished tomorrow, those same people would find

Speaker: 00:04:01

something else to scare you with.

Speaker: 00:04:03

This is about where small businesses get their advice and who's handing it out.

Speaker: 00:04:10

Think about who's on the receiving end of these posts.

Speaker: 00:04:13

You're running a business.

Speaker: 00:04:15

You're doing your own marketing or paying for it out of money

Speaker: 00:04:18

that's already stretched.

Speaker: 00:04:19

You're chasing clients.

Speaker: 00:04:20

You're chasing invoices.

Speaker: 00:04:22

You're trying to work out what AI means for you this week because

Speaker: 00:04:25

it changed again since last week.

Speaker: 00:04:27

You're fighting to stay afloat, and a lot of you are doing it on your own.

Speaker: 00:04:31

And then you open LinkedIn on your phone at 10 o'clock at night, and some bloke

Speaker: 00:04:36

tells you your website is a security disaster, and you need to rip it out.

Speaker: 00:04:41

Of course, that lands.

Speaker: 00:04:43

Of course, you think, "Shit, should I be worried?" You'd be daft not to.

Speaker: 00:04:48

It's the same pattern every single time.

Speaker: 00:04:51

Sack your SEO, hire a GEO team.

Speaker: 00:04:54

Stop blogging, vlog instead.

Speaker: 00:04:56

Google's finished.

Speaker: 00:04:57

It's all ChatGPT now.

Speaker: 00:04:58

Comment "AI" and I'll DM you the guide that leads to the paid course.

Speaker: 00:05:03

And do you know what?

Speaker: 00:05:03

It fucking terrifies me.

Speaker: 00:05:06

I see these posts with 250 comments, and every single comment says AI.

Speaker: 00:05:12

250 business owners who've put their hand up and said, "Yes, please.

Speaker: 00:05:16

Tell me what to do." And do you know what?

Speaker: 00:05:19

Some of them will be fine.

Speaker: 00:05:20

They'll read the guide, think, "Hang on, this is a load of bollocks," and move on.

Speaker: 00:05:25

There are loads of smart people on LinkedIn who see straight through

Speaker: 00:05:29

this crap, but some of them won't.

Speaker: 00:05:31

Some of them will act on it.

Speaker: 00:05:33

They'll move a perfectly good website to some shiny new platform,

Speaker: 00:05:37

lose their redirects, lose their rankings, and spend a year wondering

Speaker: 00:05:40

why the phone's stopped ringing.

Speaker: 00:05:42

I've cleaned up after that more times than I can count.

Speaker: 00:05:45

If you want the gory details on migrations going wrong, go back to episode 11.

Speaker: 00:05:51

And what really gets me is this.

Speaker: 00:05:52

It's not that these people don't know any better.

Speaker: 00:05:55

I mean, some of them don't, fair enough, but most of them simply don't care.

Speaker: 00:06:01

They don't care if you follow their advice and it wrecks your business.

Speaker: 00:06:05

They'll never find out, and if they did, they wouldn't

Speaker: 00:06:08

lose a minute's sleep over it.

Speaker: 00:06:10

Your business is not their problem.

Speaker: 00:06:12

Your comment is their metric.

Speaker: 00:06:14

Your panic is their sales funnel.

Speaker: 00:06:17

And none of this is new either.

Speaker: 00:06:19

Those of you who've been around a while might remember Ecademy,

Speaker: 00:06:22

the business networking site, years before LinkedIn got huge.

Speaker: 00:06:26

Same shite, different decade.

Speaker: 00:06:28

Hustle merchants turning up, scaring the hell out small business

Speaker: 00:06:32

owners, and selling them the cure for a problem they've just made up.

Speaker: 00:06:36

Platform changes, the playbook doesn't.

Speaker: 00:06:40

So what do you do when the next panic hits?

Speaker: 00:06:42

Because there will be a next one, probably by Thursday.

Speaker: 00:06:46

I'll tell you exactly how I'd handle it right after

Speaker: 00:06:49

this.

Speaker: 00:06:56

Next time your feed is full of people screaming that something's

Speaker: 00:06:59

dead, broken, or about to end your business, this is what you do.

Speaker: 00:07:03

One, find out what actually broke.

Speaker: 00:07:05

Before you touch anything, find one boring factual source.

Speaker: 00:07:09

Not a LinkedIn post, the software's own announcement, your hosting company's

Speaker: 00:07:13

status page, a proper tech news site.

Speaker: 00:07:16

With PHP, the official line was clear within hours.

Speaker: 00:07:19

Update PHP.

Speaker: 00:07:21

Not change your CMS, update PHP.

Speaker: 00:07:24

And for most people, the host did that for them.

Speaker: 00:07:27

If the fix being sold to you is bigger than the actual problem,

Speaker: 00:07:30

someone's selling you something.

Speaker: 00:07:32

Two, ask the person who looks after your site one question.

Speaker: 00:07:36

Message your host or your developer and ask, "Are we affected and

Speaker: 00:07:39

are we patched?" That's it.

Speaker: 00:07:41

A decent host will already have done it and will be able

Speaker: 00:07:44

to tell you so in one line.

Speaker: 00:07:46

If you run WordPress and want to see for yourself, go to Tools, then

Speaker: 00:07:50

Site Health, then Info, then Server, and it'll show you your PHP version.

Speaker: 00:07:55

If it's 8.1 or older, you're on a version that doesn't get proper

Speaker: 00:07:59

support anymore, and that's worth a conversation regardless of last week.

Speaker: 00:08:04

And if you can't work out who you'd even ask, that's your

Speaker: 00:08:06

real problem, not WordPress.

Speaker: 00:08:09

Episode two is all about who owns your website stuff.

Speaker: 00:08:12

Go and listen.

Speaker: 00:08:14

Three, run the "who benefits" test.

Speaker: 00:08:17

Look at the bottom of the post that's scaring you.

Speaker: 00:08:20

Is there a "comment X" with a link, or a product, or a free call

Speaker: 00:08:24

that turns into a sales pitch?

Speaker: 00:08:26

Then ask yourself what they get if you panic.

Speaker: 00:08:28

If the answer is your money, treat the whole post as an

Speaker: 00:08:31

advert because that's what it is.

Speaker: 00:08:34

Four, check whether they named everything that was hit.

Speaker: 00:08:37

This one's dead simple, and it catches loads of them out.

Speaker: 00:08:40

If someone tells you a problem only affects the thing they happen to

Speaker: 00:08:43

compete with and leaves out everything else that got hit, they're not

Speaker: 00:08:47

informing you, they're positioning.

Speaker: 00:08:49

The PHP post that only mentioned WordPress failed this test in about four seconds.

Speaker: 00:08:55

And lastly, take advice from people who know your business, your web person,

Speaker: 00:08:59

your SEO, your accountant, a business owner you trust who's been through it.

Speaker: 00:09:04

People who'll still be around if the advice turns out to be shit and who'd

Speaker: 00:09:08

have to look you in the eye, not someone whose only connection to you is that

Speaker: 00:09:12

the algorithm shoved them in your face.

Speaker: 00:09:15

And one more, not everything needs an action.

Speaker: 00:09:18

Sometimes the right response to a scary post is noted, checked, we're fine,

Speaker: 00:09:24

and you just get on with your day.

Speaker: 00:09:26

Checking and moving on is part of running a business too.

Speaker: 00:09:30

So this week, a few small jobs.

Speaker: 00:09:32

Ask your host or whoever looks after your website to confirm that

Speaker: 00:09:35

you're patched, and check your PHP version while you're at it.

Speaker: 00:09:39

Get the answer in writing, even if it's a one-line email.

Speaker: 00:09:43

Write down who you'd call if something properly broke on your

Speaker: 00:09:46

website tomorrow, name and number.

Speaker: 00:09:49

If that piece of paper is blank, sort that out before you do anything else.

Speaker: 00:09:54

And mute one panic merchant.

Speaker: 00:09:57

You know who I mean.

Speaker: 00:09:58

That person whose posts make your stomach drop every time you open LinkedIn, and who

Speaker: 00:10:02

has never once made your business better.

Speaker: 00:10:05

Mute them, unfollow them, block them.

Speaker: 00:10:08

Done.

Speaker: 00:10:09

Your blood pressure will thank you.

Speaker: 00:10:12

If this helped, make sure you're following SEO Fucking What in

Speaker: 00:10:14

whichever app you're listening to so you don't miss the next one.

Speaker: 00:10:18

And if a mate sent you one of those "move off WordPress now" posts,

Speaker: 00:10:22

send them this episode instead.

Speaker: 00:10:24

I'm not selling you anything today.

Speaker: 00:10:26

No link, no course, no "comment PHP for my free guide".

Speaker: 00:10:30

Just this.

Speaker: 00:10:31

If you run a small business, be careful.

Speaker: 00:10:35

Be careful who you listen to, and be really careful of anyone whose

Speaker: 00:10:40

advice comes with a panic attached and a product at the bottom.

Speaker: 00:10:44

You're doing a hard job, and you're doing better than the

Speaker: 00:10:47

doom merchants want you to think.

Speaker: 00:10:49

And if you're one of the hustle bros who spent the last couple of weeks

Speaker: 00:10:52

scaring the shit out of small business owners so you could sell them something,

Speaker: 00:10:57

I hope you step on Lego barefoot, in the dark, every fucking night.

Speaker: 00:11:02

I hope every charger you own is two inches too short.

Speaker: 00:11:05

I hope your socks are permanently damp.

Speaker: 00:11:07

I hope your Wi-Fi drops every single time you try to post.

Speaker: 00:11:11

And I hope one day you need proper, honest advice about something that

Speaker: 00:11:16

really matters to you, and the only person you can find is someone exactly

Speaker: 00:11:20

like you, you absolute arsehole.

Speaker: 00:11:25

Until next time, get found, make money, and the next time LinkedIn tells you

Speaker: 00:11:30

something's dead, ask them what they're

Speaker: 00:11:32

selling.