The loudest story this week was not about WordPress at all, but it affects every WordPress site. Here is what is worth knowing.
PHP: update it, even though WordPress did not
On 21 October WordPress.org published a notice about a critical PHP security release. PHP, the language your site runs on, fixed two critical vulnerabilities. WordPress itself needs no update, because the problem sits underneath it and affects any server running PHP applications. The notice asks site owners to update PHP as soon as possible and to check with their host, since hosts may already be rolling out updates or firewall rules. It also says PHP versions before 8.2 no longer get security fixes from the PHP project.
You can see your version in the dashboard: Tools, then Site Health, then the Info tab, then Server. If it says anything older than 8.2, ask your host to move you. I wrote the plain-language version of this on Thursday: there's a serious security hole affecting WordPress sites.
Keeping the layers under a site current is a normal part of WordPress development and ongoing care. It is also the best value security work there is, measured in minutes.
WordPress 7.2 Beta 1 is out, but leave it alone
The first beta of WordPress 7.2 arrived on 20 October, with the final release scheduled for 8 December. The list includes responsive design controls, text shadows, menu editing from the editor sidebar and image resizing and compression in the browser before upload. That last one could save a lot of oversized photos from ever reaching a media library. The WordPress team is clear that you should not install a beta on a live site. If someone looks after your site, December is when to ask about the upgrade, and the answer should include a backup and a test first.
A reminder: the Supabase TLS date
Last week I mentioned that Supabase disables an outdated subset of TLS 1.2 ciphers on 10 November. Their changelog has had nothing new since 14 October, so the date stands, eighteen days away. If something was built for you on Supabase, a two-minute question to your developer now is easier than a stressful afternoon later.
What I published this week
On Tuesday: do you need a page for every town if you want local search to work. On Thursday: why your website might not be showing up on Google. Tomorrow morning: how web developers charge, and what the different models mean for you.
One thing to do this weekend
Find your PHP version using the steps above and write it down. If it is below 8.2, send your host a short email asking when they will upgrade you.
If you would like a second pair of eyes on your site, get in touch and book the free 30-minute surgery.
Free 30-min surgery
Working on something similar?