The state of web security in Hull

We looked at the websites of 225 Hull and East Yorkshire companies to see what they are built on and how well they are being looked after.

The short version: nearly half run WordPress, and of the servers that told us which version of PHP they run, almost half are running a version that no longer receives security fixes. One has not had a security patch since 2018.

That number deserves more attention than it usually gets, and this year more than most. We will come to why.

The findings in five numbers#

• 46% of the business websites we looked at run WordPress or WooCommerce: 104 of 224.
• 46% of the servers that disclose their PHP version are running one with no security support: 21 of the 46 that disclose it.
• One server has gone nearly eight years without a security patch, running a version of PHP that reached end of life in December 2018.
• 9 sites run a version of WordPress that WordPress itself classifies as insecure, and not one of them is among the oldest sites we found.
• 46% of WordPress sites correctly hide their version number from visitors. The other 54% are advertising exactly which weaknesses to try.

How we did this, and what we did not do#

This matters more than the findings, so it goes first.

We read the home page of each site, exactly as your browser does when you visit it. That is the whole method. We did not scan for vulnerabilities, did not try any admin address, did not test whether anything could actually be exploited, and did not touch anything that is not already served to every visitor who arrives at the front page. Our crawler identified itself by name on every request and obeyed each site's robots.txt.

There is a reason for being this careful beyond good manners. Probing a computer you do not own is an offence under the Computer Misuse Act whatever your intention, and a survey that had to break the law to produce its numbers would not be worth reading. Everything below was sitting in public, in plain sight, on pages anybody can load.

The 225 companies are drawn from construction, manufacturing, professional services, logistics, wholesale and care. Most are in the HU postcode area, with the rest in DN and YO. They are established businesses rather than sole traders: companies filing real accounts.

What Hull is built on#

WooCommerce is WordPress with a shop bolted onto it, so the two belong together.

The "custom or undetermined" group is 58 sites that gave away nothing about how they were built. Some are hand built, some run a framework that leaves no fingerprint, some sit behind a service that strips the details out. It is not a finding, it is an honest gap.

A fifth of the sites are on hosted builders: Wix, Squarespace, GoDaddy, Duda. We will say something in their favour shortly, which may surprise anybody expecting a software company to be rude about them.

The PHP problem#

PHP is the language most of the web is written in. WordPress runs on it, WooCommerce runs on it, Drupal and Joomla run on it. It is not the website itself, it is the thing underneath the website, and it belongs to whoever hosts the site rather than whoever built it.

Like anything else, versions of PHP reach the end of their supported life. After that date the people who make PHP stop issuing security fixes. The software carries on working perfectly. Nothing breaks, nothing looks different, no warning appears anywhere. It simply stops being repaired, quietly, while continuing to run your business.

Of the 224 sites we could read, 46 servers disclosed which version of PHP they run. The other 178 did not, and we will not pretend to know anything about them. Some are deliberately configured to say nothing, which is a sensible choice. Many of the rest are hosted platforms that do not run PHP the visitor can see at all.

Of the 47 that did tell us, 21 are running a version that no longer receives security fixes, and 17 have been unsupported for three years or more.

Those percentages come with a caveat we would rather state than have pointed out. Servers that publish their PHP version are self-selecting, and probably skew towards the ones nobody has configured, which likely skews towards the ones nobody has maintained. Measured against all 224 sites instead, the same 21 servers work out at 9%. The honest position is that the true figure sits somewhere between the two and we cannot narrow it without asking people directly.

Either way the direction is clear. Somewhere between one in eleven and one in two East Yorkshire business websites is sitting on a foundation nobody is repairing.

Why this year is different#

Unpatched software has always been a risk, and the standard reassurance has always been the same: who would bother attacking a joinery firm in Hull?

That reassurance was never quite true, because most attacks were never aimed at anybody in particular. Automated tools have swept the internet for years looking for known weaknesses in known versions, and they do not care what your company does or how well it treats its customers. They care that your server answers in a particular way.

What has changed is the cost of that work. We have all now seen what the current generation of AI models can do with code. They read it, explain it, find the mistakes in it and write new code to order, in seconds, at a price that rounds to nothing. This is not a prediction about the future and it is not a sales pitch. It is the same technology that thousands of developers, ourselves included, use every day to do legitimate work faster.

The same capability points the other way just as well. Understanding an old vulnerability well enough to exploit it used to take a skilled person and real time, which meant it only happened to targets worth that effort. That barrier has largely gone.

Every unsupported version number is a published list of known problems that will never be fixed. That was an acceptable gamble when exploiting them was expensive. It is a much worse gamble now.

To be clear, we are not saying anybody in this survey has been breached. We have no way of knowing that and we did not look. We are saying that running software with published, permanent, unfixable weaknesses is a bet whose odds have moved sharply, and that most of the people holding that bet have no idea they placed it.

Are the WordPress sites actually up to date?#

This is the question the whole survey was meant to answer, and the answer is not the one we expected.

WordPress publishes an official security status for every version it has ever released. Each one is marked latest, outdated, or insecure, and that last word is WordPress's own: it means the version has known security holes and should be updated now. We checked every version we found against that list rather than deciding for ourselves what counts as old.

Of the 56 WordPress and WooCommerce sites that told us their version:

Nineteen more, 34%, are on an older release that is nonetheless fully patched. The remaining 28, exactly half, are on the current version.

The surprise: the dangerous sites are not the old ones#

Here is what we did not expect. The nine insecure sites are not the oldest ones. They are running versions 6.4 through to 7.0, all released within the last couple of years. The genuinely ancient sites in our sample, the handful still on the WordPress 5 series, are all fully patched.

That sounds backwards until you know how WordPress works. When a security hole is found, the fix is not only applied to the newest version. It is backported to older release branches as well, and most WordPress sites install those fixes automatically overnight without anybody being asked.

So the site running a years-old WordPress that quietly updates itself is in better shape than the site on a much newer version where that automatic updating has stopped. And it does stop: a failed update, a hosting change, a permissions problem, a plugin conflict, or somebody switching it off during a fraught release and never switching it back on.

Nobody gets an email when it stops. The site carries on looking perfectly normal. That is what those nine sites have in common, and it is why "we are on a fairly recent version" is not the reassurance it sounds like.

And the shops#

Of the 35 online shops, 25 disclosed a version. One is running a version WordPress flags as insecure, ten are outdated but patched, and fourteen are current. That is a better picture than the sites as a whole, which is reassuring given these are the ones handling card payments.

One is still one too many, given what a shop holds.

Two of those shops are worth singling out for a different reason. Both are running the WordPress 5 series, two whole major releases behind current, while taking card payments today. Both are fully patched, and we want to be straight about that rather than use them for a scare: WordPress has been backporting security fixes to their branches, and both received one last month.

The risk in those two is not the core. It is everything bolted to it. A shop that far back is running a payment extension, a theme and a stack of plugins from the same era, and those have no equivalent of WordPress's backporting. Nobody is quietly patching an abandoned payments plugin overnight. Worse, the longer it sits, the more expensive it becomes to move, because the eventual update is no longer an afternoon's work but a project with testing and decisions in it.

WordPress: start by not telling people#

Before any of the numbers, the single easiest thing a WordPress site can do.

Hiding it does not make an out of date site secure. It is not a substitute for updating and anybody who tells you otherwise is selling something. But it takes your site off the easiest list to be on, it costs nothing, and most security plugins do it with a single setting.

The remaining 56 do publish it. Of those, 21 are a major version or more behind, and 6 are still on WordPress 5, a series that has since been superseded twice over.

We want to be fair about what that means. A site one version behind is not an emergency and it is not negligence. Updating WordPress properly means updating its theme and every plugin alongside it, and that genuinely can change how a site looks and behaves. Businesses put it off for sound commercial reasons, not out of laziness.

Being three or four years behind is a different matter, because the gap grows harder to close every month it is left. The sites furthest behind are exactly the ones where updating has stopped being an afternoon and become a project.

The shops, where it is real money#

35 of the 225 sites are WooCommerce: WordPress running an actual shop, taking actual card payments from actual customers.

A brochure site that gets defaced is embarrassing and can be restored from a backup. A shop is a different proposition. It handles payment, it holds customer names, addresses and order histories, and it falls under UK GDPR, which makes a breach not merely a bad week but a notifiable event with a regulator attached.

It is also the hardest kind of site to update, which is precisely why it is so often the furthest behind. Every payment, shipping and tax extension has to keep working together afterwards, so it needs testing on a copy rather than a hopeful afternoon of pressing update. That difficulty is real. It is not a reason to leave it, it is a reason to plan it.

What we could not tell you#

Three things, stated plainly, because a survey that only reports what suits it is marketing rather than research.

There is no Magento in this sample at all. We expected to find some and found none. Any figure we gave you about Magento in this area would be invented.

Joomla, Craft and Concrete appear once or twice each. With numbers that small, publishing what versions they run would come close to identifying individual businesses, which we will not do. Anything based on a single site is an anecdote wearing a percentage sign.

We could not read every site. Some sit behind security services that decline automated visitors, which is a point in their favour rather than a fault, and we did not attempt to work around a single one of them.

If you want to know where you stand#

Nothing here requires our involvement to act on. If you take one thing away, take this list to whoever looks after your website and ask:

1. What version of PHP are we on, and is it still receiving security updates?
2. If we are on WordPress, what version, and is that version number visible to visitors?
3. When were the plugins and the theme last updated, and which are no longer maintained?
4. If we take payment, how do we test the checkout after an update, and is there a copy of the site to try it on first?
5. Do we have a backup that somebody has actually restored from, as opposed to one that exists?

Those are five reasonable questions and any competent web developer will welcome them. If yours cannot answer them, that is itself the answer.

If you would rather see the answers than ask for them, both of these are free, neither asks for an email address, and you get the findings whether you ever speak to us or not.