How this page works
We list a kind of help only when a guide on this site cannot do the job. We write down what each option is good for and where it falls short. Today none of the links below earns us money. When one does, it will say Paid link next to it, and the disclosure page will list it.
Your PHP is too old to upgrade this month
Extended support vendors (TuxCare, HeroDevs, Zend) patch PHP after the project stops. Good for code that genuinely cannot move. Weak spot: so far only HeroDevs confirms both CVEs on its own pages, so ask the others first. Compared on old PHP versions.
Your host will not tell you what it runs
Managed hosting that publishes its PHP patch status removes this job from your list. Good for small sites with no one to run a server. Weak spot: you pay monthly and give up control of timing. Before moving, ask the new host the three questions and expect a straight answer.
You think a site was already attacked
An incident response or malware clean-up service. Patching stops new attacks through these flaws. It does not remove anything an attacker already left behind. We do not do this work and do not recommend a specific firm yet.
You need a developer for the code changes
A freelance PHP or WordPress developer for the plugins and code that break on a newer PHP. Good for one-off migrations. Weak spot: quality varies; ask for a written scope and a test on a copy. We also do this work ourselves; see services.
Last reviewed on 22 October 2026.