What your website runs on matters more than most businesses realize. Two critical PHP vulnerabilities made public in October 2026 show why we custom-code our websites instead of building them on WordPress and other third-party platforms.
If your website runs on WordPress, it runs on PHP. In October 2026 two critical vulnerabilities in PHP were made public, and they are a good reason to ask what your own website is built on.
This carousel from our Instagram explains why we don’t build websites on WordPress and other third-party platforms. Below, we go through it slide by slide.
There is a reason we don’t build websites on WordPress and other third-party hosting sites. Many business owners never see what sits underneath their website, and what it runs on matters more than most businesses realize.
Your website isn’t just a pretty homepage. It is your business’s digital storefront, and the technology behind it matters just as much as the design.
Visitors see the design. The technology is the part they never see, and it is the part that has to keep working long after launch day.
Design is what people see. Technology is what keeps the doors open.
PHP is the technology powering millions of websites, including WordPress sites. On October 21, 2026, PHP’s security team published two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and rated both 9.2 out of 10 on the CVSS 4.0 scale.
Both are flaws in how PHP handles memory between one visitor’s request and the next. The National Vulnerability Database describes each one as able to lead to remote code execution, meaning that under the right conditions an attacker could run their own code on the server behind a website.
Whether a particular site is exposed depends on the PHP version it runs and how it is kept up to date.
Two flaws, both 9.2 out of 10, in the technology WordPress sites run on.
We don’t build our websites on WordPress. We custom-code them, choosing the technologies each project actually needs. For our static websites, that means:
It is the same thinking behind our custom website vs Wix breakdown: no third-party platform in the middle, and website files you own.
If you are unsure what your website is built on, or you have concerns about PHP, WordPress or third-party platform risks, send us a message. We will tell you what it is built on and what we would change, in plain language.
Ask whoever looks after your website which version of PHP it runs, and when it and its plugins were last updated. If nobody can answer, that tells you something. When you are ready to compare the options, our guide to what website builders really cost lines the platforms up side by side.
Speed, outages, security and file ownership: what really changes when a custom-priced site is built on a third-party platform.
Wix, Shopify, Squarespace and WordPress side by side: the monthly fee, what it includes and the work it leaves on your plate.
5.79 billion users, Gen Z searching social before Google, and why every post either builds recognition or gets lost.
Send us your address and we will tell you what it is built on and what we would change, in plain language. The first conversation is free.