Millions of break-in attempts in two days.
A serious hole in PHP went public on 21 October. Attacks started the same day.
Source: The Hacker News WEBSITE SECURITY & REPAIR FOR SMALL BUSINESSES
LIVE Millions of break-in attempts since 21 Oct
Your website could
already be
hacked.
And you’d be the last to know. Hackers steal your customers’ details, send spam in your name and get you flagged as dangerous, while your homepage looks perfectly normal.
Hacked, broken or slow? We fix it.
If we can’t, you don’t pay a cent.
Only 20 websites a week. Fixed, or 100% of our fee back.
What a hack does to a small business
WHAT YOU SEE EVERY DAY
Your website looks fine.
Orders coming in. Padlock showing. Nothing looks wrong, so you get on with your day.
Orders today23
Visitors1,204
Sales today$2,140
An illustration of a typical hack and how we fix it. Not a scan of your website.
This month aloneSee what happened
Millionsbreak-in attempts in the 2 days after one security hole went public
22.6Mwebsites and servers left open to that attack (Palo Alto Networks)
11 hoursa popular WordPress add-on handed out a hidden back door
1 dayfrom a break-in method going public to real attacks
If your business has a website, we can fix it.
Shops, booking sites, WordPress, custom apps and the hosting under them. One team fixes it all.
- Online shops
- Restaurants & cafés
- Clinics & dentists
- Salons & studios
- Trades & builders
- Agencies & freelancers
- Hotels & rentals
- Coaches & creators
Whatever it’s built on
WordPressSites, add-ons & themes
WooCommerceOnline shops & checkout
LaravelCustom-built websites
DrupalContent-heavy websites
MagentoLarger online stores
PHPThe engine behind most sites
Node.jsModern web apps
Next.jsModern websites
nginxWeb hosting software
ApacheWeb hosting software
AWS & LinuxServers & cloud hosting
Padlock & settingsHTTPS certificates & more
Names and logos belong to their owners; no affiliation or endorsement is implied.
Fixed, or your money back100% of our fee, guaranteed
One flat price, shown firstNo surprise bills, ever
No passwords needed to startJust tell us what’s wrong
Real people, plain answersEmail our team
FREE WEBSITE CHECK · NO SIGN-UP
Is your website an easy target?
Find out in two minutes.
Hackers scan every website for an easy way in. Type your address and see what they see, in plain English, in two minutes.
No passwords. No sign-up. Nothing to install.Your padlock · Out-of-date software · Hacked add-ons · Customer login safety · Leaked error messages
Remember: this only sees the outside. Hidden back doors and out-of-date server software don’t show up here. When we fix your site, we check the inside too.
START WITH YOUR WEBSITEFREE CHECK
Run your check online.
This saved preview can’t scan websites. Open the live checker to run your free check, or pick a fixed-price plan.
Open live website checkSecure connectionNo trackingDeleted after 5 minutesSecurity policy published
YOUR WEBSITE RISK REPORT
Your risk level
0things checked
0problems found
0couldn’t see from outside
See the 0 things that looked OK
What this check can’t see, and what it could mean
- Out-of-date software on your serverThis month’s biggest attack goes after software an outside check usually can’t see. If yours is behind, a stranger can take over your site without a password.
- A hidden back doorHacked sites often get a secret way back in that survives clean-ups and updates. The homepage looks exactly the same.
- Customer details being copiedNames, emails, passwords and payment details can be taken without a single visible change.
- How most owners find outA warning in Google, emails landing in spam, frozen payments, or a customer asking why their card was charged.
The only way to know is to look inside. We check the inside of your website, fix whatever we find, and prove it in writing.
YOUR NEXT STEP
Fixed, or 100% of our fee back.
WHAT A HACK REALLY COSTS YOU
One break-in is all it takes.
Here’s what you lose.
This month hackers found a way into PHP, the software behind most small business websites. No password needed. Once inside, they can do anything you can.
By the time most owners find out, the damage is weeks old.
Check if your website is at risk CRITICALACTIVE ATTACK
9.2/10
Danger rating
from security experts
Password needed to break inNone
Break-in attempts since 21 OctMillions
Fix availableYes, now
- Customer details stolenNames, passwords and card details, quietly copied.
- A red warning on your siteBrowsers warn visitors away before they see you.
- Your emails land in spamYour site sends spam. Your email gets blocked.
- Payments frozenProviders freeze hacked accounts. No checkout, no sales.
- Your site wiped or held to ransomPages, orders and backups deleted or locked.
- Your name, damagedReviews mention the hack for years.
It doesn’t have to be you. We throw the hackers out and lock the door behind them.
The technical details, for your web person +
Information checked 25 October 2026. Upstream fixed releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP 7.4 to 8.1 have source backports only, and 7.3 and older get no fix at all. Distribution packages may include backported fixes; verify the package advisory with your host.
Amazon observed exploit attempts on 17 October, four days before disclosure. Palo Alto Networks Unit 42 counts 22.6 million potentially exposed instances. The Hacker News and Security Affairs report exploit attempts in the millions, including Mirai payloads. As of 25 October no vendor has confirmed a successful compromise, while several research teams report working exploits. Exposure depends on the runtime, deployment, and mitigations. A vulnerable version is not evidence your site was hacked. Automattic reports WordPress.com, WordPress VIP, WP Cloud, Pressable, and Tumblr are protected. AWS says its services are not impacted; customer-managed PHP applications may need remediation.
THIS MONTH ALONE · OCTOBER 2026
This isn’t a someday problem.
It happened this month.
Six attacks in four weeks. Every one hit websites that looked normal.
One poisoned request could take over a server.
Researchers took over a standard Node.js server with one crafted request.
Source: Node.js security advisoryA popular add-on shipped with a back door.
For 11 hours a popular SEO add-on came with a back door that survives updates.
Source: SecurityWeekStolen keys used to sneak in secret admins.
Stolen keys for a backup add-on planted 99 kinds of back doors and secret admins.
Source: PatchstackSome websites’ padlocks stopped working.
A padlock company’s keys were cracked, so browsers now show visitors an error.
Source: The Hacker NewsFrom instructions to attacks in one day.
Criminals were taking over servers within 24 hours of the method going public.
Source: CISA known-exploited catalogYour homepage loads fine? So did theirs. That proves nothing.Read the full briefing
IMAGINE THE NIGHT IT HAPPENS
Your site looks fine.
It has looked fine all night.
What one hack does to a small business, hour by hour. You don’t have to make a mistake. You only have to wait.
No alarm. No outage. The padlock stays on. Most owners find out from a customer.
An example built from real attacks reported in October 2026. Your timeline would differ. The ending usually doesn’t.
A hacking tool finds your out-of-date site. No password needed. It’s in.
It copies your customers, orders and passwords, and hides a back door.
Visitors get sent to scam pages. Google starts warning people away.
Your payment provider freezes your account. Nobody can pay you.
Your emails bounce. Your site has been sending spam all night.
A customer asks about a charge they never made. That’s how you find out.
The clean-up costs ten times more than fixing it early. Your site still looks fine.
Fixing it nowAn afternoon.
Update, fix, test, report. Done.
Cleaning up a hackWeeks, and lost customers.
Investigations, rebuilds, spam-list appeals, refunds and bad reviews.
30-SECOND SELF-CHECK
Seeing any of these?
Tap what you’ve noticed.
Hacked websites drop hints. Most owners miss them until it’s too late.
Or run the free website check0 of 8 signs
Nothing ticked? Good, but that’s not proof.
Most hacks show no signs at all. A quiet website can still be leaking customer data.
WHY YOU CAN’T JUST CLICK “UPDATE”
Updating it yourself
can break your website.
A website isn’t a phone. One wrong update can take down the parts that make you money.
What breaks
- Your checkout stops taking payments
- Contact and booking forms stop sending
- Pages go blank or show error messages
- Your site goes down at 2 a.m. and nobody knows why
A bad update can take your website offline just as surely as a hacker can.
That’s why we do it for you, properly.
- 1We check everything firstWe find what would break before touching your site.
- 2We fix what would breakCheckout, forms, logins and add-ons keep working.
- 3We update, test, and prove itProtected, with no surprise downtime.
WHATEVER’S WRONG, WE FIX IT
Hacked. Broken. Down.
We’ll fix your website.
If we take it on, we fix it, or you don’t pay.
Hacked? We clean it up.
Spam, scam redirects, Google warnings or a feeling something’s off. We throw them out and lock the door.
Broken? We make it work.
Blank pages, errors, a checkout that won’t take payments, or an update gone wrong. We fix the cause.
Down? We get you back online.
Won’t load, crawls or keeps crashing. We fix the hosting under it so it stays up.
Not sure what’s wrong? That’s fine. Describe it in your own words.
A WEBSITE PROBLEM IS A BUSINESS PROBLEM
Your site can’t wait.
Take the first step.
Pick a plan with one flat price. If we can’t fix it, you get every cent back.
No passwords needed. Paid safely through Stripe.
FROM PROBLEM TO A CLEAR PLAN3 STEPS
-
START HERE
Pick the plan that fits.
Three flat prices. Not sure? The free check points you to one.
-
NO SURPRISES
Know the fix. Know the price.
Each plan lists what we do. If the job is bigger, we stop and ask first.
-
GET BACK TO BUSINESS
A fix you can verify.
We test it, explain it, and back it with our money-back guarantee.
WHAT YOU GET
Fixed. Tested.
Proven. In writing.
Plain English. Yours to keep.
- Your website updated and the holes closedThe software your site runs on, brought up to date safely.
- Everything the update would break, fixedCheckout, forms, logins and add-ons working on the new version.
- Proof the known attacks no longer workWe test your site again afterwards. Nothing is assumed.
- A plain-English reportWhat was wrong, what we fixed, and what to watch next.
- A “protected” badge for your siteShow customers your website has been checked and secured.
WebLockSmith.Sample report
Your security report.
What was wrong, what we fixed, and what to watch next.
- 01 / WHAT WAS WRONG
- The holes we found, and what they put at risk.
- 02 / WHAT WE FIXED
- The updates made, and everything repaired around them.
- 03 / WHAT WE TESTED
- The known attacks, tried again and blocked.
- 04 / WHAT TO WATCH
- Anything your host should do, and risks to keep an eye on.
The agreed result is the standard.
Our service-fee guarantee backs it.
Our service-fee guarantee backs it.
Example format · The details are specific to your project
A SECURITY FIRM AT ITS CORE
Built for the businesses nobody else protects.
“I started Web Lock Smith the week break-in attempts hit the millions. I watched owners refresh a normal-looking homepage and decide they were safe. They weren’t. The hacks that end businesses never change the homepage.”
“Big companies have a security team. A florist with an online shop has a hosting bill and a hope. We are the team they never had.”
Rishabh ChuletFounder and CEO, Web Lock Smith Inc.
Security first, not an add-onWe start where a hacker would: the easy way in.
Whatever your website runs onWordPress, shops, custom apps and the hosting under them.
Honest reports, in writingWe say what we saw and what we couldn’t. No fake all-clears.
Fixed, or your money backPrice agreed first. No fix, no fee.
ONLY 20 SLOTS A WEEK
When they’re gone,
you wait.
Real engineers fix every website by hand, so we only take 20 a week. No exceptions.
When this week’s 20 are gone, you wait. Waiting means staying open to attack.
Service-fee guaranteeFlat price up frontPaid through Stripe
A clear scope before we startEach plan spells out exactly what we fix.
A price you see firstOne flat price per plan, and no bill that grows without your yes.
A result you can verifyGet a summary of the changes and checks performed.
Our own commitments, not third-party certifications. Each one links to the page that backs it.
THE WebLockSmith PROMISE
100%We fix it. Or you pay nothing.
We fix your site, close the holes and show you it’s done. If we can’t deliver the agreed fix, you get every cent of our fee back.
Three flat prices.$499, $999 or $1,999, one website each.
Pay safely through Stripe.
No card details touch this site. Pick a plan and pay on Stripe’s secure checkout.
Credit & debit cards through Stripe
What does the free check look at?+
It looks at your website from the outside, using only what anyone on the internet can see: whether your padlock (HTTPS) is set up properly, whether your site shows which software versions it runs, whether you use any WordPress add-ons linked to this month’s hacks, whether visitors’ logins are protected, and whether your site leaks error messages. It doesn’t log in, try to break in, or touch your customer data. It also can’t see inside your server, which is where most of the damage from a hack happens, so a clean result doesn’t mean your site is safe. That’s what our hands-on check is for.
Is my website affected by this month’s PHP attacks?+
If your website runs on PHP (every WordPress site does) and nobody has updated the server since 21 October, assume you’re at risk. Updating WordPress or your add-ons does not fix this. The fix happens on the server, and unless your host or developer has done it, it isn’t done. Tell us your website and we’ll confirm where you stand. Your web person can read the full PHP2Shell explainer for the exact versions.
Can you help with something other than a hack?+
Yes. Broken pages, error messages, a checkout or forms that stopped working, an update that went wrong, a slow or crashing site, or hosting and server problems. Pick the plan that fits. Each covers one website, and if the job turns out bigger, we stop and tell you before doing more.
How quickly can you fix my website?+
It depends on what’s wrong, your hosting, and whether you have backups. If your site is down or you can’t take orders, add the emergency start and we begin within 2 hours of payment, any day. Otherwise a real person emails you after you pay with what happens next and when.
What does the money-back guarantee cover?+
If we take on your job and can’t deliver the fix we agreed, we refund our fee for that work in full. Hosting bills, things you bought from other companies, and lost business aren’t covered. Each plan spells out what “fixed” means.
Do I need to share passwords to get started?+
No. Your website address and a description of what’s wrong are enough to start. If we need access later, we’ll agree a safe way to do it with the least access possible. Never email passwords, secret keys or customer data.
How does payment work?+
Pick one of three flat-price plans, $499, $999 or $1,999, and add $500 if you need us to start within 2 hours. You pay through Stripe, and a real person emails you to confirm what happens next. If the job turns out bigger than your plan, we stop and you choose: switch plans and pay the difference, or get every cent back.
Are you affiliated with WordPress, AWS, or PHP?+
No. WebLockSmith is an independent company. Platform names and logos only show which technology we work with. They don’t mean a partnership or endorsement, and a platform appearing here doesn’t mean that platform is down or hacked.
Is this only about WordPress and PHP sites?+
No. Most small business websites run on WordPress and PHP, so that’s where most attacks land. We also fix custom-built websites and apps, including Node.js and Next.js, the hosting and servers underneath, and padlock certificate problems. The free check already looks at your server software, WordPress add-ons and padlock certificate.
Who is behind WebLockSmith?+
WebLockSmith is the trading name of Web Lock Smith Inc., an independent website security and recovery firm founded by Rishabh Chulet. Read the founder’s note and how we work, or email hi@weblocksmith.com.
P.S.Only 20 sites get fixed this week.
Only 20 sites get fixed this week.
Reserve yours before they find you.
Hacking tools try thousands of websites an hour, day and night. They don’t care that you’re small or busy. Fixed, or your money back.