Free checklist, written 26 Oct 2026. It is a technical checklist, not legal advice, not a security audit, and no guarantee that a server is safe.

For freelancers and small agencies who look after other people's PHP and WordPress servers.

Version 1.1 · written 26 Oct 2026 · facts are as reported by the sources listed at the end, each with a read date.

What this is: a checklist you can run on a server (a guess: about 30 minutes for a simple one) and the words to send your client afterwards. It is not legal advice, not a security audit, and not a guarantee that a server is safe. It does not replace updating PHP; updating is the only complete fix (Tenable, citing PHP).

Before you start: only work on servers you are contracted to manage, get the client's written go-ahead before you change settings, take a site offline or restore a backup, and keep a written record of every command you run and every change you make. The commands below only read client data, except the settings and updates in Steps 3 and 4.…