Frequently asked questions

Straight answers about how we work, what you get, and what to expect.

What exactly do you do?

We audit your PHP site, update PHP to a fixed release, test the key pages, check for signs of compromise, and harden the server. The exact scope depends on the package you choose. We deliver a written report when the work is done.

Why can't a plugin or WAF fix this?

The vulnerability is in PHP itself on the server. A plugin or web application firewall runs inside PHP or in front of it — neither can update the PHP runtime. Only updating PHP to a fixed release closes the vulnerability.

How fast can you start?

It depends on your package. Secure & Protect and Total Shield start within 24 hours of receiving access. Enterprise Response starts the same day. Verify & Check and Rapid Patch start within 48 hours. Care plans include ongoing priority support.

How do I send you access to my server?

We never ask for passwords by plain email or chat. You send access securely through a password-manager share link or a temporary credential you rotate after we finish. Use the Secure access ticket category in your client portal to send credentials.

Do you offer refunds?

If you cancel within 24 hours of payment and no engineer has started work, you receive a full refund. After an engineer begins work, no refund is available — emergency PHP patching is immediate, hands-on work that cannot be reversed. See our Refund Policy for full details.

Do you guarantee my site will be 100% secure?

No. We never say "100% secure" — security is an ongoing process. We patch the known PHP vulnerability, check for compromise signs, and harden the server. Ongoing maintenance (care plans) helps you stay protected as new releases come out.

What payment methods do you accept?

We currently accept PayPal. Additional payment methods may be available in the future. Payment is charged in US Dollars (USD) at the time of order confirmation.

Will the patch break my site?

We test key pages (forms, login, checkout) after upgrading PHP. If a compatibility issue arises, we work to resolve it. Major PHP version upgrades (e.g., 7.4 to 8.2) carry a higher risk of compatibility issues with older code — we flag this in our audit before proceeding.

Do you scan sites without permission?

Never. We run passive external scans only after the site owner or an authorized person gives written consent. We do not guess paths, scan ports, or probe for exploits.

What is a care plan?

A monthly care plan provides ongoing PHP version monitoring, security update alerts, monthly check-ins, and priority support. When a new PHP security release drops, we prioritize patching for care plan customers.

Can I get a custom quote?

Yes. For large stores, multi-site setups, custom PHP applications, or regulated industries, contact us for a custom quote. Enterprise Response is quote-based and ranges from $3,000 to $5,000 depending on scope.

Are you affiliated with the PHP project?

No. We are an independent service and are not affiliated with the PHP project, any hosting provider, or any security vendor.

Still have questions?