PHP Site AuditHosting
Do Shopify, Wix, or Squarespace sites need a PHP2Shell patch?
If your storefront uses only a managed SaaS platform, the provider operates its platform runtime and update process. That does not prove every custom integration is covered. A custom app, external API, embedded service, or separately hosted blog can have its own operator and technology stack. Identify those components, then ask their operators what they run and what is in scope.
Separate the platform from integrations
A managed website builder or commerce service hosts its core site as part of the service. The provider is responsible for platform infrastructure and its update process; the merchant remains responsible for account security, configuration, installed apps, and connected services under the provider's terms. This division does not let an owner infer current patch status from a public storefront.
Custom apps and integrations may be operated by an app vendor, agency, or the merchant's team. They can make API calls, process webhooks, receive uploads, or serve content from infrastructure separate from the storefront. Their PHP runtime, if any, must be assessed by that operator.
For each integration, record where the data goes and who can patch the receiving service. A storefront may simply embed a booking widget while the vendor operates its own application; another integration may send order events to code maintained by your agency. The visible page alone will not tell you which case applies. Ask the provider or developer to identify the service boundary in plain language.
Check your actual setup
List the core storefront, custom domains, apps, custom-developed functions, external forms, inventory systems, and any separate marketing or CMS site. For each, note whether it is native to the SaaS platform or points to a separately hosted service. Review the admin app list and integration documentation; ask the developer what infrastructure they operate.
A DNS provider, CDN, custom domain, or code snippet does not necessarily mean the storefront runs on a PHP server you control. It also does not establish that every connected app is safe or unaffected. Avoid vendor-wide statements such as ‘Shopify is vulnerable’ or ‘Wix is unaffected’ unless the vendor publishes a relevant notice.
What to ask support
For the managed platform, use the official support channel reached through your account or a known official website. Ask whether there is any merchant action regarding the named PHP advisory and whether platform-managed services are covered by the platform's update process. Do not send passwords, access tokens, customer records, or payment data.
For a third-party integration, ask its provider what service endpoint it operates for your account, which runtime handles requests, whether it uses PHP, and if so what vendor package or backport covers the issue and when it was deployed. Ask your developer to identify any self-hosted webhook receiver or middleware.
Build an owner responsibility map
Record one row per component: product/platform, operator, public hostname or endpoint, data it handles, update contact, and current evidence. Assign the SaaS provider to platform infrastructure, your team to account settings and integration choices, and the app vendor or developer to the service they operate. This prevents an unanswered integration question from disappearing behind the storefront brand.
If the platform confirms no action is required for its managed service, retain that notice and date. It is a statement about the scope the provider describes; it does not attest to separate servers your organization or app vendor runs.
Be precise about the scope of an answer from a platform. A statement that the core platform is managed does not necessarily cover an app vendor's servers, an agency's middleware, a separate WordPress site, or an externally hosted order workflow. Keep provider statements attached to the service and account they name. If a support team says no merchant action is needed, ask whether the answer covers only the native service or also an integration that the provider does not operate.
For checkout, payment, shipping, and customer data services, inventorying integrations also helps you find the right incident and support contact. Do not test a service by posting sample customer details or sending synthetic attack requests unless the operator has approved a safe procedure. A simple component list and a support confirmation are usually more useful to an owner than trying to infer server language from a storefront page.
Decision checklist
- Identify the actual SaaS product and storefront.
- Inventory installed apps and external endpoints.
- Ask the platform whether merchant action is required.
- Ask custom-service operators about their stack and patch evidence.
- Record scope and owner without making unsupported affected/unaffected claims.
Common questions
Do I update PHP in the Shopify or Wix dashboard?
Usually the platform manages its core runtime. Ask the platform if there is merchant action, and check external apps separately.
Does a hosted store mean all integrations are covered?
No. Apps and external endpoints can have separate operators and update responsibilities.
Can I assume a platform is unaffected because it is SaaS?
No. Avoid a broad verdict without a vendor notice. Ask about the exact managed service and connected components.