PHP security patch for your clients' sites, per site
An open security hole in a client's site can cost them money, and cost you the client.
Your clients' sites run on an engine most owners never see (it's called PHP). On October 21, 2026, its makers released an urgent patch for a hole in it. The "Update now" button can't install it. We can.
- The patch
- Access removed
- Written report
- 30 days of priority support
- Day-7 check-in
Patch it before Black Friday.
Website Security Patch
Order the patchPatched within 24 hours of access, or your money back.
Your part: invite us at your hosting company.
On Shopify, Wix, Squarespace or a hosting company that manages your store? Your host patches it for you. Tell us about your store →
- One price per site
- You see us as a user at your host
- We only touch the engine
The patch is public, so the hole is public too.
A published patch shows attackers where the hole is. Automated scanners look for unpatched sites all day.
~5 hrs
The first attacks come fast.
For WordPress sites, Patchstack found the first attack on a new hole often came within about 5 hours of it going public. About half of the most serious holes were attacked within 24 hours.
Source: Patchstack · Search Engine Journal
4,275
Stores get hit, big ones too.
In 2024 attackers got into 4,275 online stores, Ray-Ban and Whirlpool among them, through one hole. About 3 in 4 stores still hadn't patched it when bots began scanning for it.
Source: Sansec · The Register
51%
Half of web traffic is bots.
About half of all web traffic in 2024 came from bots, not people. Bad bots alone made up 37% of it. On retail sites, bad bots were 59% of traffic.
Source: Imperva · Intelligent CIO
5 days
The gap keeps shrinking.
Read more
Google's Mandiant team measured how long attackers took to use a new hole: 63 days in 2018 to 2019, 5 days on average in 2023. 12% of holes that already had a fix were attacked within one day.
Source: Google Cloud / Mandiant
24 hrs
It has happened to this engine before.
2019
Government sites too.
Read more
In 2023, CISA and the FBI reported that several hacker groups got into a US federal agency's web server, through a hole that had been public since 2019.
Source: CISA AA23-074A
What an open hole can cost a site
Google warning
A hacked site can lose sales: Google can warn shoppers in search that it "may be hacked" until the hole is closed and Google reviews the site.
Source: Google Search Help
Black Friday week
November 27 to 30, 2026. A site that's hacked or down those days can't make those sales.
A hacked site can lose sales and its spot in Google.
Order the patchWhat happens after you order
Order
A two-step form: your website, how many sites and your email. You pay on Stripe's secure checkout page. Your card number goes to Stripe, not to us.
Let us in
We email you from [email protected] with step-by-step instructions for your hosting company. If you'd rather, book a 10-minute call and we do it together.
We patch it
We start as soon as we have access.
Everything in the Website Security Patch
The patch We apply the patch, then check your site still works.
It closes the hole your "Update now" button can't reach.Access removed We remove our access when we're done.
No extra logins left behind on your hosting account.Written report We send you a short written report: what we did, and proof the hole is patched.
Keep it for your records, your payment provider or your insurer.30 days of priority support Included Your questions go to the front of the line. Any extra work is billed hourly.
Day-7 check-in Included A week after the patch we email you: how are you doing, do you need anything else?
Don't let an open hole cost you Black Friday.
- The patchIncluded
- Access removedIncluded
- Written reportIncluded
- + 30 days of priority supportIncluded
- + Day-7 check-inIncluded
$400 per site, one-time.
Order per site · $400One site is one website or domain. Paid up front by card. No sales tax added. Businesses only. Terms
Three ways to handle it
Do nothing
- The hole
- Stays open until someone patches it
- Your time
- None today
- Cost
- Nothing today. A hacked site can lose sales and get a Google warning
- When it starts
- Never
- Written report
- No
- Access afterwards
- Nobody checks
- If it isn't done in time
- The hole stays open
Ask your developer or do it yourself
- The hole
- Closed, if they know hosting and are free this week
- Your time
- Find someone, explain it, follow up; or learn your host's tools
- Cost
- Their hourly rate, for as many hours as it takes
- When it starts
- When they have time
- Written report
- If you ask for one
- Access afterwards
- Up to you to check
- If it isn't done in time
- You still pay for the hours
The Thrivee patch
- The hole
- Closed by people who do only this job
- Your time
- Order, then invite us at your host
- Cost
- $400 per site, one-time
- When it starts
- As soon as we have access
- Written report
- Yes
- Access afterwards
- We remove it
- If it isn't done in time
- Your $400 back, automaticallySee the Promise
| Do nothing | Ask your developer or do it yourself |
|---|---|
| The hole | |
| Stays open until someone patches it | Closed, if they know hosting and are free this week |
| Cost | |
| Nothing today. A hacked site can lose sales and get a Google warning | Their hourly rate, for as many hours as it takes |
| When it starts | |
| Never | When they have time |
The Patched-or-Refunded Promise
We apply the security patch within 24 hours of getting access, or you get your money back.
- Not done in time? You get your money back for that site automatically, even if we finish later.
- Your host already patched it, or we can't do it safely? We send your money back the same day, with the reason in writing.
To claim, email [email protected] with your order number. Refunds go back to your card and reach it within 14 days.
The Promise is clause 7 of our terms, the version stored with your order.
Questions
My host says they handle it.
If a hosting company manages your site for you (GoDaddy, Bluehost, SiteGround, Kinsta, WP Engine and similar), it does, and you don't need us. On your own server or cloud account, nobody patches it unless you or your developer do. If you order and we find your host already patched it, you get your money back the same day.
Will my site go down?
It can, briefly. Your site may be offline for 2 to 30 minutes while we apply it. It depends on your server.
Is it safe to give you access?
You invite [email protected] at your hosting company. You see us there as a user and can remove us yourself at any time. We log everything we do on your server. We only touch the engine: not your code, plugins, theme, database or content, and we keep no copy of your data. When we're done, we remove our access and confirm it in writing.
I think my site is already hacked.
Then the patch alone isn't enough. Tell us what's happening, and we'll contact you as soon as possible. The patch includes no malware clean-up, and no promise your site can never be hacked.
I'm not technical. Can I still do this?
Yes. Your part is to order and invite [email protected] at your hosting company. We send you a short guide for your host.
Why $400?
It's one price, paid once, for the whole job: the patch and the check, removing our access, the written report, 30 days of priority support and the check-in a week later. An open hole can cost far more: lost sales and a Google warning on your site. Unusual setups get a price before we start. Any work beyond the patch, including finding out what caused a problem, happens only with your written OK and is billed hourly.
I have more than one site.
The price is per site: $400 for each website or domain. 11 or more sites? Ask us for a volume price.
Does this move my site to a newer engine version?
No. The patch goes into the version you run now. Moving to a newer version is a separate job, which we quote first and bill hourly.
My setup is complex.
Tell us about it first. Unusual setups get a price before we start. Nothing extra happens without your written OK.
Stop the leak before it happens.
Order today. We start as soon as we have access.
Independent service. Not affiliated with the PHP Group, the WordPress Foundation, Automattic, Adobe, PrestaShop SA, the Drupal Association, Open Source Matters, OpenCart, cPanel or Plesk. All other trademarks belong to their owners.