Website Health Check for NZ Tradies (2026)

Executive Summary

Key takeaways: what you'll get from this guide

What happened when a PHP flaw took websites offline in October 2026, in plain English
Eight checks you can run on your own site in about 10 minutes, no login needed
Which results mean "fine", "keep an eye on it" and "get someone to look this week"
What ongoing website maintenance should actually include
Where to get a free second opinion without a sales pitch

On 21 and 22 October 2026, government agencies and businesses around the world took websites offline after two critical flaws were found in PHP, the programming language that runs WordPress and a large share of the web 1. Across the Tasman, even the website of Australia's national cyber security agency, cyber.gov.au, was unavailable for several hours 2.

The fix came out within a day. The sites that stayed exposed were the ones where nobody was watching: no one to install the update, no one to notice the site was down, no one to get the call.

So the question worth asking about your own website is simple: if something broke tonight, who would know?

How Common Is PHP on Tradie Websites?

Very. PHP is used by 69.3% of websites whose server-side language is known 3. If your site was built on WordPress, it runs on PHP. Plenty of hosting control panels, booking plugins and contact forms do too.

PHP gets patched quickly when flaws are found. The risk sits with a site that was built five years ago, handed over, and never touched again. Every plugin, theme and server version on it is still the one from launch day, so the patch never reaches it.

The 10-Minute Website Health Check

Run these on your own site. Each one takes a minute or two and needs nothing more than a phone or laptop.

2. Is there a padlock next to your web address?

Open your site in Chrome or Safari. You should see a padlock or a "secure" icon, and the address should start with https://. A "Not secure" warning scares off customers before they read a word, and Google ranks those sites lower.

3. Do your phone number, hours and services still match the job?

Check the number rings your current mobile, the hours are right, and you still do every service listed. Then compare it against your Google listing. When the two disagree, Google trusts both less.

4. Does the contact form actually arrive?

Fill in your own contact form with a test enquiry. Time how long it takes to land in your inbox. If it never arrives, or lands in spam, you may have been losing jobs for months without knowing.

5. Does it load fast on a phone?

Put your address into Google's free PageSpeed Insights tool 4 and look at the mobile score. Most of your customers find you on a phone, often on a job site with patchy signal. A slow site loses them to the next result.

6. Is it on old WordPress plugins?

If your site runs WordPress and you can log in, go to Dashboard > Updates. A long list of plugins and themes waiting for updates is the clearest sign a site is unwatched. Of the 11,334 new WordPress security flaws found in 2025, 91% were in plugins and only six were in WordPress itself 5.

If you cannot log in, or do not know who can, that is a result in itself. See the next check.

7. Do you know who controls your domain, hosting and logins?

Write down who holds the login for each of these:

Your domain name (the web address)
Your hosting (where the site lives)
Your website admin or editor
The email account that receives your enquiries

If the answer to any of them is "the bloke who built it" or "not sure", you cannot get a fix applied quickly when something like the PHP flaw comes along.

8. Would anyone notice if the site went down tonight?

Ask whoever looks after your site: is there an uptime monitor that checks it every few minutes and alerts someone? If the honest answer is "you'd find out when a customer told you", the site is unwatched.

What Do Your Results Mean?

All eight fine: someone is looking after the site. Keep it that way.
One to three flags (copyright, speed, details): the site is out of date but not urgent. Worth fixing before your next busy season.
Any flag on 4, 6, 7 or 8: get someone to look this week. A broken form or unknown logins cost real jobs, and plugins carry almost all the WordPress security risk.

What Should Website Maintenance Actually Include?

A monthly website maintenance plan is only worth paying for if it covers the boring parts that stop a site going stale. At a minimum, ask whoever looks after your site whether they:

Apply security updates for the site, its plugins and its framework when they are released, not once a year
Monitor uptime and get alerted within minutes if the site goes down
Watch for security advisories that affect the tools your site is built on
Test the contact form so enquiries keep arriving
Keep backups that can be restored quickly
Tell you when something happened and what they did about it

If they cannot answer yes to most of those, what you are paying for is hosting. For what a monthly plan covers at Made 4 Tradies, see what $59 a month website maintenance covers.

How Did Made 4 Tradies Sites Fare in the PHP Outage?

None of the websites we build run on PHP, so the flaw did not touch them. The one internal system we use that does run PHP was patched the day the fix was released.

The bigger reason they were safe is that they are watched: uptime is checked every five minutes, a security check runs every morning against the tools our sites are built on, and we keep an eye on our hosting providers' status pages. When something breaks, we hear about it before your customers do.

Want a Free Website Health Check?

If you would rather someone else ran these checks, we will do it for free. It takes about 10 minutes, and you will get a straight answer on what needs fixing, what can wait, and what is fine as it is. No hard sell.

Free website audit: security, speed, contact form and local signals, checked for you
Book a free website check: a 10-minute call to go through your results

Or reply to any of our emails.

Frequently Asked Questions

How do I know if my website is out of date?

Run the eight checks above. The quickest signs are an old copyright year in the footer, a "Not secure" warning in the browser, plugins waiting for updates, and contact details that no longer match your business.

Was my website affected by the October 2026 PHP flaw?

If your site runs on WordPress, Drupal, Joomla or another PHP system, it could have been. Ask whoever hosts or maintains it whether PHP was updated after 22 October 2026. If nobody can tell you, that is the bigger problem.

How often should a tradie website be updated?

Security updates should go on as soon as they are released, usually within days. Content like services, photos and reviews is worth a look every few months, and any time your business changes.

What is a website health check?

A website health check looks at whether a site is secure, fast, accurate and working. It covers the padlock, speed on mobile, the contact form, software updates, and who holds the logins.

How much does website maintenance cost for a tradie?

It varies a lot by what is included. See what $59 a month website maintenance covers for one breakdown, and how much a tradie website should cost for build costs.

Do I need to rebuild my website if it fails these checks?

Not always. A missing padlock, an old plugin or a broken form can often be fixed without a rebuild. A rebuild makes sense when the site is slow, hard to update, and nobody holds the logins.

References:

Published by Made 4 Tradies. Built by online experts who understand tradies. Serving New Zealand from Hawke's Bay across the country.

Website Health Check for NZ Tradies: 8 Signs Your Site Is Out of Date