Your internal network sits behind a firewall, and someone has to get through it. Your website is deliberately exposed to everyone on earth, which is the entire point of having one.Almost nobody is picking your business out of a directory and mounting a targeted attack on your brochure site. What hap...
What’s Changing Under Your Website
Hosting & Cloud | Adam Post | Friday, September 18, 2026
Overview
Has your website’s security certificate started renewing more often than it used to? Two changes are working their way through the layer most business websites sit on, and neither makes any noise. This article explains what’s changing, how to find out what your site is running, and which parts are safe to handle yourself.
What Sits “Under” Your Website
Most of a website’s attention goes to the part people can see. Underneath sits a layer of infrastructure that makes the visible part work, and it keeps its own calendar:
The security certificate, which produces the padlock in the address bar
The programming language version, which runs the site’s code
The hosting environment, where the files and database live
The platform and its add-ons, such as WordPress and its plugins
None of it asks for attention while it’s working.
Why Certificates Now Renew So Often
Security certificates used to be issued for as long as 398 days. That maximum is coming down on a published schedule set by the industry body browser makers and certificate issuers both work to:
From March 15, 2026 — 200 days. Already in effect.
From March 15, 2027 — 100 days, or a little over three months.
From March 15, 2029 — 47 days, or roughly every seven weeks.
Certificates issued before each step run until they expire, so this arrives gradually. The point is that a shorter-lived certificate limits how long a compromised one stays useful. The effect is that renewing by hand stops being realistic.
What End of Life Means for PHP
PHP is the most widely used programming language for websites, and it’s what WordPress runs on. Each version has a published support window, and PHP 8.2 stops receiving security fixes on December 31, 2026. After that the site keeps working, but nobody is patching the language underneath it.
What happens next depends on your host. Some upgrade sites automatically at end of life, usually with notice; others sell extended support so you can stay put longer. Either way, plugins and themes written for an older version can stop working when the change lands.
How to Find Out What You’re Running
Both answers take about ten minutes, without touching anything:
The certificate. Click the padlock beside your web address in any browser and look for the expiry date.
The PHP version. In WordPress, go to Tools, then Site Health, then Info, and open the Server section.
If you can’t get in, ask your host what version the site runs and what they do at end of life.
Write both down with the hosting login. That list is the foundation for everything below.
A Practical Example
Consider a business whose website has run quietly for four years. Nobody’s touched the hosting settings, because nothing appeared to need attention. Then three things happen in one quarter: a certificate renewal is missed and visitors get a browser warning, the host moves the site to a newer PHP version, and a payment form stops submitting because a plugin hasn’t kept pace. Each is small alone but yogether they add up to an unplanned week.
Doing It Yourself, and When Not To
The checks above are yours to own, and so is keeping WordPress itself current.
What changes is anything that alters how the site runs: the PHP version on a live site, hosting settings while visitors are on it, and plugin work of any kind. Plugins reach into payments, forms and layout, and one that fails takes its page with it. Bring plugin installations and updates to us rather than applying them yourself.
Our practice is to take a restore point first, apply the change, verify the site, and roll back in one click if anything looks wrong. Scheduled backups with tested restores and monthly checks are part of our website bundle plan for that reason. If something has already stopped working, go straight to our help desk rather than making another change.
Best Practices
Write down what you’re running. PHP version, certificate expiry date, hosting login.
Automate certificate renewal. A calendar reminder isn’t enough at these intervals.
Ask your host what it does at end of life. Upgrade or extended support, you want to know which.
Back up and test the restore. A backup nobody has restored is an assumption, not a safeguard.
Keep WordPress current and hand off the plugins. Regular checked updates beat one catch-up.
How Can Intrada Help?
At Intrada Technologies, we look after the infrastructure under our clients’ websites so these dates get planned for rather than discovered. For small and mid-sized businesses, that’s usually what keeps the work scheduled. Our approach includes:
Monitoring certificate expiry and automating renewal
Testing platform and language upgrades before they reach the live site
Taking a restore point ahead of every change
Reviewing hosting, plugins and platform health on a cycle
If you’re not sure what your site is running today, Intrada Technologies can help you find out and plan the year ahead.
ABOUT THE AUTHOR
Adam is a core member of the Intrada team, working in software engineering, Linux system administration, and web development. He splits his time between writing code and helping keep projects, and the people working on them, moving in the right direction. He likes staying close to the technical work while also being someone the team can lean on to keep things organized.
Learn MoreRight‑sizing simply means aligning cloud resources with actual usage: not too much, not too little. In Azure, this can apply to:Virtual machines (CPU and memory)Storage capacity and performance tiersBackup levels and retentionApplication and database resourcesThe goal is to make sure you’re paying f...