# Trades Business Website Hacked: Help for Firms Without an IT Department > Trades business website hacked or threatened by PHP2Shell? How owners without an IT department sort out host, web designer and the first steps. Source: https://phpsos.de/en/branchen/handwerk/ As of: 25/10/2026 Provider: PHP SOS, PHP emergency help and server security. Immediate help via WhatsApp: https://wa.me/491736494914?text=Hello%20PHP%20SOS%2C%20we%20need%20help%20with%20our%20PHP%20server.%20Company%3A%20%E2%80%A6%20Website%3A%20%E2%80%A6 **In short:** If a trades business website has been hacked or is at risk from PHP2Shell, you do not need to be a technician yourself. What matters is asking the right questions of your host and web designer, securing access and, when in doubt, switching the website off briefly. Specialists take care of the rest. ## Why trades business websites are at risk The website of a trades business is usually lean: services, reference photos, a contact form, perhaps a page with job offers. It was often built years ago by a small agency, a freelancer or someone from the family, frequently with [WordPress](https://phpsos.de/en/plattformen/wordpress/). Since then it has been quietly running along. PHP2Shell hits exactly such sites. The vulnerabilities lie in PHP itself, the programming language underneath almost all websites of this kind. Attackers need no password for it. They scan the internet automatically for vulnerable servers, regardless of whether a corporation or a roofing business stands behind them. ## What data sits on a trades business website At first glance, little. At second glance: enquiries with names, addresses and phone numbers, photos of bathrooms, roofs and boiler rooms that customers upload for an estimate, and applications with CVs and references. Some form plugins store all of this permanently in the database, even though you received the enquiry by email long ago. For attackers this data is less valuable than the server itself. A hacked trades business website often serves as a sender for spam, as storage for fraud sites or as a redirect to fake shops. Your good name in the region becomes camouflage. This is often only noticed when a customer calls and asks why your site is suddenly showing ads for online casinos. ## What a hacked server means for the business - **Fewer jobs:** If Google shows a warning or the site redirects, enquiries stop, often unnoticed for weeks. - **Emails in spam:** If the server sends spam, your quotes and invoices also end up in customers' spam folders. - **Trouble with the host:** Hosts suspend conspicuous packages, sometimes together with mailboxes. - **Forged invoices:** If mail access is affected too, customers may receive invoices with someone else's bank details. ## Trades business and website hacked: who is responsible? In small businesses the situation is often unclear. The hosting contract is in the owner's name, the login details are held by the former web designer, and nobody knows exactly which PHP version is running. With ordinary [web hosting](https://phpsos.de/en/server/shared-hosting/), the host updates PHP for the server. Whether it has done so is something you should ask for in writing. You will find a template in the guide [Asking your host about the patch status](https://phpsos.de/en/ratgeber/hoster-patch-status-erfragen/). Important to know: an update of the website or its plugins does not close the PHP vulnerability. And a patch does not remove malicious code that was planted beforehand. > **Tip:** > Keep the login details for the domain, hosting and website admin in a safe place within the business, not only with the web designer. Otherwise you lose time searching for them in an emergency. ## The first hours: a checklist for owners 1. Ask the host: is PHP patched and restarted for my package? Have the answer given in writing. 2. If there is no clear answer, or there are signs of a hack, switch the website off temporarily via the host's customer menu. During that time, enquiries come in by phone and email. 3. Ask the host to retain the server logs from 20 October 2026 onward. 4. Change all passwords only once the server is clean, otherwise an attacker will read the new ones straight away. 5. Check whether a current backup exists and who can restore it. ## After the incident: deliberately keep the website simple Many trades business websites carry ballast around with them: plugins for functions that were never used, old test pages, a forgotten guestbook. Each of these parts has to be maintained. After an incident, a clear cut is worthwhile: whatever brings no enquiries goes. Also clarify whether forms need to store enquiries permanently or whether an email to the business is enough. Make sure regular backups exist that are not on the same server. And check whether your hosting package still suits the website, or whether a managed package with clear responsibility for PHP is the simpler solution for you. ## How does PHP SOS help? - We talk to your host and web designer on your behalf and clarify, in plain words, who has to do what. - We remotely check whether the server is patched and whether malicious code, foreign admin accounts or spam scripts are present. - In case of an infection, we clean up the website as part of our [emergency help](https://phpsos.de/en/leistungen/website-gehackt-notfallhilfe/) and help to get a Google warning removed again. - We re-secure your access and hand you short documentation for your records. - Anyone who no longer wants to deal with it themselves gets fixed responsibility through a [maintenance contract](https://phpsos.de/en/leistungen/security-wartungsvertrag/). ## Frequently asked questions **An acquaintance built my website. Who is responsible now?** The business to which the domain and hosting are registered is responsible for the website. The web designer can help but is only responsible if a maintenance contract says so. For PHP on the server, with ordinary web hosting the host is usually responsible. **How do I notice that my trades business website has been hacked?** Typical signs are redirects to other sites, foreign-language content in Google results, a warning in the browser or enquiries suddenly stopping. Sometimes the host gets in touch because the server is sending spam. Often, though, nothing is visible at first. **Can a website hack also affect my emails?** If the website and mailboxes are in the same hosting package, that is possible. An attacker can use the server to send spam, which causes your emails to land in customers' spam folders. After the cleanup, also change the mailbox passwords. ## Sources - [php.net: Security announcements](https://www.php.net/) - [BSI: Warnings and recommendations](https://www.bsi.bund.de/) - [Google Search Console Help](https://support.google.com/webmasters/)