Am I actually affected?
Your host can confirm the installed PHP runtime—the software that runs many websites. A public check may not reveal its exact build.
Website Security, PHP Patching & MSP Services
Skip to page content
Website security · emergency response · ECZ-IDProtect it now.
Protect it now.
Patch it properly.
Prove what changed.
Keep watching.
Your website keeps your business moving. Get help reducing exposure, applying the right update and proving what changed—all without moving your hosting.
One clear plan. Practical protection. Evidence you can use.
Fixed-price services. Secure checkout. Free permanent business identity included.
I’m an MSP / MSSP →Instant action check · Keep your hosting · Free permanent business identity · Secure online payment · One-off work without a subscription
Clarity before action
The questions website owners are asking right now.
Can I reduce exposure while it is patched?
A compatible web application firewall (WAF) can block or challenge supported detected malicious traffic. The official update remains essential.
Could the update break my application?
WordPress, WooCommerce, Magento and bespoke applications may need compatibility checks, a backup and a rollback plan.
Has anyone already tried to attack us?
Available security events can be reviewed. No check can promise perfect detection or identify every human attacker.
How do I show customers we acted?
Keep a factual record of what was observed, changed and re-checked, with an owner for every remaining action.
You need a clear route from question → action → evidence.
One connected service path
From uncertainty to a documented next step.
-
01 / CHECK
Know your next step.
Instant guidance now; runtime evidence confirmed during the service.
-
02 / PROTECT
Reduce immediate exposure.
Configure compatible edge protection within agreed scope.
-
03 / PATCH
Fix the vulnerable runtime.
Apply or coordinate the official supported vendor update.
-
04 / VERIFY & PROVE
Confirm what changed.
Health checks, runtime evidence, retest and remediation record.
-
05 / KEEP WATCHING
Keep the record useful.
Optional supported state checks, notifications and evidence retention.
Website-owner packages
START HERE PROTECT NOW RECOMMENDED COMPLEX OR OLDER APPLICATION?
Choose the next step your website needs.
Fixed scope. Keep your hosting. Every paid package includes help activating the organisation’s free permanent ECZ-ID.
Instant Website Action Check™
£0no card · no account
An instant starting plan for your website—not a vulnerability scan.
- Enter your public website URL
- See Shield and Patch & Verify options immediately
- Understand what needs verification
- No email, account or card required
Emergency Website Shield™
£99one-off
One eligible, straightforward public website.
- Check the compatible edge protection layer
- Configure or verify relevant supported managed rules
- Appropriate rate limits/challenges and traffic-path checks
- Supported event alerts and a short protection summary
- Free DCI / ECZ-ID setup help
Defence in depth. It does not replace the official PHP/vendor update.
Patch & Verify™
£395one-off
One straightforward supported website/runtime.
- Appropriate Emergency Shield work included
- Authorised runtime evidence and backup/rollback preparation
- Apply or coordinate the official supported update
- Restart/redeploy where needed; scoped page/API health checks
- Post-update runtime verification and one re-check
- Remediation summary, remaining actions and free DCI setup
One route from “are we affected?” to a record of what changed. Do not buy Shield separately for the same included work.
Legacy PHP Recovery Sprint™
£1,950one-off
From £1,950: a fixed starting sprint, not unlimited engineering.
- Structured intake and written engineering scope
- Staging, rollback and compatibility planning
- Review dependencies, plugins, themes and application risks
- Supported runtime migration plan and initial scoped work
- Testing; deployment/retest where completed within scope
- Evidence and action record; extra work only with approval
Know the boundaries before you buy. Public checks cannot always establish the installed PHP build. Provider fees, licences and complex migrations are separate and agreed first. We confirm authority, compatibility, access and delivery timing before work. If we cannot accept the standard scope, we explain the next step and refund any unaccepted service payment. No surprise engineering.
No card. No trial. No expiry.Fix the website.
Fix the website.
Give the business a permanent identity.
Every paid website-security package includes help activating DCI Free for the organisation behind the website.
DCI means Digital Counterparty Infrastructure. It gives customers, partners, procurement teams, AI agents and software a persistent business identity they can resolve, rather than guess who operates a website or service.
One permanent organisation ECZ-ID
Use the same Business Passport as your organisation grows. Reuse an existing identity; several websites can belong to one organisation.
A public Resolver page
One shareable link to the business information and evidence status you choose to publish.
A record machines can read
Structured data helps compatible AI agents and software identify the organisation behind a digital surface.
Your badge, QR code and share link
Help customers reach the current record from your website, proposals or printed material.
Your TrustOps management console
Manage supported profile fields, official links, bindings and lifecycle settings.
Seven free machine Passport families
Agent, Model Context Protocol (MCP), Plugin, Application Programming Interface (API), Internet of Things (IoT) Device, Software Development Kit (SDK), and Service & Workload. Five active entities are pooled across the allowance.
One identity, with a clear evidence position. DCI Free uses your permanent free Business Passport foundation. It creates no second ECZ-ID, does not independently verify your business and does not certify your website as secure. Stronger evidence services are optional; your ECZ-ID stays the same.
Activate my free ECZ-ID ↗Optional identity activation, not a purchase step. Available with or without paid work.
See the real experienceA page for people.
A page for people.
A record for the machine economy.
Explore our own Resolver record. Your customers get the same route to a permanent identity, public profile and sharing tools. Extra evidence and operating services appear according to what is enabled and published.
ECZ-ID Resolver · EcoCitizenz example
Open the live record ↗
Screenshots supplied on 23 October 2026
Free record feature
View full size ↗
Your permanent business record
One permanent ECZ-ID and a public page people and machines can read. This example is EcoCitizenz’s Verified record; a new free record starts with information you supply.
Published by choice
Private findings. Public business identity.
Private website security findings
Detailed observations, logs and remediation evidence stay in the agreed private delivery workflow. Never put them in your cart.
Public ECZ-ID / DCI record
The organisation confirms what supported public information is published. A purchase does not automatically publish security findings.
Optional continuity · never preselectedThe patch fixes today’s vulnerability.
The patch fixes today’s vulnerability.
Currentness is an ongoing job.
Website Trust Continuity™
£39.99for a 30-day pass · one payment
Or £399 for 12 months, prepaid. Neither option renews automatically.
Understand supported changes
PulseGuard™ evaluates meaningful ECZ-ID/entity posture and state changes within its supported scope.
Receive relevant notifications
Watch™ notifies you about supported ECZ-ID changes.
Keep a stronger evidence history
LedgerCore™ retains supported evidence according to the agreed plan and retention capabilities.
Edge security protects traffic. The patch fixes the runtime. Continuity helps keep the resulting trust and evidence position from becoming an unmanaged unknown. It is not a WAF or an every-request attack detector. We confirm supported signals, cadence and retention at onboarding. Your pass starts when the agreed service is activated.
When you need more
A permanent foundation. Room to add stronger evidence.
Most website owners should start with DCI Free. Upgrade when a customer, procurement process or operating relationship needs stronger evidence or continuing currentness.
DCI Free
£0permanent
Who is this organisation?
See what is included →DCI Verified™
Stronger managed counterparty context and supported digital-surface binding.
DCI Live-Trust™
Relevant evidence and currentness revalidated over time. An add-on; applicable base context must be confirmed.
DCI Assured™
A stronger evidence posture for higher-reliance relationships.
These are DCI context services, distinct from the lower-priced Business Passport identity tiers. Buying a plan does not automatically award an evidence-driven state. Annual prepaid purchases shown here are one-time payments for 12 months.
Managed service providers · managed security service providers · agencies
Turn the crisis into a managed service your customers understand.
Protect and remediate customer websites, then build recurring machine and counterparty trust services around the estates you already manage.
You keep the customer relationship · ECZ-ID provides infrastructure · Customer identities can start free · Partner economics stay private
MSP = managed service provider. MSSP = managed security service provider.
A concrete first engagement
One client estate. A useful first 30 days.
MSP GLOBAL / FOUNDING OFFER
ECZ-ID MSP Founding Partner Pilot™
£395one-off · one client estate · 30 days
Start with one estate and leave with a customer-ready factual summary, action register and partner handover.
- One client-estate baseline; up to 25 priority digital counterparties mapped
- DCI Coverage baseline and relevant request-to-resolve routes
- One eligible website Emergency Shield deployment
- Client website/runtime crisis review within agreed scope
- Free DCI setup help for the MSP and a setup/request route for the client
- One selected critical counterparty/current-state demonstration
- Customer / quarterly business review (QBR) summary and action register
A limited stronger-currentness demonstration is included only where operationally feasible and expressly agreed. Verified/Assured states are never awarded automatically.
Your £395 pilot can count towards Foundation annual. Buy within 30 days of the pilot purchase and receive the full £395 credit against the canonical £2,490 annual price: £2,095 remains. Request the credit before paying; it is not applied automatically in this cart. One credit per eligible MSP; no cash alternative or stacking.
Request my pilot credit →
Recurring machine trust
Grow around the customers you already serve.
Pricing is based on managed customer tenants under the current programme—never per agent or event. Partner / downstream pricing is agreed privately under the partner agreement.
Foundation
Professional / Growth
Assurance / MSSP
Enterprise
From £2,500/month
Agree the estate, tenant allowance and operating scope.
Discuss the estate ↗Monthly plans recur until cancelled under their subscription terms. Annual prepaid plans are one-time payments for 12 months. Confirm tenant allowances and operating scope; buying more than one tier for the same estate is not an upgrade process.
Illustrative client estate · not live findings
Give the next customer review a clearer picture.
Client Counterparty Estate
18 / 25
priority counterparties resolvable
Illustrative DCI Coverage: 72% with usable context.
Coverage is not a safety score.
- 12
- Sufficiently evidenced for the selected workflow
- 6
- Require stronger evidence
- 3
- Changed / require re-check (overlapping subset)
- 7
- Currently have no DCI
DCI Coverage is the proportion of a client’s priority counterparties for which usable ECZ-ID/DCI context is available.
You already manage devices, identities, backups and infrastructure. ECZ-ID adds a structured way to manage the digital counterparties and machine identities the customer relies on.
Assessment only · no remediation
Need an assessment only?
Website Security Review™ · £195 one-off
Selected external configuration checks, supplied patch-evidence review, a reviewed brief and action list, a 20-minute handover and free Business Passport setup help.
Choose this when your host or developer will handle the changes.
One straightforward public website. No patching, malware removal or incident response included.
Simple purchase. Agreed scope.
01 / CHOOSE 02 / CONFIRM 03 / DELIVER
A few details now. Secure access later.
Pick the work.
Choose Buy now, enter the organisation and website, then continue to secure payment.
Tell us the organisation and domain.
No ECZ-ID account is needed to buy one-off work. Enter your contact and billing details once at checkout.
Agree access. Record the work.
We confirm authority and arrange a private route for credentials and evidence. Free identity activation happens separately, with the organisation’s confirmation.
Fixed scope, explicit authority, no surprises. Authenticated testing needs an agreed scope; exploitation needs explicit authorisation. No security, compliance or certification guarantee is provided. Missing evidence is an unknown, not proof of compromise. Official vendor remediation remains authoritative.
Questions, answered
Know exactly what you are getting.
What is the current PHP security issue?
The PHP project has published security releases addressing critical runtime vulnerabilities. See the current-incident panel for official guidance and the last review date. Use the supported vendor update or documented backport for your environment; a marketing label does not establish affectedness.
How do I know whether my website is affected?
Ask your hosting administrator for the installed PHP build and relevant vendor advisory. A visible banner or a WordPress version alone is not definitive runtime evidence.
Can you check without server access?
The free URL check gives instant service guidance without contacting or scanning your website. It cannot establish your PHP build, firewall configuration or compromise status. We verify the relevant evidence during the authorised service.
Does the £99 Shield fix PHP?
No. It configures or verifies compatible edge protection within scope. It does not replace the official PHP/vendor security update. Provider fees or plan upgrades are separate and require approval.
What exactly happens in Patch & Verify?
We establish the authorised runtime position, prepare backup/rollback, apply or coordinate the supported update, restart or redeploy if required, perform agreed health checks, verify the resulting runtime evidence and provide a remediation summary plus one re-check. Appropriate Shield work is included.
What happens if updating PHP could break my website?
We stop before an unsuitable upgrade. Older or incompatible environments move to a written Legacy Recovery scope, with staging, rollback and compatibility planning. Extra engineering requires your approval.
Can you guarantee my site has not already been compromised?
No. These checks cannot prove the absence of compromise. If evidence suggests an incident, we explain what further investigation is needed.
Can you remove malware?
Malware removal and incident response are outside these standard packages. They require a separately agreed specialist scope.
Can ECZ-ID block attackers?
A compatible WAF can block or challenge supported detected malicious traffic at the edge. ECZ-ID can coordinate and evidence that protection where included. PulseGuard is not the WAF, does not monitor every HTTP request and cannot guarantee every attack is detected or attributed.
What does PulseGuard actually monitor?
Meaningful supported ECZ-ID/entity posture and state changes within the configured service scope. Check the agreed signals, evaluation cadence and notifications; do not treat it as comprehensive website traffic monitoring.
What is DCI Free?
Digital Counterparty Infrastructure Free uses your permanent free ECZ-ID Business Passport foundation: organisation identity, public Resolver record, machine-readable record and supported sharing/management tools. It creates no second identity and is not independent verification or website certification.
Is DCI Free really permanent?
The free identity has no card requirement, trial or expiry under the current free offer. Optional paid capability is separate. Existing ECZ-IDs are reused rather than duplicated.
Will my private security findings be public?
No automatic publication occurs. The organisation chooses supported public information; detailed findings and logs stay in the agreed private workflow.
Do I need to move hosting?
No hosting migration is required for the standard proposition. Compatible edge protection can sit around the existing website. Any DNS, provider-plan or architectural change is agreed first.
Do I need an ECZ-ID before buying?
No. Buy directly through secure checkout. Free identity activation and any entitlement setup happen separately through the established TrustOps/Core flow.
Can an MSP buy for clients?
Yes, with the client’s authority and an agreed scope. The MSP keeps the customer relationship. We confirm the owning organisation and delivery recipients for each client.
What does the £395 MSP pilot include?
One client estate over 30 days: up to 25 priority counterparties, DCI Coverage baseline, one eligible Shield deployment, scoped website/runtime review, MSP/client free-identity routes, one selected current-state demonstration, customer/QBR summary, actions and handover. Buy the pilot online to begin the agreed intake.
How does the £395 annual-plan credit work?
An eligible MSP buying Foundation annual within 30 days of the pilot purchase can apply the full pilot payment against £2,490, leaving £2,095. Ask us to arrange the credit before paying. The cart does not automatically discount a full-price annual purchase.
Can I cancel the monitoring subscription?
Monthly plans use the cancellation terms shown by the subscription provider at checkout. Website Trust Continuity is sold here as a 30-day or 12-month prepaid pass with no automatic renewal. Annual prepaid options explicitly marked one-time cover 12 months and do not use a monthly selling plan.
What happens if the work does not fit the standard scope?
We explain the mismatch and next step before proceeding. Unaccepted service scope is refunded if already paid. Legacy or material extra work needs written approval. Delivery dates are agreed after complete inputs and scope acceptance.
One website or one client estate
Start small. Keep what works.
Website owner?
MSP / MSSP?
Buy online. Confirm access securely. Get the work documented. Your permanent free ECZ-ID is included.