Host verification
What “we’ve patched it” should mean in writing
A version number alone doesn’t prove a site is safe. Here’s what a defensible confirmation contains.
3 min read
Why the version string isn’t enough
Hosts and distributions often apply a fix without changing the version number, so an older-looking version can be patched and a current-looking one can be running stale code if the service never restarted. Treat the number as a lead, not a verdict.
What a useful confirmation contains
- The exact build or package identifier, not just the major version
- The date and time the update was applied
- Confirmation that PHP and the web server were restarted afterwards
- Whether the fix came from an upstream release or a backport
- The scope: every site and account the statement covers
- A named contact who can stand behind it
What it still doesn’t tell you
A patched runtime says nothing about whether the site was touched before the patch, whether plugins and themes are current, or whether stale admin accounts exist. Those are separate questions, and they’re the ones a host usually doesn’t answer.
Keep it
File the confirmation with the date. If a client or insurer asks what you did about the advisory, you can answer with a document rather than a recollection.
Sources
Want this done for you?
Start with the exposure check, or book a call.