Most of the time, good website hosting is invisible. Your site loads, your visitors find what they need, and you never give your server a second thought.
Then late October 2026 comes along.
In the span of just a few days, the WordPress world faced two very different security events: a critical flaw in PHP, the software most of the web runs on, and a breach at the company behind one of the most popular WordPress backup plugins. Neither was caused by anything a website owner did wrong. And neither could be solved by clicking “update” in your WordPress dashboard.
That’s exactly why we believe managed hosting matters. Let’s recap what happened, what it means for your website, and how a well-managed server makes all the difference.
What is managed hosting?
Most WordPress hosting falls into one of three categories. With shared hosting, many websites split the same server resources. With dedicated hosting, one website has an entire server to itself. Cloud or VPS hosting is the middle ground, giving each site its own slice of resources on a shared system. Each option comes with its own trade-offs in cost, performance, and security. Managed hosting, though, is less about which type of server you’re on and more about who is taking care of it.
With unmanaged hosting, you rent space on a server, and everything else is up to you: server software updates, security settings, backups, and troubleshooting when something breaks. With managed hosting, a team of experienced people looks after the server itself. They keep its software current, monitor for threats, maintain backups, and respond quickly when something goes wrong.
If your website is your digital home, managed hosting is a trusted team caring for the foundation, the wiring, and the locks, so you can focus on what happens inside.
What two security events taught us
1. A security flaw underneath millions of websites
The team behind PHP released emergency updates for a pair of serious vulnerabilities nicknamed “PHP2Shell.” PHP is the programming language WordPress runs on, along with roughly 70% of all websites, so this flaw reached far beyond any single theme or plugin. In the worst case, it could allow an attacker to run their own code on a vulnerable server without ever logging in.
Here’s the part that matters most for website owners: updating WordPress, your theme, or your plugins couldn’t fix this one. Only updating PHP itself, on the server, would close the door.
Details leaked before the planned release, and attempts to exploit the flaw climbed into the millions within a day. Some government agencies, hospitals, and schools in Europe temporarily took their websites offline rather than risk being exposed. Thankfully, as of this writing, no widespread break-ins have been confirmed, but for a few days the race to patch servers was very real.
2. When a trusted plugin company is breached
Just a few days earlier, TeamUpdraft, the company behind the UpdraftPlus backup plugin, discovered that someone had gained unauthorized access to its website and customer database. The plugin itself wasn’t compromised, but the breach exposed connection keys for its remote management service. Attackers used those keys to create unexpected admin accounts and install malicious plugins on some connected websites. TeamUpdraft responded quickly with an update and clear guidance for its users.
This isn’t a story about a bad plugin. UpdraftPlus is used on millions of websites, and its team has been transparent throughout. It’s a reminder that every tool connected to your website becomes part of its security, and that your backups shouldn’t depend on a single plugin.
Why managed hosting makes the difference
Moments like these are when the value of managed hosting becomes clear.
Server-level updates are handled for you
When the fix lives on the server rather than in your dashboard, you need someone with access to the server who is watching for it. A managed host applies those updates for you, often before most website owners have even heard there’s a problem.
Protection comes in layers
No single tool catches everything. Managed hosting adds protection at several levels, from firewall rules on the server to security settings at the network level, so a threat has to get past more than one locked door.
Backups live independently of your plugins
With managed hosting, backups happen at the server level, separate from the plugins running inside your website. If a plugin or the company behind it runs into trouble, your safety net is still in place.
People are paying attention
Perhaps most importantly, managed hosting means real people are keeping watch, and they know what to do when something unexpected happens.
Managed hosting in action
Before the PHP update was released, our team spent hours preparing our clients’ websites for it. We made sure WordPress and every plugin were up to date, and that every site was running at least PHP 8.2 so the fix could be applied as soon as it arrived. For the websites we host, we also verified each site’s Cloudflare settings so the firewall protections Cloudflare released ahead of the announcement were active.
When the UpdraftPlus breach became known, our team and the BigScoots tech support team removed UpdraftPlus from every site that used it on our server right away. Some of our hosting-only clients choose their own backup subscriptions, like UpdraftPlus, to keep their own copies of their site. But every website we host or care for is also managed through our maintenance dashboard, ManageWP, where our team keeps its own backups. So even when a client’s personal backup tool ran into trouble, their site’s safety net was still in place.
Since the PHP update was applied, we’ve continued monitoring every hosted and site care website to make sure each one is up, running, and working the way it should.
Our hope is that, for our clients, those few days felt like business as usual. That’s the point of the hands-on care we offer.
Why we host with BigScoots
We chose BigScoots for our private server because of their speed, reliability, and exceptional support, and those few days reminded us why.
Hours before the PHP update was released, BigScoots had already put firewall rules and server settings in place to block the known paths of attack. When their usual source for PHP updates went offline under the heavy demand, their engineers built their own process overnight so they could apply the fix the moment it was available. They then updated their entire network and confirmed to customers by email that every server was patched, with no evidence of any breaches.
Not every host moved this quickly. Across the industry, responses varied widely. Some hosts relied on temporary firewall protections for a while before applying the actual fix. Others were still rolling out updates a day or more later, and a few briefly took websites offline to complete them. When the stakes are this high, the difference between hours and days matters.
Our managed hosting plan
Roughly nine years ago, we began offering our own hosting plans after many years of working inside clients’ individual shared hosting environments. We saw firsthand the rapid decline in the quality of server performance, security, and overall support and maintenance while the monthly or annual fees continued to climb. That decline prompted us to act quickly on our clients’ behalf. As with many of the services we offer today, we chose to bridge the gap and offer a more reliable and economical solution for the faith-driven creatives we serve.
Our Short Plan pairs managed hosting on our private BigScoots server with quarterly site care. It includes:
- Managed website hosting
- Core WordPress updates
- Quarterly plugin updates
- Quarterly database optimization
- Quarterly performance assessment
- Quarterly security scan
- Manual monthly backups
- Access to MRM-owned licensing for site extensions
Already on our Tall or Grande site care plan? You can add managed hosting on our private server at a discounted rate. Whenever it fits a client’s budget, we love pairing the two. Hosting and site care work best together, with one team that knows your website, its history, and the goals behind it.
A solid foundation for what you’re building
Your hosting is the foundation your website is built on, and you shouldn’t have to become your own IT department to keep it secure. If you’d like to talk through whether managed hosting is a good fit for your website, contact us here. We’ll gather a few details and schedule a free discovery call (i.e., coffee date) to start the conversation.
This post may contain affiliate links. Read our full affiliate disclosure here.
