A supply chain attack reaches you through a supplier or supplied component, rather than only through your own website.
Definition source: NIST: supply chain attack. Read on October 24, 2026. The practical questions on this page help you define the issue with your administrator.
What is the supply chain behind your website?
Your website uses components and services supplied by other parties. These might include a WordPress pluginA WordPress plugin is an add-on you install in WordPress to give your site extra features, such as contact forms, SEO tools or a webshop., an external script or a service that publishes files for you. NIST describes a supply chain attack as one involving the target’s supply network.
The route therefore passes through a dependency you use.
A supplier outage is not automatically such an attack. Evidence must support the claim of an unauthorized change or access. Likewise, a software company’s change of ownership does not establish that its products are untrustworthy.
Base the assessment on a concrete notice and the components named in it.
How do you establish whether a notice applies?
Which PHP version does your site report?
We read only what your site already sends in public: the headers and the top of the homepage. No scan, no login.
Ask your administrator whether the site uses the named component, where it comes from and which version or delivery is involved. Keep the developer’s security advisoryA security advisory is an official notice from a software maker about a security weakness: what it is, which versions are affected and how to fix it. with that inventory. A brand name in a news report is too broad to establish whether your own installation is affected.
Check who can change the component too. Some files are released with your website; others arrive from an external service during a visit. That difference determines which party holds information about a change.
If an answer lacks evidence, ask for the source used and the date of the check.
What should you do when a supplier reports an incident?
Have your administrator compare the supplier’s advice with your installation. Agree who maintains contact and who tests any changes. Do not independently remove every external component: forms and payments may depend on them.
First establish which recommended measure applies to your own situation and who can carry it out.
Subresource IntegritySubresource Integrity lets a browser check whether a loaded script or stylesheet matches its expected content. can block unexpected content changes for suitable files. It does not examine the entire supply chain. Ask which dependencies the check covers and which it does not.
Replacing PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. does not automatically resolve a risk in an external browser script.
When should you seek help?
Ask for help if nobody can inventory the dependencies, the supplier’s advice is unclear or suspicious code has been found. Keep the question specific: which component, which source and what evidence of use on your site? That allows an investigator to establish what needs further attention.
Do not accuse a supplier based on a similar name or a secondhand report. Preserve the original notice and the supplier’s response. Record which conclusion is confirmed and which question remains open, even when the website works normally after a change.
Product and company names on this page belong to their respective owners. We use them to describe the subject. We are not affiliated with those parties.
Prepare your request for help
Write a short note for your administrator naming the page, the time of the observation and what your team changed beforehand. Include the original warning if one is available. Keep facts separate from suspicions.
Describing what you saw on a particular page is more useful than stating a conclusion that has not been investigated.
For routine maintenance of a PHP site, review the existing PHP services. First discuss which question fits the service. This glossary page explains a term; it does not examine your installation or promise recovery.
For a possible incident, establish the expertise needed and which components someone can actually assess before agreeing the work.
Agree who receives the findings and who follows up an open question. Request a report identifying the areas checked, the date and the limitations. That helps you decide on a next step without treating general reassurance as evidence.
Your own first step is to record the observation and pass it to the administrator responsible for the site.
Frequently asked questions
Should I stop using every external service?
One warning does not establish that. Identify the affected dependency and the supplier recommendation. Discuss consequences for forms and payments before components are changed.
What should I tell my administrator?
Provide the page, time and original warning. Describe what you observed and what remains a suspicion. Do not submit passwords, keys or customer personal information through an ordinary contact form.
Can the PHP Exposure Check establish this?
No. It reports public information such as the PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. exposed by your server. It does not investigate malware, access permissions or interception of form input.
Have your specific warning assessed separately.