Are Wix, Squarespace and Shopify sites affected by PHP2Shell?
Short answer: the platform handles it. Longer answer: make sure every address your business owns is actually on the platform.
Not by you. Wix, Squarespace, Shopify, Webflow, GoDaddy Website Builder, Weebly and Duda run their own servers and patch them themselves. You can't change the PHP version on those platforms and shouldn't need to. Our checker reports them as “no PHP seen”.
Why hosted platforms are different
On a hosted builder you rent a page inside the platform's system; the servers, the software on them and the updates are the platform's job. Several of these platforms don't use PHP at all, and the ones that do keep it current as a matter of course. PHP2Shell is a flaw in self-managed PHP, the kind that powers a WordPress site on a hosting account. That's where the owner, or the owner's host, has to act.
Does Squarespace use PHP? Does Wix?
You can't run PHP on Squarespace or Wix. Squarespace's help center says it "doesn't support server-side code, including PHP, Ruby, Ruby on Rails, and SQL"; its code blocks take HTML, Markdown and CSS, and JavaScript needs the Core, Plus or Advanced plan (Squarespace: adding custom code). On Wix, custom code is JavaScript, run on Wix's own Node.js runtime through Velo (Wix: about the site backend). There's no PHP setting or version for you to update on either, which is why PHP2Shell isn't something Squarespace or Wix owners need to act on.
The one thing still worth checking
Businesses often have more than one site. A Squarespace main site and an old WordPress blog on a subdomain, a Shopify store with a separate landing page someone built years ago, a booking page on different hosting. Each address is its own site. If you have any address that isn't on the platform, check it separately.
Platforms that handle PHP2Shell for you
| Platform | Your action |
|---|---|
| Wix | None |
| Squarespace | None |
| Shopify | None |
| Webflow | None |
| GoDaddy Website Builder (Websites + Marketing) | None (Managed WordPress and cPanel hosting are different: see the GoDaddy guide) |
| Weebly, Duda | None |
| WordPress.com (the hosted service) | None; Automattic maintains the servers. A WordPress site on your own hosting is different. |
Is a site builder still the right fit for your business?
PHP2Shell shows the best thing about a site builder: the platform deals with the servers. For a new business, a simple brochure site or a tight budget, that's a sensible place to start. But the platform only looks after its servers. The rest is still up to you, and the trade-offs tend to show up once a business grows:
- You're still the one running it. The platform patches its servers, but the pages, hours, photos, search setup, booking, email records and Google profile are yours to keep current. For many owners that becomes the job nobody has time for.
- Leaving is harder than joining. Wix says a Wix site has to run on Wix's servers and can't be moved to another host. Squarespace exports only part of a site, as a file for WordPress; store, portfolio and index pages, product and video blocks, and your styles and custom CSS don't come with it. If you outgrow the platform, expect a rebuild rather than a move.
- You work within the template. What the site can do, how fast it loads and what search engines see are limited to what the platform offers. Anything custom means an add-on, a workaround or going without.
What Remidiy does instead
We build custom websites (no templates and no site builders) and then run them for you, so you get what a builder promises without doing the work yourself:
- Managed hosting, DNS and security updates. When the next PHP2Shell comes along, keeping the software we manage up to date is our job, not yours. Website maintenance and security
- A site shaped around your customers. It's built to be fast on a phone and readable by search engines and AI tools, with the technical SEO handled. Web development
- Changes made for you. New hours, services and photos are updated when your business changes, and checked after every update.
- One team for the rest: online booking and business email, local SEO and your Google Business Profile, and customer engagement automation.
- Predictable pricing. A fixed setup fee, quoted up front, then a monthly plan. No hourly billing.
Already on Wix or Squarespace? We audit what you have and rebuild it, carrying over what's worth keeping: your content, photos, page addresses and the search value behind them. Planning the move? See moving off Squarespace or Wix and how to transfer a domain from Squarespace or Wix. If your builder site is working well and you enjoy running it, keep it. If it's become a chore, or you've outgrown it, let's talk.
Book a free discovery call. Tell us what your site runs on and what you'd like it to do. We reply within one business day, usually sooner. Contact Remidiy, email [email protected] or call (914) 222-3310.
Sources
- Shopify security, Squarespace security and Webflow security
- Wix Help: Exporting or embedding your Wix site elsewhere and Squarespace Help: Export your site content
- Squarespace Help: Adding custom code to your site and Wix Developers: About the site backend
- NVD: CVE-2026-109618 and CVE-2026-109619
Common questions
Do Wix, Squarespace or Shopify sites run PHP?
Not in a way you control. These are hosted platforms: the company runs the servers and the software stack and applies security updates itself, so there's no PHP version for a site owner to change.
Is a WordPress.com site the same as a hosted platform?
WordPress.com is a hosted service that manages its own servers, similar to the platforms above. A self-hosted WordPress.org site on your own hosting is different: your host's PHP version matters.
Could anything on a hosted site still be affected?
Other parts of your online presence can be, such as a separate blog, booking system or subdomain on ordinary hosting. Run the PHP vulnerability checker on each address you use.
Does Squarespace use PHP?
You can't run PHP on Squarespace. Its help center says it doesn't support server-side code, including PHP, Ruby, Ruby on Rails and SQL; code blocks accept HTML, Markdown and CSS. Wix doesn't run PHP either: its custom code is JavaScript on Wix's own servers. So there's no PHP version for a Squarespace or Wix owner to update.
Should I move off Squarespace or Wix because of PHP2Shell?
No. PHP2Shell isn't a reason to move: the platform patches its own servers. The reasons businesses do move are different: wanting a custom site, someone else to keep it current, and room to grow. Wix sites can't be moved to another host, and Squarespace exports only part of a site, so moving means a rebuild. We do that rebuild and then manage the site: book a free discovery call.
Part of PHP2Shell: is your website affected, and what to do. Not sure which setup you have? Run the free PHP check and the result tells you.