# Who patches your website: you, your web agency or your host?

When a flaw in common web software is announced, you need to know who fixes your site before it happens.

The Assurance Desk. Published 22 October 2026. Last checked 22 October 2026.

Part of the guide [Customer security questionnaires: what they ask and how to answer](https://theassurancedesk.com/guides/customer-security-questionnaires-what-they-ask-and-how-to-answer.md).

**The short answer.** Your contract decides who does the work, but your firm still owns the risk. The NCSC says each update plan should name who does and checks updates. A decision not to update is a senior-level risk decision for the organisation ([NCSC, 10 Steps to Cyber Security, Vulnerability management](https://www.ncsc.gov.uk/collection/10-steps/vulnerability-management) and [NCSC, Vulnerability management, Guidance](https://www.ncsc.gov.uk/collection/vulnerability-management/guidance), checked 22 October 2026).

## Who is responsible for website security updates?

Responsibility for website security updates is usually shared, and your contract decides who does each task. Your firm, your web agency and your host can each hold part of the job.

The UK National Cyber Security Centre (NCSC) says a supplier with privileged access joins in the job of keeping a service secure ([NCSC, Cloud security guidance, Understanding cloud services, Cloud security shared responsibility model](https://www.ncsc.gov.uk/collection/cloud/understanding-cloud-services/cloud-security-shared-responsibility-model), checked 22 October 2026).

The NCSC says to know what systems and software you have, and who is responsible for what. For systems that do not update themselves, the plan should name who does and checks the updates ([NCSC, Vulnerability management, Guidance](https://www.ncsc.gov.uk/collection/vulnerability-management/guidance) and [NCSC, 10 Steps to Cyber Security, Vulnerability management](https://www.ncsc.gov.uk/collection/10-steps/vulnerability-management), checked 22 October 2026).

You can hand the work to a supplier. The decision to leave something unpatched stays with you. The NCSC calls a decision not to update a senior-level risk decision that the organisation must own ([NCSC, Vulnerability management, Guidance](https://www.ncsc.gov.uk/collection/vulnerability-management/guidance), checked 22 October 2026).

## Who patches each part of a website?

Who patches each part of a website depends on how the site is hosted. The NCSC says each party's share depends on the type of service and how the provider runs it. On your own servers, you are entirely responsible for security ([NCSC, Cloud security guidance, Understanding cloud services, Cloud security shared responsibility model](https://www.ncsc.gov.uk/collection/cloud/understanding-cloud-services/cloud-security-shared-responsibility-model), checked 22 October 2026).

With a hosting or cloud service, the provider will almost always look after its servers and their physical protection. Responsibility for the software on those servers depends on the type of service ([NCSC, Cloud security guidance, Understanding cloud services, Cloud security shared responsibility model](https://www.ncsc.gov.uk/collection/cloud/understanding-cloud-services/cloud-security-shared-responsibility-model), checked 22 October 2026).

Your firm did not write PHP, the language many websites run on. The NCSC advises making your provider responsible for updates to all software your organisation did not write ([NCSC, Critical security issue affecting PHP](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php) and [NCSC, Cloud security guidance, Understanding cloud services, Cloud security shared responsibility model](https://www.ncsc.gov.uk/collection/cloud/understanding-cloud-services/cloud-security-shared-responsibility-model), checked 22 October 2026).

Some jobs always stay with you. You check the service meets your security needs, set it up securely and decide what data goes into it ([NCSC, Cloud security guidance, Understanding cloud services, Cloud security shared responsibility model](https://www.ncsc.gov.uk/collection/cloud/understanding-cloud-services/cloud-security-shared-responsibility-model), checked 22 October 2026).

**Who usually holds each part of the job, on NCSC guidance**

| Part of the job | Who holds it | What to check |
| --- | --- | --- |
| Servers, their availability and physical protection | Almost always the hosting or cloud provider | Nothing, unless you run your own servers |
| Everything, if the site runs on your own servers | You | Who in your team, or which supplier, does each task |
| Security of the website software on the servers | Depends on the type of service | Whether the agency, the host or you applies updates |
| Updates to software your firm did not write | The NCSC advises making the provider responsible | Whether your contract says so |
| Meeting your security needs, secure settings and what data the site holds | Always you | Who checks these, and how often |

Source: NCSC, Cloud security guidance, Understanding cloud services, Cloud security shared responsibility model, https://www.ncsc.gov.uk/collection/cloud/understanding-cloud-services/cloud-security-shared-responsibility-model (checked 22 October 2026)

## What did the NCSC say about the PHP security issue?

On 21 October 2026 the NCSC published an alert about a critical security issue affecting PHP. It encouraged UK organisations to take immediate action ([NCSC, Critical security issue affecting PHP](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php), checked 22 October 2026).

PHP published a security update for an issue that may let attackers run commands on any web server running PHP. The NCSC said organisations using any version of PHP are affected and should update to the latest fixed version ([NCSC, Critical security issue affecting PHP](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php), checked 22 October 2026).

If an update is not possible straight away, the NCSC describes temporary mitigations. If those cannot be applied, or would take too long, it says to consider taking the system offline until it is fixed. A system that could not be updated quickly should also be checked for signs of compromise and for backdoors ([NCSC, Critical security issue affecting PHP](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php), checked 22 October 2026).

PHP can also sit inside other products. The NCSC says to watch for updates from third-party vendors, including products and services that may bundle PHP. If you are not confident checking for compromise yourself, the NCSC says an NCSC-assured Cyber Incident Response provider can help ([NCSC, Critical security issue affecting PHP](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php), checked 22 October 2026).

**What the NCSC asks for when a flaw like this is announced**

1. Find it: Identify systems running PHP, starting with internet-facing systems.
2. Update it: Update to the latest fixed version.
3. If you cannot update: Use the temporary mitigations, or consider taking the system offline until it is fixed.
4. Check for compromise: If a system could not be fixed quickly, look for signs of compromise and backdoors.

The order follows the NCSC alert on PHP. Your supplier may do some or all of these steps for you, so agree who does each one.

Source: NCSC, Critical security issue affecting PHP, https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php (checked 22 October 2026)

## How fast should a website security fix be applied?

A website security fix for a critical or high-risk weakness should be applied within 14 days of the update's release, on NCSC guidance ([NCSC, Choosing a managed service provider (MSP)](https://www.ncsc.gov.uk/guidance/choosing-a-managed-service-provider-msp), checked 22 October 2026).

That figure comes from the NCSC guide for small firms choosing a managed service provider. We apply it here to web agencies and hosts, because they also run systems for you ([NCSC, Choosing a managed service provider (MSP)](https://www.ncsc.gov.uk/guidance/choosing-a-managed-service-provider-msp), checked 22 October 2026).

Faster is better when attackers are already using a weakness. The NCSC says to speed up updates when a critical weakness is under active exploitation, especially on an internet-facing system. Attackers often try to exploit weaknesses as soon as they are disclosed ([NCSC, Preparing for a ‘vulnerability patch wave’](https://www.ncsc.gov.uk/blogs/prepare-for-vulnerability-patch-wave) and [NCSC, 10 Steps to Cyber Security, Vulnerability management](https://www.ncsc.gov.uk/collection/10-steps/vulnerability-management), checked 22 October 2026).

A security fix should not sit in a queue. The NCSC says an update strategy should aim to minimise the time before updates are applied ([NCSC, 10 Steps to Cyber Security, Vulnerability management](https://www.ncsc.gov.uk/collection/10-steps/vulnerability-management), checked 22 October 2026).

If you cannot update everything, the NCSC says to update the parts facing the internet first. A public website is one of those parts. A flaw that lets attackers run code may be more serious there than on an internal system ([NCSC, Preparing for a ‘vulnerability patch wave’](https://www.ncsc.gov.uk/blogs/prepare-for-vulnerability-patch-wave) and [NCSC, 10 Steps to Cyber Security, Vulnerability management](https://www.ncsc.gov.uk/collection/10-steps/vulnerability-management), checked 22 October 2026).

Some software is no longer supported and cannot receive updates. The NCSC says patching alone will not always be enough, so plan to move off older products before support ends ([NCSC, Preparing for a ‘vulnerability patch wave’](https://www.ncsc.gov.uk/blogs/prepare-for-vulnerability-patch-wave) and [NCSC, 10 Steps to Cyber Security, Vulnerability management](https://www.ncsc.gov.uk/collection/10-steps/vulnerability-management), checked 22 October 2026).

> "Our recommendation is that software is patched within 14 days of an update being released (where the patch fixes a critical or high-risk vulnerability)."
> NCSC, Choosing a managed service provider (MSP), https://www.ncsc.gov.uk/guidance/choosing-a-managed-service-provider-msp (checked 22 October 2026)

## What should a website maintenance contract say about security updates?

A website maintenance contract should set out who applies security updates and who does everything else. The NCSC calls a matrix of responsibilities good practice ([NCSC, Choosing a managed service provider (MSP)](https://www.ncsc.gov.uk/guidance/choosing-a-managed-service-provider-msp), checked 22 October 2026).

The NCSC also says to agree how incidents are reported, including whether the supplier will tell you about one it suffers. Agree who is accountable for vulnerabilities, damages and incident impacts ([NCSC, Choosing a managed service provider (MSP)](https://www.ncsc.gov.uk/guidance/choosing-a-managed-service-provider-msp), checked 22 October 2026).

Ask who tracks end-of-life dates for your software, and who acts before support ends. Cover any third parties your supplier uses to deliver the service. Agree that your supplier and its own suppliers will work with your incident response team ([NCSC, Choosing a managed service provider (MSP)](https://www.ncsc.gov.uk/guidance/choosing-a-managed-service-provider-msp) and [NCSC, Cloud security guidance, Understanding cloud services, Cloud security shared responsibility model](https://www.ncsc.gov.uk/collection/cloud/understanding-cloud-services/cloud-security-shared-responsibility-model), checked 22 October 2026).

Ask about backups. The NCSC says to check what backup arrangements a supplier has, how often they are tested and whether they suit you ([NCSC, Choosing a managed service provider (MSP)](https://www.ncsc.gov.uk/guidance/choosing-a-managed-service-provider-msp), checked 22 October 2026).

Give a supplier only the access it needs. The NCSC recommends least privilege and an extra sign-in step, so accounts are harder to hack. It also says to check how a supplier protects its login credentials ([NCSC, Choosing a managed service provider (MSP)](https://www.ncsc.gov.uk/guidance/choosing-a-managed-service-provider-msp), checked 22 October 2026).

You should be able to see which privileges a supplier holds ([NCSC, Cloud security guidance, Understanding cloud services, Cloud security shared responsibility model](https://www.ncsc.gov.uk/collection/cloud/understanding-cloud-services/cloud-security-shared-responsibility-model), checked 22 October 2026).

Some security work may cost extra, so read the contract carefully ([NCSC, Choosing a managed service provider (MSP)](https://www.ncsc.gov.uk/guidance/choosing-a-managed-service-provider-msp), checked 22 October 2026).

**Questions to send your web supplier**

- Which parts of the website do you update, and which stay with us?
- What is your policy for applying updates?
- How will you tell us about a security incident, including one at your own firm?
- Who is accountable for vulnerabilities, damages and incident impacts?
- Who tracks when our software reaches end of life?
- Which third parties do you use to run our website?
- How often do you test our backups, and where are they kept?
- How do you protect your logins to our website?

Based on NCSC guidance for choosing a managed service provider. The answers belong in your contract.

Source: NCSC, Choosing a managed service provider (MSP), https://www.ncsc.gov.uk/guidance/choosing-a-managed-service-provider-msp (checked 22 October 2026)

## Does data protection law leave website security with you?

Data protection law can leave website security with you. Your site may collect personal data, for example through a contact form. A supplier that handles it for you may then be your processor under UK data protection law ([ICO, What responsibilities and liabilities do controllers have when using a processor?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/responsibilities-and-liabilities-for-controllers-using-a-processor/), checked 22 October 2026).

The ICO says a controller must only use a processor that can provide sufficient guarantees to protect personal data ([ICO, What responsibilities and liabilities do controllers have when using a processor?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/responsibilities-and-liabilities-for-controllers-using-a-processor/), checked 22 October 2026).

The responsibility does not move with the contract. The ICO says a controller is primarily responsible for its own compliance and its processors' compliance. Whatever the contract says, the controller may face the corrective measures and sanctions in the UK GDPR ([ICO, What responsibilities and liabilities do controllers have when using a processor?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/responsibilities-and-liabilities-for-controllers-using-a-processor/), checked 22 October 2026).

The ICO says controllers should check a processor's compliance on an ongoing basis. It notes this guidance is under review because of changes made by the UK's Data (Use and Access) Act ([ICO, What responsibilities and liabilities do controllers have when using a processor?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/responsibilities-and-liabilities-for-controllers-using-a-processor/), checked 22 October 2026).

## What to do

1. Ask your web agency and your host which parts of the website each one updates. Write the answer into a matrix of responsibilities ([NCSC, Choosing a managed service provider (MSP)](https://www.ncsc.gov.uk/guidance/choosing-a-managed-service-provider-msp), checked 22 October 2026).
2. Ask each supplier for its policy for applying updates. Compare it with the NCSC's 14 days for critical or high-risk fixes ([NCSC, Choosing a managed service provider (MSP)](https://www.ncsc.gov.uk/guidance/choosing-a-managed-service-provider-msp), checked 22 October 2026).
3. Ask whether your site runs PHP. If it does, ask whether the update after the NCSC alert of 21 October 2026 has been applied ([NCSC, Critical security issue affecting PHP](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php), checked 22 October 2026).
4. Ask how your backups are kept and tested, and which access your supplier holds ([NCSC, Choosing a managed service provider (MSP)](https://www.ncsc.gov.uk/guidance/choosing-a-managed-service-provider-msp) and [NCSC, Cloud security guidance, Understanding cloud services, Cloud security shared responsibility model](https://www.ncsc.gov.uk/collection/cloud/understanding-cloud-services/cloud-security-shared-responsibility-model), checked 22 October 2026).
5. Sign up for NCSC Early Warning, a free service for organisations based in the UK ([NCSC, NCSC Early Warning](https://www.ncsc.gov.uk/section/active-cyber-defence/early-warning), checked 22 October 2026).
6. Record any decision not to update as a senior-level risk decision ([NCSC, Vulnerability management, Guidance](https://www.ncsc.gov.uk/collection/vulnerability-management/guidance), checked 22 October 2026).

## Common questions

### Is my web agency responsible if my website is hacked?

It depends on your contract. The NCSC says to agree who is accountable for vulnerabilities, damages and incident impacts. If the site handles personal data, the ICO says the controller may still face sanctions in the UK GDPR whatever the contract says ([NCSC, Choosing a managed service provider (MSP)](https://www.ncsc.gov.uk/guidance/choosing-a-managed-service-provider-msp) and [ICO, What responsibilities and liabilities do controllers have when using a processor?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/responsibilities-and-liabilities-for-controllers-using-a-processor/), checked 22 October 2026).

### Does my host update PHP on shared hosting?

It depends on the type of service. The NCSC says responsibility for the software on the servers depends on the type of service used. Ask your host who updates PHP for your site ([NCSC, Cloud security guidance, Understanding cloud services, Cloud security shared responsibility model](https://www.ncsc.gov.uk/collection/cloud/understanding-cloud-services/cloud-security-shared-responsibility-model), checked 22 October 2026).

### What if a security update breaks my website?

Plan for it before it happens. The NCSC says to limit the impact of problematic updates by staggering them and having a rollback strategy available. Agree in the contract who pays for that work, because some security work may cost extra ([NCSC, 10 Steps to Cyber Security, Vulnerability management](https://www.ncsc.gov.uk/collection/10-steps/vulnerability-management) and [NCSC, Choosing a managed service provider (MSP)](https://www.ncsc.gov.uk/guidance/choosing-a-managed-service-provider-msp), checked 22 October 2026).

### Who keeps the logins if we change web supplier?

Your firm should. The NCSC says to apply least privilege to a supplier's accounts and to see which privileges have been granted to them. That list is what you remove or hand over when the supplier changes ([NCSC, Cloud security guidance, Understanding cloud services, Cloud security shared responsibility model](https://www.ncsc.gov.uk/collection/cloud/understanding-cloud-services/cloud-security-shared-responsibility-model), checked 22 October 2026).

## Where next

- [After a ransomware or security incident](https://theassurancedesk.com/best/security-incident.md)
- [What is supplier assurance, and what do buyers check?](https://theassurancedesk.com/guides/supplier-assurance-what-buyers-check.md)
- [How much is Cyber Essentials, and what does it ask?](https://theassurancedesk.com/guides/cyber-essentials-cost-and-requirements.md)
- [Incident response plan: what to write down](https://theassurancedesk.com/guides/incident-response-plan-what-to-write-down.md)
- [Who is a data controller, and who is a processor?](https://theassurancedesk.com/guides/data-controller-or-processor.md)
- [Data processing agreement: what must an Article 28 contract say?](https://theassurancedesk.com/guides/article-28-processor-contract.md)

## Sources

- NCSC, 10 Steps to Cyber Security, Vulnerability management: https://www.ncsc.gov.uk/collection/10-steps/vulnerability-management (checked 22 October 2026)
- NCSC, Vulnerability management, Guidance: https://www.ncsc.gov.uk/collection/vulnerability-management/guidance (checked 22 October 2026)
- NCSC, Cloud security guidance, Understanding cloud services, Cloud security shared responsibility model: https://www.ncsc.gov.uk/collection/cloud/understanding-cloud-services/cloud-security-shared-responsibility-model (checked 22 October 2026)
- NCSC, Critical security issue affecting PHP: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php (checked 22 October 2026)
- NCSC, Choosing a managed service provider (MSP): https://www.ncsc.gov.uk/guidance/choosing-a-managed-service-provider-msp (checked 22 October 2026)
- NCSC, Preparing for a ‘vulnerability patch wave’: https://www.ncsc.gov.uk/blogs/prepare-for-vulnerability-patch-wave (checked 22 October 2026)
- ICO, What responsibilities and liabilities do controllers have when using a processor?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/responsibilities-and-liabilities-for-controllers-using-a-processor/ (checked 22 October 2026)
- NCSC, NCSC Early Warning: https://www.ncsc.gov.uk/section/active-cyber-defence/early-warning (checked 22 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.