A Glasgow IT support company's scan of 461 Scottish dental practice websites found Aberdeen the worst-hit area: of the 19 Aberdeen sites that disclose their PHP version, seven (37%) are running versions that no longer receive security fixes.
Riverbank IT Systems made one ordinary request to each practice homepage on 27 October 2026 — nothing probed or tested beyond what a browser sees. Across Scotland, 268 of the 453 reachable sites (59%) run WordPress, 121 disclose their PHP version, and 41 of those (34%) are on end-of-life releases. Six run PHP 5.6 or 7.0 — no security patches for more than six years.
PHP powers the back-end of most small-business websites. Versions past their security-support date keep working but receive no fixes, and dental sites carry contact forms and appointment requests. Notably, most practices keep WordPress itself updated (113 of 142 on the current branch) — it is the PHP underneath, set by the hosting company, that gets left behind.
"Most of these practices are doing the right thing — WordPress is up to date on nearly all of them. The problem is underneath: the PHP version is set by the hosting company, and nobody is asking. It is usually a twenty-minute job to put right, and it is far cheaper than cleaning up a hacked site," said Timothy, founder of Riverbank IT Systems.
Upgrading is normally a hosting change, not a rebuild. Remote diagnosis and repair starts at £39.99 + VAT for the first 20 minutes; larger jobs are quoted in writing first. No practice is named.
Full findings: https://www.riverbank-systems.com/news/scottish-dental-practice-websites-unsupported-php-study-2026/ — fixes: https://www.riverbank-systems.com/security-audit/php-fixes/.
About Riverbank IT Systems: Glasgow-based IT support company founded in 2003, providing 24/7 managed IT support, Microsoft 365, cloud and cyber security services to SMEs across Scotland, Northern England and Northern Ireland.