A Glasgow IT support company has published a scan of 461 Scottish dental practice websites — including 50 reachable Glasgow practices — finding that of the 14 Glasgow sites disclosing their PHP version, three are running versions that no longer receive security fixes.
Riverbank IT Systems made one ordinary request to each practice homepage on 27 October 2026 — nothing probed or tested beyond what a browser sees. Scotland-wide, 268 of the 453 reachable sites (59%) run WordPress, 121 disclose their PHP version, and 41 of those (34%) are on end-of-life releases. Six sites run PHP 5.6 or 7.0, unpatched for more than six years.
PHP powers the back-end of most small-business websites, including the WordPress under most dental sites. When a version reaches end of life it keeps working but stops receiving fixes — and dental sites carry contact forms and appointment requests. Most practices keep WordPress itself updated (113 of 142 on the current branch); the PHP underneath is set by the hosting company and rarely maintained.
"Most of these practices are doing the right thing — WordPress is up to date on nearly all of them. The problem is underneath: the PHP version is set by the hosting company, and nobody is asking. It is usually a twenty-minute job to put right, and it is far cheaper than cleaning up a hacked site," said Timothy, founder of Riverbank IT Systems.
Upgrading is normally a hosting change, not a rebuild. Remote diagnosis and repair starts at £39.99 + VAT for the first 20 minutes; larger jobs are quoted in writing first. No practice is named.
Full findings: https://www.riverbank-systems.com/news/scottish-dental-practice-websites-unsupported-php-study-2026/ — fixes: https://www.riverbank-systems.com/security-audit/php-fixes/.
About Riverbank IT Systems: Glasgow-based IT support company founded in 2003, providing 24/7 managed IT support, Microsoft 365, cloud and cyber security services to SMEs across Scotland, Northern England and Northern Ireland.