Glasgow IT support company Riverbank IT Systems checked the public homepages of 461 Scottish dental practice websites and found that, of the 121 sites that disclose their PHP version, 41 (34%) are running versions that no longer receive security fixes.
The scan — one ordinary request to each homepage on 27 October 2026, nothing probed or tested beyond what a browser sees — found that 268 of the 453 reachable sites (59%) run WordPress, and that six run PHP 5.6 or 7.0, versions with no security patches for more than six years. Three sites still serve over plain HTTP with no HTTPS at all.
PHP is the software that powers most small-business websites, including WordPress. Each version only receives security patches for around three to four years; after that, publicly known vulnerabilities stay open permanently.
The finding that most practices keep WordPress itself updated made the gap starker: of the 142 WordPress sites that disclose their version, 113 are on the current 7.1 branch — while the PHP underneath is left untouched.
"Most of these practices are doing the right thing — WordPress is up to date on nearly all of them. The problem is underneath: the PHP version is set by the hosting company, and nobody is asking. It is usually a twenty-minute job to put right, and it is far cheaper than cleaning up a hacked site," said Timothy, founder of Riverbank IT Systems.
By area, end-of-life PHP among sites that disclose: Aberdeen 7 of 19, Edinburgh 3 of 16, Glasgow 3 of 14, Dundee 2 of 7, Inverness 2 of 6, rest of Scotland 24 of 59.
Riverbank says upgrading to a supported PHP release is usually a hosting change measured in hours, not a rebuild. No practice is named in the study; any Scottish dental practice can email the firm and be told privately whether its site was in the sample and what was seen, free of charge.
The full findings, method and anonymised area breakdown are published at https://www.riverbank-systems.com/news/scottish-dental-practice-websites-unsupported-php-study-2026/ — remote PHP diagnosis and repair starts at £39.99 + VAT for the first 20 minutes via https://www.riverbank-systems.com/security-audit/php-fixes/.
About Riverbank IT Systems: Glasgow-based IT support company founded in 2003, providing 24/7 managed IT support, Microsoft 365, cloud and cyber security services to small and medium-sized businesses across Scotland, Northern England and Northern Ireland, with an Edinburgh presence and SC-cleared engineers.
Media contact: Anand Kumar, anand.kumar@rbs.uk.net, 07967 928551, Riverbank IT Systems, Glasgow.