Customer story
Vienna · HR services
Undivi: the same website, four times as fast.
“Now it loads four times as fast — and a change is a message, not an agency project.”
Karim PfeilManaging Director, Undivi
Beforeload time
On Johnnya quarter
PHP security release · 21 October 2026 · CVE-2026-109618 and -109619
Patch PHP today.
Then never again.
The 21 October fix closes this hole in PHP. Johnny removes the door: we move your WordPress site, same look and same addresses, to a site with no PHP, no plugins and no admin login left to patch.
Let’s look at what your site shows the world: PHP, plugins, logins. What’s the address?
- Free
- About a minute
- No sign-up
- Nothing changes on your site
Today, then for good.
The patch closes this hole. Moving to Johnny takes away the next ones.
Today: install the PHP fix.
- 1Find your PHP version: in WordPress, Tools → Site Health → Info → Server.
- 2On managed or shared hosting, your host installs the fix. No mail from them yet? Ask today. A fix applied to an older version keeps its number, so ask rather than look.
- 3On a server of your own, you or your administrator install PHP 8.2.35 or newer and restart PHP. PHP 8.1 and older get no new release.
- 4Did the update break your site? Have your host switch PHP back to the previous version. One setting, and the site is back today. Then send us your address.
This is the fix for this hole. The patch is quick, the move takes longer. So patch first.
For good: a site with nothing to patch.
- Your pages are delivered finished. No PHP runs on your domain.
- No plugins, no theme, no admin login, no database. What every WordPress attack needs isn’t there.
- Same look, same addresses, same email. You see it before anything switches.
Why this keeps happening
- A WordPress site runs code every time someone opens a page: WordPress, your theme, your plugins, and PHP underneath.
- Each of them needs updates, and any of them can be the way in. This time it was PHP itself, so updating WordPress didn’t help. WordPress.org says no WordPress update is planned: the fix is PHP.
- Attacks started on the morning of 21 October, before the fix was out.
- The next date is already set: PHP 8.2 gets its last security fixes on 31 December 2026. 8.1 and older already get none.
- A WordPress site nobody looks after is still a WordPress site anyone can attack.
On Johnny, those doors don’t exist.
Nothing left to update. Far less to attack.
Why we don’t say unhackable
Your site is still on the internet. But nothing on it runs code, so an attack like this one has nothing to run on. What does run, the function behind your contact form and Johnny itself, is ours to keep patched. That is part of the monthly fee, not your job.
What can break, or be broken into
PHPGonePluginsGoneAdmin loginGoneDatabaseGoneUpdate emailsGone
What stays. What changes.
Stays
- How your site looks, every page
- Every page address, so your Google listings stay
- Your domain and your email
- Your contact form, carried over and tested
Changes
- No PHP, plugins or admin login to update
- Pages load faster
- Hosting, SSL and backups are included
- A change is a message, with preview and undo
A good fit:company and service sites, a normal blog, contact forms.Not yet:online shops and member logins. If your site needs those, we say so before you pay.
And on the side
Security is why you’re here. These come with it.
Faster
Finished pages load in a fraction of the time. Undivi’s site loads four times as fast as on WordPress, with the same look.
Easier to change
Write what you want changed. You see a preview, then publish or undo. No tedious clicking through an editor.
Looked after
Hosting, SSL and backups. All in the monthly fee.
How the move works
You decide every step. Nothing goes live until you say go.
- 1
You
Send your address
Johnny checks your site: what it shows an attacker, how fast it is, what ChatGPT finds. Free, and your score needs no sign-up.
- 2
Us
Your preview, within 5 working days at the latest
Your whole website on Johnny, free, on a private link. Same look, every address kept, your form carried over and tested. We look over every page before you get it.
- 3
You
Try it, then say go
Change something on any page by message. If you like it, say go: only then do you pay €490 for the move. If not, you don’t have to do anything.
- 4
You
Switch your domain
One setting in your domain settings. From then on, a change is a message.
You never give us your WordPress login. We rebuild from your live site.
Who is behind Johnny
We check every page
On computer, tablet and phone, before your site switches. We look over every preview before it goes out.
30-day money-back guarantee
Not happy in the first 30 days after the switch? You get everything back, and we point your domain back to your old site. Keep it running, and patched, until then.
What it costs
The move
€490
Promotion price until 31.12.2026
Once, and only if you keep it
Johnny
€99per month€119
Billed yearly.
You get both. We move your site once, and Johnny runs it from then on.
See your site. Try the editor. Then decide.
The report is free, and so is the preview of your whole website that follows it. You pay for the move only if you keep it. No call, no credit card. Not happy in the first 30 days? You get everything back.
In the move
- Every page rebuilt, with the same look
- Every page keeps its address
- Forms, analytics and cookie banner carried over
- We check every page on computer, tablet and phone
- Seen and tried by you before you pay
Every month
- Changes by message, with preview and undo
- Unlimited content changes: text, photos, team, hours, prices
- Hosting with SSL
- Backups and security
All prices are net. VAT is added. Unlimited changes within fair use. Billed monthly. Cancel any month: €119 per month.
Questions
Do I still have to install the PHP fix?
Yes, today. Your host usually does it; ask them if you have no mail. The move takes longer than the patch, so don’t wait for us.
The PHP update broke my site. What now?
Ask your host to switch PHP back to the version it was on: one setting in the hosting panel, and your site is back today. Ask them whether that version has the fix of 21 October; some hosts patched old versions too. Then send us your address. We rebuild from your live site, so it has to be online. A backup copy works as well.
Is a site on Johnny really safe from this kind of attack?
This attack runs code through PHP on the server. On Johnny nothing on your site runs code: your pages are delivered finished. No PHP, no plugins, no admin login, no database. We don’t say unhackable. We say there is far less to attack, and nothing for you to keep patched.
What happens to my plugins?
What they do moves: your forms, analytics and cookie banner come along, and we test them before the switch. The plugins themselves don’t, so there is nothing left to update. Online shops (like WooCommerce) and member logins can’t move yet; if your site needs them, we tell you before you pay.
Will my site look exactly the same?
Yes. Every page as it is: design, text, photos, menus and forms. Before the switch we check every page on computer, tablet and phone against your current site.
What happens to my Google listings?
Every page keeps its address, so links and Google listings still work. We carry over your page titles and descriptions and check them before the switch.
Do you need my WordPress login?
No. We rebuild every page from your live site. You don’t give us a password.
My site has already been hacked. Can you move it?
Yes, if a clean copy can still be reached: a backup, a staging copy, or the pages as they were before. Write to hello@telljohnny.com when you send your address. We rebuild from the clean copy and look at every page before you see the preview. If there is no clean copy, we tell you before you pay.
What do I do with the old WordPress after the switch?
Keep it running, and patched, for 30 days: that is how long the money-back guarantee lasts. Then switch it off and cancel the hosting. A WordPress site nobody visits is still one someone can attack.
Patch PHP today.
Then send your address.
Free. About a minute. Nothing changes on your site.