There's nothing for you to patch on your Squarespace site: Squarespace runs the servers, and you don't install or update PHP there. If your business also runs a WordPress blog, a booking tool or a portal on another address, check that address separately.
- PHP for you to manage
- No
- runs the servers
- Squarespace
Why there's nothing to patch on Squarespace
Squarespace runs the servers behind your site. There's no PHP version for you to choose or update, so PHP2Shell isn't yours to patch on Squarespace. PHP2Shell affects servers running PHP from before the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12). On a hosted platform like Squarespace, the platform looks after its own servers.
Other parts of your business to check
Many businesses on Squarespace still have something running on PHP somewhere else. Check each of these addresses separately:
- a WordPress blog on a subdomain
- a booking or member area hosted elsewhere
What PHP Scanner looks for on a Squarespace site
When you check a Squarespace site, PHP Scanner recognizes it from Squarespace server headers and assets from static1.squarespace.com, and shows "Nothing for you to patch" with the evidence.
Questions people ask
Is Squarespace affected by PHP2Shell?
There's no PHP on Squarespace for you to manage or update, so there's nothing for you to patch. Squarespace looks after its own servers.
Does Squarespace use PHP?
Your Squarespace site doesn't run on PHP that you choose or maintain. If you moved from WordPress, make sure the old site isn't still live on another address.
What should I check instead?
Any other website, blog, store or portal your business runs outside Squarespace. Enter each address in PHP Scanner.
Sources
Checked against these sources on October 22, 2026. PHP Scanner is a free tool from Catch Digital and is not affiliated with the PHP project.