Yes, We’re the Back Office
Most of what we do, nobody sees. That’s not a complaint. It’s the job.
When things go right, a website is just there. It loads, the contact form works, the cart takes the order. Nobody thinks about the PHP version underneath it, the plugin that needed an update on Tuesday, or the strange file that showed up in a folder overnight. They shouldn’t have to. That’s what the back office is for.
The trouble with invisible work is that it’s easy to undervalue until the day it matters. So this blog is where we make some of it visible. We call it Notes from the Back Office: real problems from real sites, written so no client is identified, with what we learned and what you can check on your own site.
What a back-office day looks like
Three examples from recent work.
The vulnerability that hit everyone at once. On October 21, 2026, PHP released emergency fixes for a flaw that let attackers take over a server with a single request, no login needed. By that afternoon, every site we manage had been checked, and every one that could be patched was. Most of our clients learned about it from our email telling them they were already covered.
The malware that kept coming back. Our own scan found infected files on a site. We cleaned them, and a few days later they were back. The source was hiding in the database, where the site’s file-only security plugin never looked. A second scanner that checks the database found it, and once we removed it there, the site stayed clean.
The legal demand letter. A client received a letter claiming the tracking scripts on their website broke privacy law. We inventoried every third-party script on the site, removed what didn’t need to be there, verified it was gone, and documented all of it for their attorney. The claim didn’t hold up.
None of these made anyone’s day more exciting. That’s the point.
How to tell if your back office is working
Whether you work with us or anyone else, these are worth asking whoever looks after your site:
- What PHP version is my site on, and when does it stop getting security fixes?
- When was the site last updated, and what changed?
- Where are my backups, how far back do they go, and has anyone tested restoring one?
- Who has admin access to my site right now?
- If my site were hacked tonight, who would notice, and how fast?
- Do I have my own logins for my domain, my hosting and my site?
If the answers come back quickly and clearly, you’re in good hands. If they come back as “I’ll get back to you,” that tells you something too.
What’s next
Each post in this series is one of those days. Next up: what keeping a 911 platform running taught me about keeping websites running.
If you’d like straight answers to the questions above for your own site, get in touch with Kinetic Thoughts.