Earlier this year, our investigation into law firm email records revealed that 76.8% of firms cannot stop criminals impersonating their domain to clients. That research exposed a wider, troubling trend across the legal sector: firms spend heavily securing internal networks while leaving their public-facing infrastructure neglected in plain sight.
Now we are seeing the exact same blind spot on law firm websites. When a client wires completion funds, shares a confidential enquiry or checks that an email is real, they trust the firm’s site. Yet behind the polished partner portraits and contact forms, thousands of firms are running dead, end-of-life server software and announcing the exact version number to anyone who visits.
On 21 October, the PHP project issued an emergency warning over two critical vulnerabilities that let attackers execute code remotely on a server. PHP powers the vast majority of law firm websites, including WordPress and Drupal builds. The developers urged everyone to patch immediately. That raises an uncomfortable question for managing partners: do you have any idea what software runs your website, or whether the agency you paid years ago is still patching it?
We examined the stored public homepage data of 60,652 monitored law firms. Thousands of servers openly broadcast their software versions in public headers and page code. More than a third of those that reveal a PHP version are advertising a release branch that the PHP project has completely abandoned.
A public version banner is a smoke alarm, not proof of an active breach. Hosting providers sometimes backport quiet fixes, and server headers can be stale. Public data cannot prove whether an individual site is exploitable today. What it proves is how many law firms leave outdated, unsupported technology hiding in plain sight.
3,262 law firm websites are running on borrowed time
PHP is the engine behind most of the web. Every release branch gets a fixed lifespan before its creators pull the plug on official security updates. Unless a specialist host is actively backporting custom fixes behind the scenes, an end-of-life branch is a sitting target as new flaws are discovered. PHP publishes the exact cutoff dates in public.
Out of 8,860 homepages that broadcast their PHP version, 3,262 are still advertising PHP 5, PHP 7, PHP 8.0 or PHP 8.1. Every single one of those branches is officially dead. Worse still, 425 firms are still advertising PHP 5, a generation of software whose official security support ended nearly eight years ago.
More than three thousand law firm homepages are openly advertising software its own creators no longer patch.
An emergency alert drops. Hundreds of firms do not move.
Even firms on a modern software branch are only safe if somebody is actually at the wheel when an emergency hits. October’s critical PHP flaws opened the door to remote code execution, the worst-case scenario where an outsider can run commands on the web server. Official patches dropped immediately. Days later, hundreds of law firm sites were still broadcasting unpatched version numbers.
That is 5.5% of sites on supported branches still advertising a pre-patch version number after the warning went live, while 5,123 advertised the initial upstream fix or newer. Neither figure proves what is happening inside the server: a host may have quietly backported a fix without changing the version string, and a clean banner does not guarantee every plugin is secure.
The real risk is organisational blindness. Law firms routinely hand their website to an external marketing agency, pay the invoice, and assume someone is watching the server. When a critical advisory drops on a Wednesday afternoon, nobody inside the firm asks whether the front door was locked.
Drupal sites tell the exact same story
The problem is not confined to PHP. We identified 522 monitored law firms running on Drupal. Among the 378 that broadcast their major release in page metadata, 139 are still running Drupal 7, 8 or 9, all of which have passed community end of life.
In October, Drupal also disclosed a critical remote-code-execution flaw of its own. Whether a specific site can be compromised depends on its exact release, modules and custom code, and some firms pay specialist vendors for extended Drupal 7 support. Still, broadcasting a retired CMS version to every visitor and automated scanner on the internet is an avoidable gamble.
Hiding the version number does not fix the server
Most websites stay quiet about what runs under the hood. Silence is good hygiene, not proof of security. A site that hides its headers can still be running ten-year-old code, and a site displaying an old banner may sit behind a security service or vendor backports.
We also found 34,861 firms running WordPress. Of the 17,560 that broadcast a version number in their page metadata, 1,469 advertise a release older than WordPress 6.0, which first launched in 2022. WordPress backports security patches to eligible older branches, so an old version number does not automatically mean an unpatched site, but it is a glaring sign of a neglected build.
Modern JavaScript stacks are not immune either. Both Node.js and Next.js shipped critical security updates in October. Because those frameworks rarely broadcast exact patch levels in public headers, we cannot estimate from stored fingerprints how many law-firm sites missed them.
Hiding a version banner is not a security strategy. Someone still has to patch the server.
Four questions to send your web agency today
- What exact software and versions power our site right now? Demand a full list: PHP or server runtime, CMS core, third-party plugins and hosting stack.
- Who is on the hook when a critical alert drops? Pin down who monitors security advisories, whether updates are included in your retainer, and whether any end-of-life software relies on vendor-supported security backports.
- Were the October PHP and Drupal patches applied? Ask for the exact date they were assessed and deployed, or written confirmation of why your environment was not affected.
- When did you last test a full restore? Backups only matter if they work. Confirm that clean backups exist, cover both code and data, and have actually been restored in a test environment.
An outdated public header is not a verdict on a firm, but it is a flashing red light on the dashboard. Do not wait for a client or an attacker to spot it first.
How we measured this
- On 30 October 2026, we analysed the latest successful stored homepage for 60,652 monitored firm records, excluding records marked dead or suspected non-firms. The sample is not all law firms and may contain duplicate organisations or non-firms. Most homepages were collected in the preceding 30 days.
- PHP figures use the 8,860 homepages that disclosed a version in a stored response header. The 36.8% figure is not a percentage of all monitored firms. Support status is based on the PHP project’s published branch support on 30 October 2026.
- The October PHP comparison covers 5,424 observations collected on or after 22 October that disclosed a full version on PHP 8.2, 8.3, 8.4 or 8.5. We compared each banner with the initial upstream fix for its branch. We cannot confirm installed patches or provider backports.
- CMS figures use confirmed, current stored technology fingerprints, which can come from a homepage or another page. Version percentages include only fingerprints that disclosed an extractable generator version. PHP and CMS groups can overlap and must not be added together.
- Public headers and metadata may be missing, stale or misleading. We did not test websites for exploitation, inspect private systems, verify installed patches or determine whether a site has been compromised.
- No firm is named. Results are reported only in aggregate.
From unprotected email domains to abandoned web servers, the pattern is clear: the warning signs are public, anyone can read them in seconds, and too many firms assume somebody else is minding the store.