State of Cyber Hygiene in Ontario
An independent look at the public-facing side of small businesses across Ontario, starting in the southwest and working outward, checked for the things an audit would flag. No scanning, no business named, just what an attacker can already see from the outside, and the plain fixes that close most of the gap. With the PHP vulnerabilities announced in late October, it felt like the right time. 4,450 businesses mapped so far.
Why this, and why now
With the PHP vulnerabilities announced in late October, it felt like the right time, and close to a public service, to look at the public-facing side of Ontario's small businesses and check for the things I would flag in one of my audits: how their email is set up, whether the software behind the website is current, whether the padlock works, and what their domains give away.
I spend most of my time securing infrastructure, from courthouses to municipal water utilities, and there are always holes: something does not work the way it was designed, something failed, or something was overlooked, on the physical side and the digital side alike. I see it all the time: a temporary fix becomes permanent, and that becomes the vulnerability. Small businesses are no different.
We look after the physical side without thinking about it. A broken door, a lock that does not latch, a camera someone has covered: we see those and fix them the same day. We are not always looking at the same things on the digital side, and the threats there are just as real, with real damage behind them.
The biggest change in the last thirty years is that a criminal no longer has to drive to your business. They can reach it from the other side of the globe without getting out of their chair. We need to take the same steps on the digital side: at least put a lock on the front door, or at least make sure the windows are closed. At the very least, close the front door.
This is not name and shame. It is meant to draw attention to things we do not normally pay attention to.
The combined picture
London-Middlesex, Sarnia-Lambton, Chatham-Kent, Kitchener-Waterloo, Cambridge, Brantford-Brant, and Windsor-Essex, measured the same way, from the outside, in late October 2026.
The reports
London, Strathroy, Ilderton, Dorchester, Lucan, Parkhill, Glencoe, and the county. 65+ exposed to PHP2Shell, 81% impersonable by email.
Read the reportSarnia, Point Edward, Petrolia, Corunna, Forest, Grand Bend, Watford, and the county. 36+ exposed to PHP2Shell, 83% impersonable by email.
Read the reportChatham, Wallaceburg, Blenheim, Ridgetown, Tilbury, Dresden, and the municipality. 12+ exposed to PHP2Shell, 82% impersonable by email.
Read the reportKitchener, Waterloo, Elmira, St. Jacobs, New Hamburg, and the townships. 7+ exposed to PHP2Shell, 88% impersonable by email.
Read the reportCambridge, Galt, Preston, Hespeler, and Ayr. 5+ exposed to PHP2Shell, 90% impersonable by email.
Read the reportBrantford, Paris, St. George, Burford, and the County of Brant. 6+ exposed to PHP2Shell, 84% impersonable by email.
Read the reportWindsor, LaSalle, Tecumseh, Amherstburg, Kingsville, Leamington, and Essex County. 18+ exposed to PHP2Shell, 86% impersonable by email.
Read the reportDo this first
Every one of these is a setting in something the business already pays for, or a DNS record. None of them need new software, and most take an afternoon.
Publish an SPF record, turn on DKIM signing in your mail platform, and add a DMARC record set to quarantine or reject. These 3 DNS records are what let Gmail and Outlook drop a fake invoice before your customer sees it. 83% of the businesses surveyed have not done this.
Keep WordPress, its plugins, and PHP current, and turn off the version numbers in the page and the headers. PHP2Shell is being exploited right now, and a visible version is a shopping list for an attacker.
Redirect every visitor to the encrypted version of your site and add an HSTS header so browsers stay there. Check that the certificate is valid and set to renew on its own.
Turn on multi-factor authentication for the website admin, the email accounts, and the hosting panel. Remove old staff accounts. Put the login behind a different address if your platform allows it.
An old domain that still points nowhere can be re-registered by someone else, who then receives your email. Keep unused domains renewed with mail turned off, or let them go on purpose, not by accident.
Going further
Once the 5 are done, these are the next changes that move the needle, in rough order of effort to payoff.
How this was measured
Every business in these reports was found in a public directory, a chamber of commerce, a business improvement area, or a municipal listing, and kept only if it runs a website on a domain of its own. Chains, franchises, government, hospitals, and school boards were left out.
Each one was checked using public DNS records and a single visit to its home page, the same way any customer's browser works. Nothing was scanned, probed, or logged into, no form was filled, and nothing past the home page was touched. The PHP2Shell count reads the version a site volunteers in its headers and compares it to the patched releases. No business is named in any report.
The data was cross-checked against an independent re-scan before publication. The full method and limits are in each regional report.
Questions
Possibly, if you are in one of the 7 regions and have a website on your own domain. No business is named publicly. If you want your own results and the fixes for your platform, email media@hans.study or book a scoping call.
No. Everything here comes from the public-facing side: public DNS records and one ordinary visit to each home page. No scanning, no probing, no logins. It is the same information an attacker, or a customer, can already see.
PHP2Shell lets an attacker take over a web server with no password, on the most common setup, and it is already being exploited. It was patched on October 21, 2026. If your site runs PHP, the fix is to update to a patched version, which most good hosts have already done. The reports show how many local sites are still advertising a version that is behind.
Start with the 5 steps above. If you are not sure where your DNS or your hosting is, your web developer or host can tell you, and most of the changes take them minutes. If you would rather hand it off, that is what the consulting side is for.