Legacy Shield • Per site • Joomla 3 · Drupal 7 · Old PHP

Cover for a site that will never be patched again.

If your site runs Joomla 3, Drupal 7 or software that needs an old PHP version, nobody is going to publish a security fix for it — not the projects, and for Joomla 3 not even the paid extended-support programme, which closed in 17 February 2025. That is not a reason to panic, and it is not a reason to pretend either.

Legacy Shield is what we do about it in the meantime: monitoring, scanning, backups you can actually restore from, and cleanup included when something does get through. It buys you time to decide about the site on your own schedule, instead of at two in the morning.

Ask about Legacy Shield Free Legacy Site Check

What Shield does not do

We would rather be the host that says this out loud than the one that sells you a padlock graphic.

Shield reduces and contains your exposure. It does not remove it, and no amount of monitoring turns an end-of-life platform into a supported one. A site on Shield is a site being watched carefully — not a site that has been made safe.

The only thing that actually ends the risk is moving off the end-of-life software. Shield is cover while you plan that, and we would rather you eventually stop needing it.

What is included, per site

Blocking and scanning

ModSecurity rules tuned for the platform, plus a weekly malware scan. Scanning is one input, never the verdict — a scanner reporting nothing is not the same as nothing being there.

Backups you can restore from

Daily backups with 30-day retention, held off the docroot. On a site that cannot be patched, being able to go back a week is worth more than it is on a modern one.

Uptime and defacement monitoring

We watch for the site going down and for its content changing underneath you, so you are not relying on a customer emailing to say something looks wrong.

Cleanup included

If the site is compromised while it is on Shield, the cleanup is included — the same rebuild described on the Site Rescue page, not a quick scan-and-delete.

An hour of small fixes a quarter

For the things that accumulate on an old site: a broken form, a certificate warning, a plugin that started throwing errors. Real time, not a support-ticket allowance.

The PHP version it actually needs

Each site runs the PHP version it requires, isolated from every other site on the platform — which is what makes hosting these sites possible at all.

Required on legacy sites we host — and we would rather explain that than bury it

Shield is a condition of keeping an end-of-life site on our platform. That is not an upsell dressed as a policy; it is the basis on which we are willing to host these sites at all.

A compromised site is not only the owner’s problem. It sends spam, it gets the address blocked, and it sits next to other people’s sites. Plenty of hosts solve that by refusing end-of-life software outright, or by suspending the account when something goes wrong. We would rather keep hosting the site and be honest about what it costs to do that responsibly.

Shield’s cleanup is not the same thing as our WordPress guarantee

These get confused, so here is the difference in plain terms.

The 30-day guarantee — WordPress only, free

After a paid Site Rescue on a WordPress site, if it is re-infected within 30 days we rebuild it again at no charge. We can promise that because a WordPress rebuild is near-total. We do not offer it on Joomla or Drupal, ever, because those platforms cannot be made safe — Drupal’s own security team says “zero-days may occur”.

Shield’s cleanup — any CMS, part of the subscription

Shield includes cleanup on whatever the site runs, Joomla and Drupal included. It is a benefit you are paying for month to month, not a guarantee that the site will not be re-infected — and on end-of-life software nobody can honestly offer that.

Put simply: on Joomla and Drupal we will not promise it won’t happen again, so instead we make sure it is caught quickly and fixed without a new invoice.

The way out, whenever you are ready

Shield is deliberately not the end of the story. When the site is worth investing in again, the way off end-of-life software starts with a paid, fixed-price Upgrade Assessment: we inventory the extensions, the custom code, the theme work and the content, and give you a written scoped quote — and the fee comes off the project if you go ahead.

For Drupal 7, Backdrop CMS is usually the cheapest credible route: it is a fork of Drupal 7 built specifically as the fastest path off it, though its own documentation is clear that the upgrade “is not without its considerations”. Drupal 7 to 10 or 11, and Joomla 3 to 4 to 5, are re-platforming projects and are quoted as such. We have not delivered one of these upgrades before, and we will not pretend otherwise — the assessment exists so that you get a real number before anyone commits to anything.

Questions people actually ask

My site has been fine for years. Do I really need this?

Possibly not, and if the honest answer is “leave it alone” we will say so — the free Site Check exists partly to give that answer. What changed is not your site but its software: since Joomla 3’s extended support closed in 17 February 2025 and Drupal 7 reached end of life in 5 January 2025, newly discovered vulnerabilities simply never get fixed. The risk accumulates quietly rather than announcing itself.

Is Shield per site or per account?

Per site. A legacy site is the unit of risk, so it is the unit of cover — if you host three of them, each one is watched, backed up and covered separately.

Can I buy Shield without moving my hosting to you?

No. Shield depends on things we can only do on our own platform: the isolation, the PHP version, the blocking rules and the backups. Migration is included with a hosting plan.

What if I just want to upgrade instead?

Then Shield has done its job. Start with the Upgrade Assessment — it is a scoping exercise ending in a written quote, and the fee is credited against the project if you proceed.

Does Shield mean my site is secure?

No, and we will not say it does. It means the site is monitored, backed up, blocked at the edge where we can, and cleaned by us if something gets through. A site running software that no longer receives security updates is exposed for as long as it runs that software. Shield manages that; only an upgrade ends it.

Ask about Legacy Shield

Tell us what the site runs and we will tell you what cover it actually needs — including if the answer is that it needs less than you think.

If you are not sure what the site runs, the free Legacy Site Check answers that first, at no charge.