Your accounting firm's website is working. Your clients can access it. Your contact forms are functioning. Everything looks fine.
But who's making sure the technology underneath it is actually secure?
When critical PHP security vulnerabilities triggered emergency updates across the internet in October 2026, CountingWorks CEO Lee Reams woke up to an urgent Slack message from his DevOps team. They were already investigating the threat, reviewing infrastructure, and coordinating security updates.
That experience raised an important question.
How many independent tax and accounting firms actually know who's responsible for maintaining and protecting their websites?
In this episode of The Growth Minded Accountant, Lee explores the hidden infrastructure behind modern websites, why an updated WordPress installation doesn't necessarily mean your server is secure, and how outdated technology can create unnecessary risks for your practice.
He also examines a growing challenge facing the profession: protecting sensitive client information as artificial intelligence becomes more deeply integrated into everyday workflows.
From website hosting and security patches to AI data minimization and vendor accountability, this episode is about something every accounting professional understands: Client trust.
And why protecting it requires more than simply assuming somebody else is handling the technology.
The future of tax and accounting is increasingly digital.
Websites are becoming more interactive. Client relationships are supported by connected applications. AI is helping smaller teams deliver more sophisticated services.
These advances create opportunities for independent firms to compete in ways that weren't previously possible.
But they also make responsible technology management more important.
Technology should help firms win better clients, deliver more value, and build stronger relationships.
It shouldn't introduce avoidable risks simply because nobody knows who's responsible.
Whether you're reviewing your website hosting, choosing a practice management platform, or adopting AI, ask the same fundamental questions.
Who maintains it?
Who protects it?
Who responds when something goes wrong?
You don't need to become the expert.
You need to make sure someone is accountable.
Because growth depends on trust, and that trust is worth protecting.
Your accounting firm depends on technology for more than marketing.
Your website represents your firm. Your client portal supports important relationships. Your practice systems manage sensitive information. And increasingly, AI helps you work more efficiently and identify new opportunities.
All of those capabilities depend on trust.
CountingWorks PRO brings together your website, client experience, practice intelligence, and AI-powered workflows in a connected platform designed around the needs of tax and accounting professionals.
Explore how CountingWorks PRO approaches security, client experience, and responsible AI.
One of the most common misconceptions about website security is that everything must be fine as long as the site is functioning normally.
But website performance and website security are different things.
Your homepage may load quickly. Your contact forms may work. Your clients may be able to log in without difficulty.
None of those things guarantees that the underlying technology is current or properly protected.
In October 2026, critical vulnerabilities affecting PHP highlighted this distinction.
PHP is a programming language used by many websites and applications, including WordPress. When vulnerabilities are discovered in the underlying software, developers and hosting providers may need to apply security updates even when the website appears to be operating normally.
Importantly, discovering a vulnerability does not mean a website has been compromised.
It means a weakness has been identified that could potentially be exploited under certain conditions.
The lesson for accounting firms is straightforward.
Don't use a functioning website as your only measure of website security.
Make sure someone is actively monitoring and maintaining the technology supporting it.
Many independent accounting firms rely on WordPress websites developed by freelancers, marketing agencies, or outside website providers.
There's nothing inherently wrong with that arrangement.
WordPress can be a legitimate, well-maintained platform.
The challenge is understanding the different layers of technology involved.
A website may include its content management system, plugins, themes, databases, hosting infrastructure, and underlying programming languages such as PHP.
Those components don't necessarily update together.
For example, an accounting firm might log into WordPress and see that every plugin is current.
But the server could still be running an outdated or unsupported version of PHP.
Updating a plugin doesn't automatically resolve a vulnerability in the server's underlying software.
This distinction matters because website maintenance responsibilities are often divided among multiple providers.
The agency that designed the website may not manage the server. The hosting company may provide infrastructure without maintaining every component of the application.
And the accounting firm owner may assume both providers are handling security.
The problem isn't necessarily the technology. It's not knowing who's responsible for maintaining it.
Your firm's website is more than a digital brochure.
It's part of a trusted relationship between you and your clients.
Prospective clients use it to evaluate your services. Existing clients may use it to schedule appointments, access portals, complete intake forms, or communicate with your team.
And your clients trust your firm with highly sensitive information.
Financial records. Tax returns. Personal identifying information. Details about their families and businesses.
A compromised public-facing website doesn't automatically mean an attacker has accessed your accounting software or client records.
But it can create other serious risks.
Attackers could potentially redirect visitors, present fraudulent login pages, impersonate your business, or trick clients into providing information they believe they're sharing with your firm.
That's why website security shouldn't be viewed exclusively as an IT issue.
It's also a client experience, business continuity, and reputation issue.
Your clients trust your name. Protecting the technology associated with that name is part of protecting the relationship.
You don't need to become a cybersecurity professional to take website security seriously.
But you should be able to get straightforward answers from whoever manages your website.
Lee recommends asking three questions.
Question 1: Is our website running on supported, up-to-date technology?
If your website uses PHP, ask whether the applicable October 2026 security updates have been installed.
Don't stop at confirming that WordPress is current.
Ask whether the underlying server software and hosting environment have been reviewed.
Question 2: Who monitors our website for security issues, and how quickly do you respond?
Serious vulnerabilities don't arrive on a convenient maintenance schedule.
They may be announced overnight, during tax season, or over a weekend.
Your provider should have a defined process for identifying critical security issues and responding appropriately.
There's a difference between someone who fixes your website when it stops working and someone who proactively monitors and maintains it.
Question 3: Who is ultimately responsible for security, backups, and recovery?
If something goes wrong, who takes charge?
Are backups performed regularly?
Has anyone tested whether those backups can be restored?
Having a backup file doesn't guarantee that your business can recover quickly from an incident.
The objective isn't to demand a lengthy technical report.
It's to establish clear accountability.
And if your provider can't explain who's responsible, that may be a sign your firm needs to revisit its technology arrangements.
Website security was the starting point of this episode, but the underlying lesson extends to artificial intelligence.
Tax and accounting firms are increasingly using AI for document analysis, tax research, workflow automation, client communication, and advisory planning.
The opportunities are enormous.
But AI can also create new questions about how sensitive client information is accessed, shared, and protected.
Consider an employee who uploads a client's tax return into a general-purpose AI chatbot.
Or connects an AI application to the firm's email or cloud storage.
The tool may produce useful results.
But what information can it access? What information is transmitted to the provider? How is that information handled? And does the firm have appropriate authorization to use it in that way?
These are questions that should be answered before sensitive information is shared.
One important concept is data minimization.
AI should receive the information necessary to accomplish an authorized task, rather than automatically receiving every available piece of client information.
For example, a system identifying potential retirement planning opportunities may need income information and retirement contribution history.
It may not need the client's Social Security number, home address, or bank account details.
In the episode, Lee discusses how CountingWorks PRO approaches this challenge through a security layer that can tokenize or mask certain sensitive information in supported MAX workflows before information reaches external AI models.
The broader lesson applies regardless of which AI provider a firm chooses.
Understand what information your tools access, what protections exist, and where professional oversight is required.
Technology constantly changes.
New software versions are released. Vulnerabilities are discovered. Vendors introduce new capabilities. Employees adopt new applications.
And artificial intelligence is accelerating many of those changes.
A security review performed several years ago may no longer reflect how your firm actually operates.
That's why Lee also encourages accounting firms to revisit their Written Information Security Plan, or WISP.
Does it reflect your current technology providers?
Your employees and their access?
Your website, client portal, and cloud applications?
Your use of AI?
Your procedures for responding to incidents?
A plan that's never updated may describe a business that no longer exists.
The same principle applies to website security.
Don't wait for something to go wrong before finding out who's responsible.
Build the conversation into your ongoing relationship with your technology providers.
The ultimate takeaway: You don't need to understand every piece of technology your firm uses. But you do need to know who's accountable for protecting it.
We know that everyone digests information differently. That’s why we’re now sharing the full transcript of each episode of The Growth Minded Accountant right here on the CountingWorks PRO blog. Whether you’re short on time, like to scan and highlight, or simply prefer reading over listening, you can catch up on every conversation at your own pace.
Each week, we cover topics that matter most to tax and accounting professionals—from AI and automation to marketing strategies, firm growth, and client relationships. Scroll down to read the full episode, or subscribe to the podcast to listen on the go.
Q. How do I know if my accounting firm's website is secure?
Start by contacting your website hosting provider or website management company.
Ask whether your website is running supported software, whether relevant security updates have been applied, and who monitors the infrastructure for newly discovered vulnerabilities.
You should also confirm that appropriate backups, access controls, and recovery procedures are in place.
A working website does not, by itself, establish that the underlying technology is secure.
Q. What were the October 2026 PHP security vulnerabilities?
In October 2026, serious vulnerabilities affecting PHP prompted security updates and response efforts among developers, hosting companies, and other technology providers.
PHP is used by many websites and applications, including WordPress.
Depending on the affected configuration, vulnerabilities in underlying server software can introduce risks even when the website continues operating normally.
A vulnerability does not automatically mean a system has been hacked or that customer information has been exposed.
Website owners should ask their providers whether their environments were affected and whether applicable updates or mitigations have been completed.
Q. Is WordPress secure enough for a tax or accounting firm?
WordPress can be used securely when it is properly configured, maintained, and monitored.
The key considerations include supported software versions, timely security updates, secure hosting, appropriate access controls, and ongoing maintenance of plugins and themes.
Accounting firms should also confirm that the underlying server environment, including PHP where applicable, is being maintained.
The issue isn't simply which website platform you use.
It's whether the technology is being actively managed.
Q. Who is responsible for the security of an accounting firm's website?
Responsibility depends on the firm's agreements with its hosting provider, developer, marketing agency, or managed website service.
Different providers may maintain different parts of the technology.
For example, one vendor may handle server infrastructure while another manages WordPress, plugins, and application-level updates.
Firm owners should establish clear responsibilities rather than assuming that hosting automatically includes comprehensive security management.
Q. Can a compromised accounting firm website put client information at risk?
Yes. Depending on the nature of the compromise, attackers could potentially redirect visitors, create fraudulent login pages, impersonate the firm, or attempt to obtain sensitive information.
However, a compromised public website does not necessarily mean the firm's tax software, financial records, or separate client portal have also been compromised.
The consequences depend on how the systems are configured and connected.
Appropriate maintenance, monitoring, access controls, and incident response planning help reduce these risks.
Q. How often should an accounting firm review its website security?
Website security should be maintained continuously, with critical vulnerabilities evaluated and addressed according to their severity and the firm's actual exposure.
Firms should also conduct periodic reviews of their hosting arrangements, software support status, access permissions, backups, and recovery procedures.
Security planning should evolve as technology and business operations change.
An annual review alone is not a substitute for ongoing monitoring and timely response to newly identified threats.
Q. How can accounting firms protect client information when using AI?
Accounting firms should understand what information AI systems receive, what the tools can access, how external providers handle data, and whether the intended use is authorized under applicable privacy and professional requirements.
Important protections may include limiting access, minimizing personal information, masking or tokenizing sensitive identifiers, reviewing vendor agreements, and maintaining human oversight.
Avoid assuming that a provider's promise not to train models on customer data addresses every privacy or compliance obligation.
Q. What is data minimization in AI?
Data minimization means limiting the information shared with a technology system to what is needed for the authorized task.
For example, AI analyzing retirement planning opportunities may need financial details but not a client's Social Security number or personal contact information.
In supported MAX workflows, CountingWorks PRO uses a security layer designed to mask or tokenize certain sensitive information before it is sent to external AI models.
Data minimization is one layer of protection, not a replacement for other security and privacy safeguards.
Q. What is a Written Information Security Plan (WISP)?
A Written Information Security Plan documents how an organization protects sensitive information, assigns security responsibilities, manages risks, and responds to security incidents.
Tax and accounting firms should ensure their plans reflect their current operations, technology providers, employees, access practices, and use of AI tools.
Firms should review their plans regularly and update them when significant changes occur.
Listen to other podcast episodes or read other related blog articles with relevant information and insights.
