Checklist for any contractor who updates the PHP on your website

Hand this to whoever does the work, us or anyone else. It keeps the job safe, and it keeps you in control. Tick each line before you say yes.

BEFORE STARTING
[ ] You have the contractor's scope and price in writing, and you agreed to it.
[ ] The scope names the site address, the PHP version it runs now, and the version it should end on.
[ ] The scope lists the pages and functions that must still work afterwards (home page, login, any form or checkout page).
[ ] You know who your host is, and whether the host has to allow the change.
[ ] You named one person who can approve the work and answer questions the same day.

ACCESS THEY WILL NEED (THE LEAST THAT DOES THE JOB)
[ ] Only the access the job needs, for only the site named in the scope. Not every account you own.
[ ] Agreed in writing: which method (hosting panel, a temporary user, SSH if needed) and for how long.
[ ] Shared only the way the contractor asks, never through a public form, a chat group or a shared document.
[ ] A separate login for the contractor where the host allows it, so you can switch it off later.

A BACKUP COMES FIRST
[ ] A current backup of the site files and the database exists before anything changes.
[ ] You know where it is and you (or the host) can restore it. A backup nobody can restore is not a backup.
[ ] If the contractor cannot see a workable way back, they should say so and stop.

DURING THE WORK
[ ] The contractor tells you before changing anything that is outside the scope.
[ ] Anything extra gets a written price first. You can say no.
[ ] If the host blocks the change, the contractor says so plainly and does not pretend the site is safe.
[ ] You can reach the contractor if the site misbehaves while they work.

AFTER THE WORK, CONFIRM
[ ] The new PHP version is the one actually serving your site, and the old version is named in writing.
[ ] Your home page, your login, and every form or checkout page in the scope still work. Try them yourself.
[ ] You received a short written note: what was found, what changed, which checks ran.
[ ] You know how to go back to the old version, and who does it, if something listed breaks.
[ ] The contractor's access is removed and any password you shared is changed.

NEVER SHARE IN A PUBLIC CHAT OR EMAIL
[ ] Passwords, or a login together with its password in one message.
[ ] Full credentials for your host, your domain registrar or your payment account.
[ ] Private keys, API keys, tokens or a database password.
[ ] Customer lists, card numbers or other personal data.
[ ] If a contractor asks for any of these in an open chat or an email, stop and ask for a safer method.

SIGN-OFF
[ ] You tested the pages and functions in the scope.
[ ] You have the written note and a restorable backup.
[ ] Access is removed and shared passwords are changed.
[ ] You agree the job is finished, in writing, before the final payment on quoted work.

More info: dxdev.com/php2shell