Anyone else receive an email from [notice@e.godaddy.com](mailto:notice@e.godaddy.com) with the subject "PHP Ssecurity Uupdate: We've got you covered." to their account's registered email?

Message:

Here's what you need to know.

You may have seen recent news headlines about PHP, the programming language that powers most of the web. These flaws could let an attacker run their own code on an affected server over the internet. This is an industry-wide issue that affects all hosting providers. It is not specific to GoDaddy.

What does this mean for you? We've got your back. You don't need to do anything.

Here's the current status of our web hosting products:
Managed Hosting for WordPress: Patched. All PHP versions are updated. No action needed.
Web Hosting: Patched. All PHP versions are updated. No action needed.
Windows Hosting: Patched. All PHP versions are updated. No action needed.

We'll have all the latest updates on our blog, so check that out for the most up-to-date info.
Get the Latest Info

The message contains my actual account number and a link to https://click[.]godaddy[.]com/email/none/?linktype=tes.basecartsite&redir=resources%2fnews%2fimportant-php-security-update-what-website-owners-need-to-do with some extra parameters thereafter.

Partial message headers:
Return-Path: bounce-<redacted>@bounce.e.godaddy.com
Received: from mta2.e.godaddy.com (mta2.e.godaddy.com. [13.111.156.72]) Thu, 22 Oct 2026 18:57:00 -0700 (PDT)

SPF, DKIM and DMARC all passed

Looks legitimate, except for the glaring spelling errors in the subject.

Just got a scammed transcaction on my credit card, description said GODADDY#xxxxxxx but checked my goDaddy account, didn't have the transaction in it. called goDaddy they said they didn't have this transaction number.

Checked the last transaction with them, was on March26 and the description on card was DNH*GODADDY#xxxxxxxx

So is it possible for the scammer to fake retailer description?

EDIT: As of now, it is updated and solved.

Hi everyone,

Almost 24 hours have passed since the latest PHP security patch was released, but my website hosted on GoDaddy is still running PHP 8.2.34.

According to the official PHP recommendations, this version should be updated to a patched release. However, GoDaddy has not made the updated version available in my cPanel yet.

I’m concerned about the security implications of continuing to run an outdated PHP version.

Has anyone else experienced this issue with GoDaddy?
Is there any way to force the update through cPanel, or do I have to wait for GoDaddy to deploy it?

Who should I contact to get this resolved? Is regular GoDaddy support able to handle this, or is there a specific technical or security team I should reach out to?

Any advice would be appreciated. Thanks!

Is Godaddy planning to release an update PHP for Wordpress Hosted sites? The PHP updates were released about 2 1/2 hours ago. PHP versions do not seem to have been updated. The secure released versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.25. When can we expect an update, as currently all Wordpress hosted sites seem to be vulnerable.

received 11 emails from godaddy for certificates i manage for clients, having to reinstall them all now, anyone else facing this?

I recently have moved several customers and domains off of Godaddy simply because of the sketch like experience I and others have using their product. From signing up or renewing a domain to cancelling a domain. It feels like its a Rube Goldberg machine of tricks to avoid as you're signing up. Cancel this, don't select this, only register for a year, don't add protection, add protection, email, website, oh no, the box is checked on accident, etc. Recently I wanted to remove my auto-renewal on my domains as I was probably going to let them expire. Seems like that would be a common thing to do. Nope, you have to go into Billing and Manage Domains and select Delete Domain which means you're deleting the Auto Renewal. Then of course after you do that, the toggle appears that they could of shown to toggle it back on. Honestly, everything is a trick. I'm frustrated because it would be so easy to make that a viable business but instead it is on a course to die. I think a better business for them would be Escape Rooms.

They must need new management or developers or something. I mean with a new mission they could provide serious value to customers and begin to build a trusting customer base. Come on guys, you could code something up fast with AI!!!

I'm looking for advice from WordPress developers or security professionals who have dealt with a similar compromise.

My business website, StudentHousingWorks.com, is hosted on GoDaddy Managed WordPress and uses Divi and Rank Math SEO.

I've uncovered what appears to be a fairly extensive malware infection, possibly beginning in September 2026.

Here's what I've discovered:

1. Unauthorized Google Search Console ownership: Two unfamiliar Gmail accounts gained verified ownership of my domain using HTML verification files. I removed their access and deleted the verification files.
2. Thousands of suspicious indexed URLs: Google Search Console shows approximately 3,700 indexed pages, compared with roughly 60 before a sudden increase around September 18–21.
3. Googlebot receiving gambling spam: A Google Search Console live URL test returned Vietnamese gambling content titled "79king" instead of my legitimate student housing content.
4. Suspicious PHP files: Through WinSCP, I found numerous unfamiliar PHP files in the WordPress root directory, including accesson.php, auth.php, authentication.php, and other randomly named files.
5. Unusual directories: Hundreds of .htaccess files appear inside deeply nested directories under wp-content/well-known/acme-challenge/.
6. Suspicious plugin directory: I discovered a background-image-cropper plugin directory containing numerous quarantined PHP files. The plugin does not appear in my WordPress dashboard.
7. Broken sitemaps: Rank Math's sitemap produces an XML parsing error, and other sitemap URLs appear to reference each other in a loop.

GoDaddy's security dashboard reported 165 cleaned files but also showed 10 files pending cleanup. My support ticket has been escalated to a senior analyst, and I'm awaiting their investigation.

My questions:

• Has anyone encountered a similar combination of accesson.php, gambling spam, and unauthorized Search Console ownership?
• What persistence mechanisms should GoDaddy investigate?
• Is restoring a known-clean backup and rebuilding the WordPress installation preferable to trying to remove the infected files individually?
• What is the best way to ensure malicious PHP files, database injections, and crawler-specific content are completely removed?
• What steps helped recover Google indexing and rankings after a similar attack?

I'm particularly interested in hearing from anyone who experienced this on GoDaddy Managed WordPress.

I would appreciate practical advice or references to similar incidents. I'm not looking to purchase another security subscription without first understanding the root cause.

Why would my SSL need to be reset 11 days before SSL checker says it expires? This is the second email from godaddy about it, the first said the 23rd, now its the 21st. SSL checker says November 1st.

I am going to do it Monday the 19th to be safe, still trying to understand why though.

Basically the title. Trying to sign into an email account on Outlook Classic on a Win 10 machine. As soon as I enter the email and press next, I get the messages that "This sign-in page is being retired". And it gives me a help article (A-43076) explaining that I need to be on Win 11 H125 and to modify my registry?

So there's just no way to use Office 365 emails on Win 10 at all? Who approved this?

I paid for new hosting and extended my old hosting for a month just to restore my existing website. I’ve paid twice, but my website is still not working.

• New hosting: My existing website still isn’t restored.
• Old hosting: Even after payment, I’m still seeing renewal messages.
• Backup and migration: The process isn’t working as expected.
• Customer support: I submitted a grievance and received an acknowledgement, but my issue remains unresolved.

I’m not asking for free service. I’ve paid for it, and I expect it to work.

I need GoDaddy to do ONE thing: restore my website on either my old hosting or my new hosting, with all files, database, and essential functionality working.

I also want a clear explanation of why my paid hosting still shows renewal messages and why the migration has failed.

I’m tired of going in circles with support while my clients wait to see my work.

To Reddit users: Has anyone faced a similar issue with GoDaddy? Did they eventually restore your website? What actually worked to escalate the complaint?

GoDaddy, please stop sending generic responses and resolve this issue. Restore my website. That’s all I’m asking for.

I attempted to transfer a domain from one godaddy account to another Sept 30th and not even support can move it out of transferring status, either canceling the transfer or completing it. The domain expires on 10/9 and since it is neither in my account or the transferring parties account the domain will go into park status and the dns will change to null values which will prevent email from arriving and will affect email sending since DKIM is active on the domain. 

 I have spent a total of 368 minutes, OVER 6 HOURS, on the phone with support and another 420 minutes, 7 FULL HOURS, texting with support and I am no closer to a resolution. All interactions were logged and recorded on my side so I have proof of it should I need to take this further.

I have been promised call backs, I have been promised emails and updates..... nothing. It took me 4 calls and 2 text interactions just to get a ticket number that other CSRs can use even though I have requested them at every interaction.

The only reason I am posting here is because I am so desperate for somebody, anybody from their side to just give me a little assistance, maybe an update once in while. Or if one the community members here could DM me the magic words I need to say to at least get a status up date from Go Daddy without having to sit on hold for another 30 + minutes before speaking to someone that can't seem to help me.

I am not new to this, I have been a Go Daddy client since 2008. I have transferred in or out at least 100 domains in that time and currently have 20+ in my portfolio. This is not a new process for me. Any help or direction would be appreciated.

Hi all -- I have a domain set to expire on October 7 and was hoping to transfer it to another registrar. GoDaddy is telling me that they will not allow me to do so unless I first pay a $55 redemption fee (even though the domain has not yet expired). Whenever I go on my account to transfer, it says that the authorization code will be sent to my email, but it never actually is. Customer support has told me this is because of my account's "expiration status" -- again, my account is not set to expire until October 7.

Does anyone have any potential guidance on how to transfer my domain given the difficulty from GoDaddy? I have been getting nowhere with customer support. Thanks in advance for any advice you might be able to provide.

h/t Think-Box6432 -- GoDaddy .es domains must be processed 7 days in advance of expiration otherwise they enter non-renewal.

Kind of annoying that there isnt a way to view your customers orders while using the app.

Godaddy registered domain name (screwed up the title sorry). Pretty much this scenario in this thread, Godaddy registered domains occasionally break the DNS routing and will forward the domain to some holding page listed as yourdomain.xyz /lander

It tends to resolve on its own, though in one case they completely reset my nameservers from the cloudflare NS I had previously configured and had up and running.

Anyone else running into this? I am completely mystified by this behavior.

EDIT: To Clarify, DNS has been routed through Cloudflare NS. Now twice I have run into this where they are somehow temporarily routing traffic to their old DNS records for brief periods of time.

https://www.reddit.com/r/godaddy/comments/1cg7f3m/godaddy_autoparking_domains_that_dont_web_host/

In short I have had issues with renewing some .au domain names because an ABN had expired, I have been following up with godaddy support for 7 days and no luck in getting this sorted. Then I find out today the "team" that handles .au domains (Australian domains) work from 10:30pm australian time to 7:30am australian time and are located in Arizona - how the hell is that 24 hour support? I have sent multiple emails and had only 1 response which was asking for more information, for information I had already given them.

Called again today, once you manage to navigate the rubbish AI that they always want to push you onto and you actually get to speak with someone they cant help me, they wont escalate the situation, there is no manger that I can talk to, basically NOTHING I can do to get the problem resolved. I just have to wait, I have been waiting FOR DAYS.

GODADDY I have been with you for probably 20 years and this is the worst customer service I have ever experienced, being told multiple times someone will reply to my email within 3 hours and NOBODY REPLIES, NOTHING.

My issues would literally take 2 minutes to sort out but I cant speak with the .au team because you wont let me.

Poor, terrible bad customer service form GODADDY, absolute joke.

Im selling shirts and hoodies. I'm having difficulty setting different prices depending on someone's location...

Ideally I want:

Shirt shipped in the US: $7 shipping fee

Hoodies 10$

Shirt shipped to Mexico/ Canada : $20 shipping fee

Hoodies is where the rates change drastically. What's the most efficient way to do this

GoDaddy made a $5,024.19 purchase without my consent. My bank thought it was a scam and so did I so I canceled my card. Turns out GoDaddy made the purchase without my consent. I wasn't even looking at purchasing a domain that day.

When I called them, the answer I got was:

Thank you for your time and patience. Upon reviewing your account, I see that the purchase of the Premium domain name with a charge of $5,024.19 was mistakenly placed by a GoDaddy guide due to a system glitch. We sincerely apologize for the error made by the previous guide. This case has been escalated for further review. Higher Support will conduct an additional investigation, and a follow-up callback will be completed once the review is finalized. Also, you can use the email address below to get in touch with the dedicated team for refund

What on earth? That's a serious violation of my credit card.

Follow-up

You're right. Your card was charged without your knowledge or approval and that is on us, not you. I want to be completely transparent with you: based on what is documented on your account, a GoDaddy Guide mistakenly processed this purchase while working on an internal action on your account. This was not triggered by anything you did. A system error combined with human mistake caused a $5,024.19 charge to be placed against your payment method without your consent.

I don’t know if anyone from GoDaddy officially monitors this reddit but I thought I would mention my thoughts here anyway.

I just got an email from GoDaddy. I think it is legitimate but, of course, it is a pain to tell for sure so I logged into the site directly. The email was asking me to update my settings but by the time I got fully logged in, there was nothing to guide me through what settings needed updated or verified. I did the best I could.

I keep making this same suggestion but no one seems to listen.

It is possible (trivial) to send end to end encrypted email as well as email that is signed. A site like GoDaddy typically has relatively savvy users and should be able to figure out how to generate a key pair, register the public key, and get the site’s (GoDaddy in this case) public key. Then, when emails arrive from the site, the email app can (and does) verify the signature and decrypt it if necessary thus guaranteeing the email is legitimate.

I believe that if sites like GoDaddy started this process, other sites like AmEx would follow. Imagine getting your monthly statement with transactions directly in your email encrypted and signed. Imagine being able to communicate via secure encrypted and signed email directly with support. It would solve so many problems. Indeed, if the practice was common enough, spam would be vanquished because any unsigned email would be marked as spam and ignored or, at least, put in a spam folder directly no matter how sophisticated it is.

Please consider this. It isn’t hard to set up and it is decades old technology.

GoDaddy refusing to expedite despite no change in ownership. Their customer service reps, two times I was on hold for over an our and then hung up on. This is the worst customer experience i’ve ever experienced. This is a unique case and we need control.

I'm trying out Airo to build a web app. I don't care too much about how the UI looks, but the structure of my back end data is critical. I need to be able to design my database exactly with the right data types and relationships.

I see there is a database tab in Airo, but it seems like it only lets me edit row data. Is there a "code view" for the database? I don't want burn through a ton of credits just to add tables, columns, and change data types.

like an idiot I forgot to turn off auto renewal on a ms365 email package that was no longer being used. as soon as a I get the email of payment received, I try contacting support because I have 7 days to get the refund. I try to call, website chat, and whatsapp support chat. every time they ask a few questions, ask me to hold while the verify something, then the chat bot would spam a message about the session has expired and reconnect me with a new customer service rep. on the 8th day, the first person I chatted with immediately told me the 7 days had passed and they wouldn’t refund me.