Before the end of December 2026

Two changes land over the Christmas break. Sort them out before you close.

At the end of December 2026, Microsoft 365 stops accepting password-only sign-in for sending mail by default, and PHP 8.2 stops getting security fixes. Neither affects every business. If one affects yours, it's better found in November than on the first day back.

Book a 15-minute call Request a call back

Both: $790, fixed
Email sending fix: $490, fixed
PHP upgrade: $390, fixed
Where: Remote work Australia-wide; on-site device work in Canberra only

Email sending fix, $490

Some things send email through Microsoft 365 with just a username and password (called SMTP AUTH with Basic authentication): website contact forms, scanners and printers, and practice or accounting software. Microsoft's notice says that at the end of December 2026 this is turned off by default for existing Microsoft 365 accounts. An administrator can turn it back on for now, but Microsoft will set a final removal date later (explainer). If nothing of yours sends mail this way, you're not affected.

(01)
List what sends your mail

Everything that sends email as your business: website forms, scanners, printers, practice software and any other systems, and which of them use a password-only sign-in.
(02)
Move the website form

Your website form moved to a transactional email service, or to a supported Microsoft sign-in (OAuth), so it keeps sending after the change.
(03)
Your other devices and software

The fix for each one, set out in writing. Where it can be done remotely I do it; on-site changes to devices are in Canberra only.
(04)
SPF and DKIM

Your domain's SPF and DKIM records checked and aligned, so mail from the new route is accepted rather than marked as spam.
(05)
DMARC record published

A DMARC record for your domain, starting at p=none with daily reports sent to you, so you can see everything that sends email using your domain name.
(06)
Tested

Test messages sent from each changed sender and checked on arrival.
(07)
Advice on enforcement

Once the reports show all your real email passing, written advice on moving DMARC to quarantine and then reject, and what to check before each step.

What DMARC does, plainly: it stops other people sending email that looks like it's from your business, once DMARC is moved to enforcement (quarantine or reject). At p=none it only reports: fake email using your domain is still delivered (RFC 7489, section 6.3; Microsoft's DMARC set-up guide starts at p=none for this reason). It covers your own domain name, not lookalike domains. Moving to enforcement isn't included in the $490: it comes later, once the reports show all your real email passing. More on why this matters now: AI and website security.

PHP upgrade, $390

PHP is the language WordPress and many other websites run on. PHP's own schedule ends security fixes for PHP 8.2 on 31 December 2026; older versions have already stopped getting them. If your site runs on PHP 8.3 or newer, this isn't urgent for you.

Check. Which PHP version your site runs, and what your host offers.
Staging test. A copy of your site tested on PHP 8.4 first, so your live site isn't the test.
Fix or replace. Plugins or code that break on the new version fixed or replaced. If something needs more than that, you get a written quote before I do it.
Upgrade. Your live site moved to PHP 8.4 and checked page by page, forms included.

Hacked or long unpatched? See hacked WordPress clean-up and the hardening check.

Questions

How do I know if I'm affected?

Book a 15-minute call. Tell me what sends email for your business and who hosts your website, and I'll tell you whether either change touches you. If neither does, that's the whole conversation.

What do you need from me?

Admin access to Microsoft 365 or someone who has it, access to your domain's DNS, and access to your website hosting. For devices in your office, someone on site, or a visit if you're in Canberra.

Who does the work?

Me, Jarek Piotrowski. 0404 003 240 · jarek@layerops.tech

No GST charged. See all prices.

Check before the break, not on the first day back.

Both for $790, or $490 for email and $390 for PHP. Book a 15-minute call, or leave your number and I'll call you.

Book a 15-minute call

Or call 0404 003 240 jarek@layerops.tech. I reply within one business day.

Request a call back