The entire website is written in PHP. I have nothing against the language, but it's a major red flag when you would expect it to be using Java instead like most bank and government websites do.
I know this is a troll comment, but, a website being written in Java screams "this was subcontracted to junior devs" to me, which is not precisely a green flag.
The language you use matters very little. It's how you use it. PHP's not at fault here, even if they used Java or another language their incompetence would still be the issue.
I dont know that a website running Java gives me warm and fuzzy feelings only because its on Java. I care mire that whatever the underlying website is powered by is not easily exploitable by bad actors.