Why does WordPress need updates?

Why a website needs updating at all

WordPress runs a huge share of the web, somewhere over 40% of all websites according to W3Techs. That popularity makes it a target. When a security flaw is found and fixed, the fix is public, which also tells attackers exactly what to look for on sites that have not updated yet.

Automated tools scan the internet around the clock looking for those out-of-date sites. Nobody is choosing your business in particular. An unpatched site is simply found and exploited, often within days of a flaw being announced.

The three things that need updating

Security firm Patchstack reports every year that the vast majority of newly discovered WordPress vulnerabilities, well over 90%, are found in plugins rather than in WordPress itself. Every plugin you install is another piece of software that needs looking after.

What happens if you do not update

• Hacked sites: spam pages, redirects to scam sites, or malware that gets your site flagged by Google.
• Broken features: contact forms, booking tools and payments quietly stop working as other software moves on.
• Harder updates later: a site left for two years can need significant work to bring up to date safely.

How to update without breaking things

• Take a full backup first, files and database, so you can undo anything.
• Update plugins one at a time on a busy site, rather than all at once.
• Test on a copy of the site first if the site takes bookings or payments.
• Delete plugins and themes you are not using. Deactivated is not the same as removed.
• Check the contact form, basket and key pages once you are done.

If keeping on top of this sounds like a job you do not want, that is a fair reason to consider a site with no plugin stack at all. We compare the two approaches in WordPress vs custom-coded websites.