Website software years out of date
Your website runs software that stopped receiving security updates years ago.
How to see it yourself, in a minute
- View the page source (right-click, View Page Source) and search for “generator”.
- A WordPress version starting with 4 or 5, or a Joomla or Drupal version from years ago, is this fault.
- If you can log in, the dashboard will show update warnings that have been ignored for a long time.
Or paste your address into the free audit, which checks this and seventeen other faults in ten seconds.
Why it matters
Old content-management software is the most common way small business sites get hacked, defaced or quietly turned into spam hosts. Once that happens Google marks the site as dangerous and your email reputation goes with it.
Out-of-date content-management software is the most common way small business sites get hacked. The result is not usually a defaced homepage; it is hidden spam pages, malware served to your visitors, Google marking the site as dangerous, and your domain's email reputation destroyed. Cleaning up after that costs far more than updating before it.
How we fix it
We take a full backup, bring the software, theme and plugins up to date on a staging copy, fix whatever breaks, then switch over. If the site is too old to update safely, we say so and quote a rebuild.
- Take a full backup and copy the site to a staging server.
- Update the core software, theme and plugins there, and fix what breaks (something always does on a site this old).
- Remove the plugins that are abandoned or duplicated; old sites usually run twice as many as they need.
- Switch over, then put the site on a care plan so it never falls this far behind again. If the theme cannot be updated safely, we say so and quote a rebuild.
How long: A day, sometimes two.
Questions people ask about this
- It has been fine for years.
- It has been lucky for years. The holes in old versions are published, and automated scanners try every one of them against every site, every day.
- Will updating break the site?
- On a site this far behind, probably, which is why it is done on a copy first. Nothing changes on the live site until the copy works.
- Should we just rebuild?
- If the theme is abandoned or the plugins no longer exist, yes. We tell you which it is after looking, before you spend anything.
People usually find this page by searching
- “wordpress out of date security risk”
- “update old wordpress site safely”
- “website hacked outdated plugin”
Has your site got it?
Paste your address. This and seventeen other faults, checked in seconds.
Free, on screen in about ten seconds, no call. We fetch your homepage once, the way a visitor's browser does, and nothing else.
Or fix the lot at once
If the audit finds five or more, a rebuild is usually cheaper than five fixes. Prices are on the page.