A WordPress site can look perfectly fine on the outside while running software that was patched for a security hole months or years ago. Nothing breaks, nothing looks different, and so the updates keep getting put off. The trouble is that the people who break into websites are not looking at how your site looks. They are looking at what version it runs.

This guide explains why an out-of-date WordPress site is a real security risk, what an attack usually looks like for a small business or church, and how to check your own site this afternoon, even if you have never logged into the dashboard before.

Why old software is the easy target

WordPress itself, along with most popular plugins and themes, is maintained by people who fix security problems as soon as they find them. When a fix ships, the details of the problem usually become public too. That is good for everyone who updates, and bad for everyone who does not, because it hands attackers a list of exactly which versions to look for.

Most attacks are not personal. Automated tools crawl the web around the clock, checking thousands of sites for a known weak plugin or an old version of WordPress. A bakery, a credit union and a youth ministry all look the same to them. If your site matches what the tool is looking for, it gets in, whether anyone has ever heard of your business or not.

That is why “nobody would bother hacking us” is not a safe assumption. Being small does not hide you. Being current does.

What a break-in actually looks like

Very few hacked sites get a dramatic message on the homepage. Most attackers want the site to keep running so they can use it quietly. Common results include:

• Spam pages. Hundreds of hidden pages selling pills or knockoff products, which can pull your real pages down in search results.
• Redirects. Visitors from Google or a phone get sent to a scam site, while you, logged in on your office computer, see nothing wrong.
• Stolen form data. Contact, prayer request, donation or application forms can be copied as people fill them in.
• Email abuse. Your server gets used to send spam, and your own emails to customers start landing in junk folders.
• Browser warnings. Google may mark the site as dangerous, which puts a red warning screen in front of every visitor until it is cleaned and reviewed.
• Backdoors. Hidden files that let the attacker come back after you think the problem is fixed.

Cleaning up after any of these takes far more time and money than keeping the site updated in the first place.

Check your versions in ten minutes

You do not need to be technical to find out where your site stands. Log in to your WordPress dashboard (usually yoursite.com/wp-admin) and work through this:

1. Open Dashboard, then Updates. This page lists any update waiting for WordPress itself, your plugins and your themes. A long list here is your first warning sign.
2. Look at Plugins. Each plugin shows its version, and many show a notice when a newer one exists. Note any that say an update is available.
3. Check when each plugin was last updated by its developer. Click “View details” on a plugin. If it has not been updated in a year or more, or has been removed from the WordPress plugin directory, treat it as abandoned. An abandoned plugin will never get a security fix, even if you update everything else.
4. Open Tools, then Site Health. WordPress flags problems here in plain language, including an outdated PHP version, inactive plugins and themes, and missing updates.
5. Find your PHP version. Site Health shows it under the Info tab, in the Server section. PHP is the language your site runs on, and older versions stop receiving security fixes. If Site Health says your PHP version is outdated, ask your host how to move to a supported one.

If you cannot log in at all, or nobody on your team knows who has the password, that is a finding too. It usually means nobody has been updating anything.

Look for signs someone is already in

An outdated site is a risk. A site that has already been compromised is a problem to fix right away. A few quick checks can tell you which one you have:

• Users you do not recognize. Go to Users and look for administrator accounts nobody on your team created.
• Strange search results. Search Google for site:yourdomain.com and scroll. Pages in another language or about products you do not sell are a red flag.
• Odd behavior on a phone. Visit your site from a phone that is not logged in, ideally by tapping a Google result. Redirects often only show up this way.
• Warnings from your host or Google. Check your hosting account for notices and look at Google Search Console, if you have it, under Security issues.

If any of these turn up something, stop updating and call whoever manages your hosting or a WordPress professional. Updating a hacked site does not remove what the attacker left behind.

Close the doors you forgot about

Updates are the biggest fix, but outdated sites usually have a few other loose ends that make an attack easier:

• Unused plugins and themes. Deactivated plugins can still be exploited because their files remain on the server. Delete anything you are not using, and keep only one spare default theme.
• Old accounts. Remove logins for former staff, past volunteers and the agency you worked with five years ago. Lower anyone who does not need full control to the Editor or Author role.
• Weak logins. Use long, unique passwords stored in a password manager, and turn on two-factor sign-in for every administrator.
• No recent backup. Make sure you have a backup stored somewhere other than the website’s own server, and that someone has tested restoring it.

Update in the right order

On a site that has gone a long time without care, clicking “Update all” can break things, especially when a theme or plugin is years behind. A safer order:

1. Back up first. Take a full backup of files and database, and confirm it finished.
2. Use a staging copy if you can. Many hosts offer one-click staging. Test updates there before touching the live site.
3. Update PHP, WordPress, then plugins and themes. Go a few at a time so you know which one caused a problem if something breaks.
4. Replace abandoned plugins. Find a maintained plugin that does the same job, or ask whether you still need that feature at all.
5. Click through the site. Test the homepage, menus, forms, giving or checkout pages, and the site on a phone.

If the theme itself is abandoned or the site is so far behind that updates keep breaking it, it may be time to rebuild on a current foundation rather than patch an old one.

Your next step

Put thirty minutes on your calendar this week, log in, and work through the checks above. Write down what you find: the number of waiting updates, any abandoned plugins, your PHP version and any accounts you do not recognize. That short list tells you whether you have an afternoon of cleanup or a bigger job.

Once the site is current, the goal is to keep it that way. Our guide to the value of website maintenance covers the routine side of ongoing care. And if you would rather not be the one watching for updates, Circles Co care plans handle updates, backups and monitoring for WordPress sites, so security stops being one more thing on your list.