Out-of-date WordPress sites will get hacked
This page uses annoyingly big text because it’s really important:
We see this happen to people all the time. The rest of this page has more information:
- Why would hackers target me?
- Don’t updates cause problems?
- But aren’t most hacking attacks more complicated than this?
- What if I don’t have time to constantly update my site?
- How to keep WordPress up to date
- Two other thoughts about WordPress security and updates
Why would hackers target me?
People are often surprised by this, asking: Why would they target me? Why would my small site be attacked by criminals when it contains nothing worth stealing? That question makes sense in the physical world, but things don’t work that way online. Hackers can use even a small site to send lots of spam, distribute malware, infect the site visitors with viruses, and worse. It doesn’t matter how big or small it is.
It’s easy for hackers to use Google to get a list of every site on the internet that run certain WordPress plugins and themes that may contain security bugs. They then use automated software to attack all of those sites, one by one, in the hope that the site is still using an old version. They don’t care if it takes weeks: they’re using stolen computer time anyway, and no human intervention is required to eventually try every last site.
Don’t updates cause problems?
If you think “I don’t trust updates, so I won’t update my site software for a while because I’m concerned about compatibility”, you’re setting yourself up for trouble unless you have a specific plan to apply the update in the very near future (by which we mean days, not weeks). Otherwise you’ll just get further and further behind, and updating will become harder and harder, then you’ll be even more likely to be hacked every day.
If you’re concerned about compatibility, you can make an extra backup right before the update, and we’ll help you undo the update if there’s a problem. The type of problems potentially caused by updating are far less severe (and far more easily fixed) than the security problems potentially caused by not updating.
But aren’t most hacking attacks more complicated than this?
No. A surprising number of our customers read elsewhere about WordPress hacks, then write to us asking if their site is vulnerable... but when we check, we see they haven’t updated old plugins and themes on their site for months or years. We also see people who install complicated security plugins but don’t update WordPress itself.
This suggests that it’s not obvious how sites usually get hacked, and we want to correct that. So here’s some more annoying text:
Not updating a plugin, or theme, or WordPress itself, is the same thing as not applying security updates to your own computer. When your computer tells you there’s an update available, you (hopefully) install it right way to keep “hackers” out. You should do exactly the same thing with WordPress.
So please: whenever you see that an update is available, install it. If you don’t login to your WordPress site often, start doing so on a regular basis just to check for updates.
What if I don’t have time to constantly update my site?
If you don’t have time, automate it. On our own sites, we use a plugin that automatically updates WordPress plugins and themes, in the same way that WordPress automatically updates its own files. We recommend it to all our customers.
How to keep WordPress up to date
As we mentioned above, on our own sites we use a plugin that automatically updates things.
If you prefer to do it manually, here’s the recommended way to update WordPress:
- Create an extra backup of your site before making any changes.
- Deactivate all plugins that you don’t truly need.
- Delete all inactive plugins.
- Delete all inactive themes. Be sure not to delete the child or parent theme of the active theme, if any.
- Update all remaining plugins and themes.
- Update the core WordPress files.
Two other thoughts about WordPress security and updates
By the way, if someone tries selling you a “premium” WordPress theme or plugin that doesn’t have automatic update notifications, you should avoid it. The only way to keep these secure is to return to the original download site from time to time to check for security updates, which few people ever do. Premium themes without automatic updates are a major security risk.
Finally, you should completely delete any plugins or themes you don’t use. Hackers can take advantage of some security bugs even if the plugin or theme is deactivated. If you’re not going to use it in the future, it shouldn’t be there at all.