If you do one thing for security, do this. Out-of-date software is how the overwhelming majority of sites are compromised, and it is entirely preventable.
How the attacks actually work
Nobody targets your site personally. A vulnerability is found in a widely used plugin and published. Within hours, automated tools are trying it against every site on the internet. They do not know or care what your site is; they check whether the vulnerable version is present.
The gap between a fix being released and attacks beginning is now measured in hours. An update applied a month later is a month spent exposed.
What to keep updated
- The core software – WordPress, CubeCart, whatever you run
- Every plugin, module and extension
- Your theme or skin
- The PHP version
Delete what you do not use
A deactivated plugin is still code on the server and can still be exploited. If you are not using it, remove it rather than switching it off.
Abandoned software
A plugin with no update for two or three years will never be fixed. Replace it while you have the choice, rather than after an incident.
Doing it safely
Updates occasionally break things, which is why people delay them. The answer is a backup and a staging site, not avoidance – see Updating WordPress, plugins and themes without breaking the site. Weigh a broken layout, which is fixable in an hour, against a compromised site, which is not.
