Your WordPress site keeps asking for updates. Here is what that actually means.
By Ramzy Brown ·
If you have a WordPress site, you’ve seen the little red number in the admin bar. Plugins need updating. The theme needs updating. PHP is out of date. You click “update all”, something breaks, and you swear never to touch it again.
That’s normal. It’s also the main reason small business WordPress sites get into trouble.
WordPress itself is fine. The add-ons are the problem.
WordPress core is maintained by a big team and gets security fixes quickly. The trouble is everything bolted onto it. A typical small business site runs a page builder, a contact form plugin, an SEO plugin, a caching plugin, a security plugin, a slider, a cookie banner and a few others somebody installed years ago.
Each of those is written by a different developer. Each one gets bugs fixed on its own schedule. Some get abandoned. Security researchers who track WordPress problems consistently find that the vast majority of new vulnerabilities are in plugins and themes, not WordPress itself.
So the risk isn’t “WordPress”. It’s a WordPress site that nobody is looking after.
What happens when updates get skipped
Most of the time, nothing visible. Then one day:
- Google shows “This site may be hacked” under your listing
- Your host suspends the account for sending spam
- Visitors get redirected to a dodgy pharmacy or casino site
- Pages you never wrote appear in Google, usually in Japanese
Cleaning that up costs far more than keeping on top of it would have. And Google can take a while to trust the site again.
Your three options
1. Keep WordPress and actually maintain it. Updates every week, backups you’ve tested, and someone who knows what to do when an update breaks the layout. This is the right answer if you genuinely need WordPress: lots of people editing, a big shop, membership features.
2. Strip it back. Delete every plugin you don’t need, ditch the page builder if you can. Fewer plugins means fewer things to go wrong.
3. Move off it. For a brochure site (a few pages about what you do, a contact form, maybe a blog), WordPress is often more machinery than you need. A static site has no admin login, no database and no plugins on the live server. There’s simply less to attack and nothing to update.
Is moving painful?
It shouldn’t be. Done properly:
- Your pages, posts and images come across
- Every old web address stays the same or redirects to its new home, so you keep your Google rankings
- Your contact form still lands in your inbox
- The site gets faster, because pages are built once instead of on every visit
The bit people worry about is editing. If you like logging in and changing things yourself, that can still be set up. Most small business owners we speak to would rather send a message and have it done.
A quick self-check
Log into your WordPress dashboard and look at:
- How many plugins are installed? More than 15 on a simple site is a warning sign.
- When was each last updated by its developer? Anything not updated in over a year is a risk.
- What PHP version is your host running? Your host’s control panel will tell you. Old versions stop getting security fixes.
- Do you have a backup you’ve actually restored? If not, you don’t really have a backup.
If that list made you wince, we can take a look and tell you straight whether to keep it, tidy it or move it.
