What the standard says
WordPress’s own documentation is direct: you should always update WordPress to the latest version, and back up the site before you start [1].
WordPress handles part of this for you. Since version 3.7, most sites apply minor and security releases automatically in the background [1]. Sites first installed on WordPress 5.6 or later receive major releases automatically as well; older sites keep their previous setting unless someone changes it [2].
Plugins and themes are where most of the work is. A plugin is an add-on that gives the site a feature, like a contact form or an online store. A theme controls how the site looks. Since WordPress 5.5, an administrator can turn on auto-updates for each plugin and theme, one at a time or in bulk [3]. They are off until someone turns them on [3]. Once on, WordPress checks twice a day and emails the site owner when an update succeeds or fails [3].
WordPress’s hardening guide adds three habits [4]:
Keep plugins updated, and delete any plugin you aren’t using [4].
Back up regularly, including the database [4].
Know who owns what. Web hosts are often responsible for the server, but not for the software you install on it [4].
The same idea applies beyond WordPress. The OWASP Top 10, a widely used list of web security risks, flags software that is “vulnerable, unsupported, or out of date” and says to remove unused components and watch for unmaintained ones [5]. That includes JavaScript libraries, code your site loads into each visitor’s browser. jQuery supports only its latest version; the 1.x and 2.x branches no longer get fixes [6]. Tools like Retire.js spot library versions with known vulnerabilities [7].
For small businesses in general, the FTC’s advice is short: update your software and set updates to happen automatically [8]. CISA urges every organization to treat vulnerabilities that are already being exploited as a top priority [9].
Hosted builders work differently. Squarespace pushes updates automatically and doesn’t use plugins [10]. Wix scans its platform for vulnerabilities and fixes what it finds [11]. There, your part is mostly strong logins and any custom code you’ve added.
What you’ll hear
“WordPress isn’t secure. You should move off it.”
There’s a fair point here: WordPress sites are common targets because there are so many. But the core software is rarely the problem. Wordfence, a WordPress security vendor, counted 5 core vulnerabilities out of 8,223 disclosed in 2024; 96% were in plugins [12]. A well-kept WordPress site with a short list of maintained plugins is a reasonable choice.
The opposite claim also comes up: “Turn on every auto-update and forget about it.” Auto-updates help, and the FTC recommends them [8]. But an update can occasionally break a page, and WordPress emails you when an auto-update fails [3], so someone needs to read those emails and have a backup ready [1].
What the numbers say
8,223 vulnerabilities published in WordPress software in 2024, about 68% more than 2023 [12]. Publisher: Wordfence, a WordPress security vendor, from its own database; report published April 2025; funded by Wordfence. Small-business fit: good, since it covers the plugins small sites use.
96% were in plugins; 5 were in WordPress core [12]. Same source.
About 35% of 2024’s vulnerabilities were still unpatched in 2025 [12]. Same source. Some fixes never come, which is why unmaintained plugins should go.
These count disclosed flaws, not break-ins. We couldn’t find a reliable public figure on how often outdated small-business sites are compromised.
What we’ve seen
We haven’t run into this yet.
Putting it together
Most website risk lives in the add-ons, not the platform. Keep WordPress, plugins and themes current, delete what you don’t use, and take a backup before each round of updates. Agree in writing who does this: you, your developer or your host.
What good looks like
WordPress core on the current release, with automatic minor and security updates left on.
A short plugin list: every plugin in use, still maintained and updated within the past few months.
Unused plugins and themes deleted, not just deactivated.
Auto-updates on for low-risk plugins; larger ones (store, forms, page builder) updated on a schedule.
A backup taken before every update, with a restore tested at least once.
A staging site (a private copy of your website for testing changes) for big updates, if your host offers one.
Update emails going to an inbox someone reads, and one named owner for updates.
Questions for your IT resource
Who is responsible for updating our website: us, our developer or our host?
Which plugins and themes do we actually use, and are any no longer maintained?
Are automatic updates on, and where do the update emails go?
When was our last backup, and have we ever restored from one?
Does our host offer a staging site we can test updates on?
Does our site load an old version of jQuery or another library, and can it be updated?
Related learning
Who holds the keys to your domain and website?
Your domain registrar, DNS provider and web host each have a login, and whoever holds those logins controls your website and where your email is delivered. Give each one its own strong password, turn on MFA, and know who has access.
How to read your Free Security Assessment
Your Free Security Assessment starts with what’s working well, then lists each item worth confirming with how sure we are and how soon it’s worth handling. This page explains each part so you can read it on your own.
How many admin accounts should your business have?
An admin account can change settings, reset passwords and read company data across Microsoft 365 or Google Workspace. Keep only a few, protect each one well, and use them only for admin work.
Sources
WordPress.org, Updating WordPress, WordPress Documentation, updated September 15, 2024. (checked 2026-10-08)
WordPress.org, Upgrading WordPress, Advanced Administration Handbook, updated July 1, 2026. (checked 2026-10-08)
WordPress.org, Plugin and themes auto-updates, WordPress Documentation, updated January 13, 2023. (checked 2026-10-08)
WordPress.org, Hardening WordPress, Advanced Administration Handbook, updated January 7, 2026. (checked 2026-10-08)
OWASP, A03:2025 Software Supply Chain Failures, OWASP Top 10:2025. (checked 2026-10-08)
jQuery, jQuery Support. (checked 2026-10-08)
Retire.js, Retire.js. (checked 2026-10-08)
Federal Trade Commission, Cybersecurity Basics, Cybersecurity for Small Business. (checked 2026-10-08)
CISA, Reducing the Significant Risk of Known Exploited Vulnerabilities. (checked 2026-10-08)
Squarespace, Moving from WordPress to Squarespace, Squarespace Help Center, updated November 21, 2025. (checked 2026-10-08)
Wix, Wix Security Measures Overview, Wix Help Center. (checked 2026-10-08)
Wordfence, 2024 Annual WordPress Vulnerability and Threat Report, April 8, 2025. (checked 2026-10-08)
How we rate these. Our judgment from real setups, applied the same way on every page. Cost: $ = no new spend or under $25/month · $$ = a modest monthly tool or a short project · $$$ = new hardware, licensing, or a larger project. Effort: Light = one sitting · Moderate = setup plus follow-up over days or weeks · Heavy = planning, testing and staff changes. Outlined marks show how far it can go for some businesses. N/A = doesn’t apply to this topic. Time to fix: how long the first useful step takes, then how long until it’s fully done. Ratings are typical averages, not quotes. Time to fix: the filled dot is when the first useful step lands, the hollow dot is when it’s fully done. Who can do it: highlighted chips are who can reasonably handle it.