Guide
Is your website out of date? Five checks for updates, plugins and backups
Old software and forgotten plugins are a common way sites get hacked or break. Five practical checks: list what runs, update on a routine, remove what you do not use, keep backups you have restored, and know who is responsible.
The short answer
A website that is not updated slowly becomes a risk: old software and plugins can have known security holes, and one day an update that was put off for a year breaks the site. Check five things. First, list everything that runs the site: the system, the theme, every plugin and the hosting. Second, check whether each part still gets updates from its maker. Third, remove plugins and accounts you do not use. Fourth, keep a backup and prove it works by restoring it somewhere safe. Fifth, write down who updates what, how often and who you call when it breaks. Small regular updates are safer than one big overdue one.
In this guide
Who this is for
Your website was built a while ago, perhaps by someone who has since moved on, and nobody has looked at it for months. It still works, so it is easy to leave alone. This guide is the short list that tells you whether it is quietly becoming a problem, and what a sensible routine looks like. It fits sites built on a content management system such as WordPress as well as sites with a custom backend.
You do not need technical knowledge for the first checks. Some fixes need whoever looks after the site.
The five checks
List what runs your site. Write down the system or framework the site is built on, its version, the theme, every plugin or extension, and where it is hosted. Your admin screen or your hosting panel usually shows most of this. A site you cannot list is a site nobody can keep up to date.
Check each part is still supported. For every item, find out whether its maker still publishes updates. A plugin that has not been updated for years, or software that has reached its end of life, will not receive security fixes any more. Mark these as “replace”, not “wait”.
Remove what you do not use. Every plugin, theme and user account is something that can be attacked. Delete plugins you switched off long ago, themes you do not use and accounts of people who left. Give each remaining person only the access they need, and switch on a second login step where the system offers one.
Keep a backup, and restore it once. A backup that has never been restored is a hope, not a backup. Check that backups run automatically, are stored away from the site itself, and cover files and database. Once, restore one into a test copy and look at the result. Our guide What website maintenance should include, and what to ask before you sign covers this from the contract side.
Write down who does what. Decide who applies updates, how often (a monthly routine works for most sites), how updates are tested before they reach the live site, and who is called when something breaks. Applying small updates regularly is safer and cheaper than catching up on years at once, when many things change together.
A twenty-minute self-check
- Log in to the admin area. Does it show pending updates, and how many?
- Count the plugins. Do you know why each one is there?
- Find the date of the last backup. Where is it stored?
- Ask whoever looks after the site when the last update was applied.
- Is there a name and a number to call if the site goes down?
When to get help
Ask someone experienced if:
- the system or plugins are several versions behind and you are afraid an update will break the site
- the site was built by someone you can no longer reach
- you see pages or links you did not create, or visitors report warnings
- you want updates, backups and checks handled for you on a monthly routine
We can take a first look at your site with you in a free 30-minute video call: book a call. How ongoing care works is explained on our Maintenance page.