Is my website running an out-of-date version?
Worth sorting promptly
Almost every website is built on a platform somebody else maintains — WordPress, Drupal, Joomla, Shopify and so on — and almost every one of them prints its version number on the page without anybody meaning it to. That number is the single most useful thing anyone can learn about your site, including you.
Why the version matters more than the platform
Platforms get security problems found in them constantly. That isn't a scandal — it's what maintenance looks like on software running a third of the web. The problem is found, it's fixed, and the fix ships as an update.
The moment that fix ships, the problem becomes public. Anyone can read what it was and which versions it affects, and anyone can write a program that visits sites, reads their version number off the page, and makes a list of the ones that haven't updated. That work takes an afternoon and then runs forever.
So the risk isn't really that your site is interesting to anybody. It's that being out of date puts you on a list that gets made automatically, whether or not anyone has ever heard of your business.
Out of date, and no longer supported: two different problems
Being a release or two behind is common and rarely urgent. It means newer versions exist and you haven't moved yet, and most of what you're missing was never announced as important.
Being on a version line that has stopped receiving fixes is different, and it's the one worth putting a date in the diary for. Platforms support their older release lines for a while and then stop. After that, problems found in your version simply don't get fixed for you — so the gap widens on its own, without anything changing at your end.
The third case is the one that reads worst and is often easiest to fix: your platform's own maintainers have marked the exact release you're on as having security issues that were fixed later. WordPress publishes this for every version it has ever shipped, which is why Gus can be specific about WordPress in a way he can't about every platform.
What Gus can and can't tell you here
He reads the version your site publishes and compares it against a list of released versions and published security advisories. He'll tell you the date that list was last refreshed, because a list pretending to be live would be worse than no list.
He never tests whether a weakness is actually exploitable on your site — that would mean attacking it. So “this version has known problems” means exactly that: problems are on record against this version. It isn't a claim that anything has happened to you.
And where your site publishes no version at all, he says so rather than assuming you're fine. Not knowing and being safe are different answers.
How to check this yourself
- Log in to your site's dashboard and look for an updates or version screen — WordPress has Dashboard → Updates, and it states plainly whether core, plugins and themes are current.
- Without logging in: open your home page, right-click and choose “View page source”, then use Ctrl-F (Cmd-F on a Mac) to search the text for the word “generator”. Many sites print their platform and version on that line.
- Search for your platform's name plus “supported versions” — most publish a table of which release lines still get security fixes and when each one ends.
- Or run a free check-up and Gus will tell you the version he can see, whether it's the newest, and whether its release line is still supported.
What to ask your web person
Copy this. It's phrased so you don't have to know the jargon to ask for the right thing.
Could you tell me which version of our website platform we're running, whether that version line is still receiving security updates, and when we last applied one? If we're behind, I'd like to know what updating involves and whether it can be made automatic from here.
Want to know if this applies to your site?
Gus checks this and everything else in the free check-up, then explains what he found in plain English. It's free, there's no account, and it takes about a minute.