Is my WordPress site out of date or at risk?
Worth knowing
WordPress itself is not the problem — it's well maintained and updates itself by default. Nearly all WordPress break-ins come in through a plugin or theme that hasn't been updated in a year or more. If nobody is named as responsible for updates on your site, that's the risk, not WordPress.
How Gus can tell, and what he won't do
Websites openly advertise what they're built with — a WordPress site typically says so in the page's source, in the address of its stylesheets, and sometimes in a “generator” tag. Gus reads what's advertised and nothing more.
That includes version numbers where a site publishes them, which most do without meaning to: the generator tag usually carries the WordPress version, and plugin and theme files are often served with their version in the address. Reading a number printed on the page is not probing for it, and Gus reports what he finds on separate pages — whether your platform is current, and whether your add-ons are.
What he will not do is ask your site for anything it didn't volunteer: no admin pages, no guessing at file paths, and no testing whether a known weakness is actually present. That kind of active testing is only ever appropriate against a site whose owner has proved they own it, and in the UK it's a legal line under the Computer Misuse Act 1990 rather than a matter of taste.
So being built on WordPress is a neutral fact worth knowing, not a finding against you. What's worth acting on is which version of it you're on.
Where the actual risk sits
The order of risk, roughly: abandoned plugins first, then out-of-date themes, then WordPress core, then hosting. A plugin whose author stopped updating it three years ago is the classic route in — the weakness becomes public, automated scanners find every site running it, and nobody is coming to fix it.
Number of plugins matters more than most owners expect. Every plugin is somebody else's code running on your site with full access. Twenty plugins is twenty maintenance commitments you've made without noticing.
Admin accounts are the other quiet one. The developer who built the site in 2019, the agency you left, the “admin” account with a password from a leaked list — all still live unless someone removed them.
Signs a WordPress site may already be compromised
Pages you didn't create appearing in Google results for your domain, often in another language or about pharmaceuticals, gambling or counterfeit goods. This is the most common symptom and the one owners find last, because the pages are frequently hidden from ordinary visitors and shown only to search engines.
Unexpected redirects that only happen on a phone, or only for visitors arriving from Google. Sudden slowness. New admin users. Your host emailing about outbound spam.
If you suspect an actual compromise, that's a job for a specialist clean-up rather than a checklist — and worth doing properly, because a partly-cleaned site usually gets reinfected within days.
How to check this yourself
- Log in to WordPress and look at Dashboard → Updates. It tells you plainly whether core, plugins and themes are current.
- Go to Plugins and sort by name. For each one, check the “last updated” date on its page in the WordPress plugin directory — anything untouched for over a year deserves a decision.
- Go to Users. Remove anyone who no longer works on the site, and make sure every remaining administrator is a real person you can name.
- Search Google for site:yourbusiness.co.uk and read the results. Anything there you don't recognise is worth investigating immediately.
What to ask your web person
Copy this. It's phrased so you don't have to know the jargon to ask for the right thing.
Could you confirm who is responsible for keeping WordPress, our plugins and our theme updated, and how often that happens? I'd also like a list of plugins that haven't had an update from their author in over a year, and a review of who still has an administrator account.
Want to know if this applies to your site?
Gus checks this and everything else in the free check-up, then explains what he found in plain English. It's free, there's no account, and it takes about a minute.