Why CMS updates matter for security
Most hacked sites run an outdated CMS or plugin with a published exploit. Keep the core and plugins current.
Step by step, with screenshots: How to check your WordPress version, and what to do when it is out of date →
Check your own site
Runs this check and the other 192, free, in about 45 seconds.
Or run only this check with the free WordPress theme & plugin detector, the free Tech stack & CMS detector or the free Hacked site & SEO spam checker.
What it is
CMS updates are new releases of the software that runs your site, such as WordPress, Joomla or Drupal, and of its plugins, themes and extensions. Many releases fix security holes, and once a fix is published, the hole is public knowledge.
Bots scan the web around the clock for sites still running a vulnerable version, and security companies' yearly reports consistently list outdated software, especially plugins, among the top causes of hacked sites. getReport reads the version your page advertises in its generator tag and warns when it is behind the latest release. Your site is OK when core, plugins and themes are current and the version is not advertised.
What a passing site looks like
- CMS version: passeswarning · −3 ptseffort M
CMS version
Why it matters. Old CMS versions have published security holes that bots scan for automatically, and the generator tag advertises the exact version to them.
- Back up the site, then update the CMS from its admin dashboard; update plugins and themes at the same time.
- Remove the generator tag (WordPress: remove_action('wp_head', 'wp_generator') in functions.php).
Questions people ask
Why are WordPress updates important?
Because most updates fix bugs and security holes, and attackers read the same changelogs you do. Within days of a fix being published, bots scan for sites still on the old version. Updates also keep plugins compatible with current PHP versions. Keep a backup, test big updates on a staging copy, and install security releases promptly.
Should I turn on WordPress automatic updates?
Yes for minor and security releases of core, which WordPress has installed automatically by default since version 3.7. For plugins and themes, turn on auto-updates for well-maintained ones you rely on, especially security-critical plugins. For major core versions and complex plugins such as WooCommerce or page builders, many sites prefer to update manually after a backup and a quick test.
How many WordPress hacks come from outdated plugins?
Plugins are where almost all WordPress vulnerabilities are found: Patchstack's yearly reports attribute over 90 % of newly disclosed WordPress vulnerabilities to plugins, most of the rest to themes and only a handful to core. Many are exploited on sites that simply never updated. Removing plugins you do not use shrinks the risk as much as updating the rest.