If you look after your own WordPress website, you’ll know the feeling. You log in, and there’s a little red number telling you that 7 updates are waiting. You make a mental note to deal with them later. Next time you look, it’s 12.
One of my clients described her old routine perfectly. When she finally got round to them, she’d click “update all”, cross her fingers and pray she didn’t break anything.
So what actually happens if you just leave them? Here’s the honest answer, without the scare tactics.
Why there are so many updates
Your website isn’t one piece of software. It’s WordPress itself, plus a theme, plus a collection of plugins, each made by a different developer and each updated on its own schedule.
Those updates tend to do one of three things:
- Fix security holes that have been discovered
- Fix bugs, or keep things working with newer versions of other software
- Add or improve features
The first one is the one that matters most. And it’s the one you can’t tell apart from the others just by looking at that little red number.
What happens when updates are ignored
Nothing happens overnight. That’s the trouble. Your website carries on looking perfectly normal, right up until it doesn’t. Here’s what builds up in the background.
1. Security holes stay open
When a security problem is fixed in a plugin, the details usually become public. That’s good for everyone who updates. But it also tells hackers exactly what to look for on websites that haven’t.
And they don’t pick on websites personally. Automated bots scan the internet around the clock, looking for known weak spots. A small business website is just as likely to be found as a big one. Most WordPress security problems come in through out-of-date plugins, not through WordPress itself.
2. Things start to quietly break
Your hosting company updates its servers over time, including the version of PHP, the programming language WordPress runs on. Other plugins move on too. An old plugin that hasn’t kept up can suddenly stop working, or bring the whole site down with it.
This is often how people meet the “There has been a critical error on this website” message for the first time.
3. Catching up gets harder
One update at a time is usually straightforward. Twenty-five updates in one go, some of them months behind, is a different story. If something breaks, it’s much harder to tell which update caused it. Some plugins may even have been abandoned by their developers in the meantime, and need replacing altogether.
4. Fixing it costs more
Put all of that together, and the cost of ignoring updates doesn’t disappear. It just gets saved up for later, usually for the most inconvenient moment. Tidying up a hacked or broken website takes far longer, and costs far more, than keeping it up to date in the first place.
“Can’t I just switch on automatic updates?”
You can, and for some websites it’s better than nothing. But automatic updates have one big blind spot: nobody checks what happens afterwards.
If an update breaks your contact form at 3am, WordPress won’t tell you. You’ll find out when a customer mentions they never heard back, or when you notice the enquiries have gone suspiciously quiet.
Updates aren’t really the hard part. Checking that everything still works afterwards, and knowing what to do when it doesn’t, is where the real work is.
The good news
None of this needs to be your problem. Keeping on top of updates is exactly the sort of job you can hand over and forget about.
On my Site Care Plan, I apply security updates within 24 hours, and everything else within a few days. I check your site afterwards, and if an update ever causes a problem, I fix it at no extra cost. You get a monthly report showing what was updated, so you’re never left wondering. (If you’re curious, I’ve written about what I actually do on your website each month.)
So next time that little red number appears, you can simply ignore it. Because someone else won’t.