Outdated and Unsupported Software: CMS, Plugins, Server and Libraries
Most websites that get hacked aren’t hit by anything clever. They run a version of WordPress, a plugin or a server component with a publicly known flaw, and an automated scanner finds them. Once a fix is published, the details of the bug are effectively public too, and attacks usually follow within days.
Keeping software current is the cheapest security measure there is. This guide explains what we look at and how to act on it.
Two different problems
| Situation | What it means | How serious |
|---|---|---|
| Behind its release line | A newer patch of the same line exists (PHP 8.3.4 when 8.3.27 is out, a plugin a version back) | Missing fixes, often security fixes. Usually easy. |
| Unsupported (end of life) | The whole release line no longer gets security fixes (PHP 7.4, jQuery 1.x) | New flaws will never be fixed. Plan an upgrade. |
| Older, still supported | A supported line, but a newer one exists (jQuery 3 while 4 is out) | Fine for now. Plan the move before support ends. |
The first is maintenance; the second is a project. A minor WordPress or plugin update takes a click. Moving from PHP 7.4 to 8.x may need code changes, so it is worth scheduling rather than postponing.
What we check
We only use what the site reveals on its own: the generator tag, the Server and X-Powered-By
headers, and version numbers in the URLs of scripts and stylesheets. We never download the scripts
themselves.
- Release lines and support dates come from endoflife.date for PHP, nginx, Apache, WordPress, Drupal, Joomla, TYPO3 and jQuery.
- WordPress plugins are compared with the current version in the WordPress.org plugin directory. Premium plugins sold elsewhere aren’t listed there, so we can’t judge them.
| Check | Pass | Needs attention | Fails |
|---|---|---|---|
| Unsupported software | nothing past end of life | a release line is end of life | |
| Software updates available | everything on its latest release | a supported but older line | something is behind its line |
The Technologies list in Site Profile shows each affected item in red (or amber), with your version and the latest one.
How reliable is this?
Versions from headers and the generator tag are exact. Plugin versions are read from the ver=
parameter WordPress adds to file URLs; it is usually the plugin’s own version, but not always. We
ignore numbers that clearly aren’t versions (build stamps, WordPress’s own version) and take the
highest number per plugin, because plugins also ship libraries with their own, lower versions.
Treat a plugin result as a strong hint and confirm it in your dashboard.
If nothing shows a version, we can’t judge, and the checks don’t count toward the score. That is also a good outcome: see version disclosure.
How to fix it
WordPress. Go to Dashboard → Updates. Update plugins and themes first, then WordPress itself. Turn on automatic updates for plugins you trust (Plugins → Enable auto-updates). Delete plugins you no longer use; a deactivated plugin’s files are still on the server and can still be attacked.
PHP. Your host’s control panel usually has a PHP version selector (cPanel: “Select PHP Version” or “MultiPHP Manager”). Test on a staging copy first. If the site breaks on a supported version, that’s a sign of an abandoned theme or plugin that needs replacing anyway.
nginx or Apache. On a managed host this is the host’s job; ask them. On your own server, use the
distribution’s packages and enable automatic security updates (unattended-upgrades on
Debian/Ubuntu). Distributions often backport fixes without changing the version number, so an “old”
nginx from Ubuntu’s packages can be patched; check the distribution’s security notices.
jQuery and other libraries. If a theme bundles an old copy, update the theme. If you load it yourself, move to the current release and test the pages that use it. Our vulnerable libraries guide covers the known flaws.
Make it routine
- Put updates on a calendar: weekly for plugins and the CMS, and review the PHP version twice a year.
- Keep a backup you have actually restored, so updating never feels risky.
- Remove what you don’t use: every plugin is code you have to keep current.
A quick way to keep an eye on it: rescan your site after each round of updates and check that nothing in Site Profile is still red.