Key takeaways
- A site is kept current when WordPress, the theme and the plugins are up to date, and nothing abandoned is left installed.
- Most of the security problems in WordPress sites come from plugins and themes, not from WordPress itself.
- Keeping current also means building in a way that can follow the web as it changes, including, one day, beyond WordPress.
The fourth rule is the least exciting and, over the life of a site, perhaps the most important. A website is not finished at launch. The day it goes live, the software underneath it starts to age, and if nobody looks after it, it decays.
What kept current means
My test is short:
- WordPress itself is up to date.
- The theme and the plugins are up to date, and they are maintained by someone who still releases updates.
- Nothing abandoned is left installed. No plugin whose developer has moved on, no theme kept “just in case”, no leftover from a feature the site no longer uses.
That is all. It is simple to state and easy to neglect, because nothing visibly breaks the day an update is skipped.
Why it matters
The risk is concentrated where most people do not look. Patchstack, a company that tracks WordPress security, reported 11,334 new vulnerabilities in the WordPress ecosystem in 2025. Of those, 91% were in plugins and 9% in themes, and only six were reported in WordPress itself. Keeping WordPress updated is necessary, but it is the plugins and themes that need the most attention.
The articles in this section
Free vs Premium WordPress Plugins: When It’s Worth Paying explains what the paid versions of my themes and plugins add, and how to decide whether you need them.
Built for WordPress Today, Ready for Any CMS Tomorrow is about building in a way that can outlast any one platform, including WordPress.
Abandoned Plugins: The Quiet WordPress Plugin Security Risk describes how to recognise a plugin that is no longer looked after, and what to do about it.