A WordPress site nobody updates: risks and costs

A WordPress site that someone keeps up to date is a perfectly good website. The risk is the other kind: built five or eight years ago by a freelancer or an agency that has since moved on, still online, and untouched since. Nothing looks wrong from the front, but the plugins, the theme and the PHP version underneath keep aging, and published security holes in them do not close by themselves. If that describes your site, this article covers what can go wrong, how to check your own site in about 15 minutes, and what to ask before you pay anyone to maintain it.

The PHP advisory of 21 October 2026

On 21 October 2026, the PHP project published a security advisory for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that can let an attacker run code on a server without logging in. PHP is the language WordPress runs on. Fixed versions came out the same day: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. A day later the Centre for Cybersecurity Belgium issued its own warning, whose title says to patch immediately or take the site offline.

Both advisories say that PHP 8.1 and older no longer get updates from the PHP project. Some Linux distributions and long-term support vendors backport fixes, so if your site runs an old PHP version on shared hosting, the question for your host is concrete: has this fix been applied to my server, yes or no?

You cannot apply a PHP update yourself on most shared hosting. You can find out which version you are on, and you can make sure somebody is responsible for asking.

What ages when nobody updates

Plugins and themes

Most WordPress security problems are not in WordPress itself. Patchstack, a company that collects WordPress vulnerability reports, counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025: 91% in plugins, 9% in themes, and 6 low-priority issues in WordPress core. The same report says 46% of those vulnerabilities had no fix from the developer when they were made public, and that the weighted median time to the first exploit was 5 hours.

WordPress itself needs updating too. Its own hardening guide asks you to always run the latest version, because fixes for known holes are public once they are released. Do not count on security fixes reaching old branches. The current release on 22 October 2026 is 7.1.3.

PHP versions

PHP branches have fixed end dates, published on php.net and in its end-of-life table:

On 22 October 2026, WordPress.org's statistics showed about 36% of WordPress sites on PHP 8.1 or older, roughly one in six on 7.4 alone. WordPress recommends PHP 8.3 or newer.

This is where old sites tend to break. When a host moves accounts off an unsupported PHP version, a plugin last updated in 2019 may not run on the new one, and the site shows an error page instead of your homepage. Nothing was attacked. The site was too old for the server it ran on.

What a hacked site looks like

Nobody has to pick your site on purpose. A vulnerable plugin version can be found by automated scanning, and a site that matches can be put to use: spam pages added under your domain, visitors redirected to scam sites, a script slipped into your contact form. The owner often notices last, because the homepage still looks the same.

Google may notice first. It can label your site "This site may be hacked" in search results, and browsers that use Google Safe Browsing can warn visitors before they open the page. You can look up your domain in Google's Safe Browsing site status. Once the site is cleaned, the review request goes through the Security Issues report in Search Console.

When it becomes a data breach

A WordPress database often holds personal data: contact form messages stored by a form plugin, newsletter sign-ups, customer accounts, comments. If an attacker had access to the admin area or the database, you have a possible personal data breach to assess. Under Article 33 of the GDPR, you notify the data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people. Article 34 adds that you inform the people affected when the risk to them is high. Article 33(5) requires you to document every breach, including the ones you do not notify.

In Belgium, notification goes through the GBA/APD portal; the authority says notifications sent by e-mail are not processed. You can also report a cyber incident to the CCB through its incident form.

A 15-minute self-check

You need the WordPress admin login. If nobody has it, that is your first finding.

• WordPress and PHP version: go to Tools › Site Health › Info. The WordPress section shows the version, the Server section shows PHP (how the screen works). Compare PHP with the table above.
• Site Health status: the Status tab lists critical issues, such as an outdated PHP version or plugins waiting for updates.
• Plugins: note any with an update waiting. Look each one up on wordpress.org: "Last updated" more than a year ago is a warning sign, a notice that it has not been tested with recent WordPress releases is another, and a page saying the plugin has been closed is the strongest one. WordPress.org closes plugins for, among other reasons, security issues.
• Inactive plugins and themes: delete what you do not use. Inactive code on the server can still be reached.
• Admin accounts: in Users, filter by Administrator. Every name should be someone who works for you today. A former freelancer with admin rights is an open door.
• Backups that restore: ask where the backup is, how old it is, and when anyone last restored it to check that it works. A backup stored on the same server as the site goes down with it.
• Hosting and domain: who holds the hosting login, and in whose name is the domain? For a .be name, the DNS Belgium WHOIS shows the holder.

What a maintenance contract should cover

Updating plugins is the visible part. Since almost half of disclosed vulnerabilities had no fix at the time of disclosure, a contract that only clicks "update all" once a month leaves gaps. Ask for these in writing:

• How often WordPress, plugins and themes are updated, and whether updates are tested before they reach the live site.
• Who follows the PHP version and plans the move before the end-of-life date.
• Where backups are stored (not only on the same server), how long they are kept, and how often a restore is tested.
• Uptime monitoring, and how quickly someone reacts when the site goes down.
• What happens if the site is hacked: is cleanup included, or billed separately, and at what rate?
• Whether content edits are included, and how many hours.
• Whose name the hosting account, domain and admin logins are in. They should be yours, with the maintainer as a user you can remove.
• The minimum term and the notice period.

Maintain, migrate or rebuild

If the site still does its job and the self-check finds a recent theme and plugins that are still maintained, maintenance is the sensible choice.

If the plugins are abandoned, the theme is a dead commercial one, or the PHP upgrade breaks everything, you are paying someone to keep a site alive that will need replacing anyway. Then the choice is between moving the content to a fresh installation with supported plugins, or building a new site.

There is no reliable average figure for what maintenance costs in Belgium, so we will not quote one. Compare offers by the list above, not by the monthly amount alone. If you are weighing a rebuild against an AI website builder, we compared the two in AI website builder or studio.

What we offer

We don't maintain or patch WordPress sites, our own or anyone else's. If the self-check tells you the site needs replacing, there are two ways to a new one with us, depending on how you'd rather pay and how much the site has to do.

A local business that wants it off its plate. A shop, salon, practice or restaurant needs a site its customers can read and a Google profile that is up to date. That is what Navidu is for, a service of Invoid Vision: we build a new multilingual site and keep it running for one monthly amount, together with your Google Business Profile and the replies to your reviews. There is no WordPress left for you to update, and you see a free preview of your new site before you pay anything.

A site that needs more, or one you'd rather own outright. We build a new site as a one-off project in one of our website packages: Starter at €1,400, Business at €3,200 or Business+ at €6,000, excluding VAT. For Business and Business+, we choose the CMS with you. Migrating an existing blog archive is not included in Business, and data migration is quoted per project. Scope and exclusions are on the pricing page and the website development page.

After launch, Care keeps the new site up to date. Care is €69 per month: EU hosting, SSL, backups, updates, uptime monitoring, one hour of content edits a month and a response within one business day. Care+ is €199 per month and adds monthly content and SEO iteration, an analytics review, small feature changes and priority response. Both run for a minimum of 12 months. Prices exclude VAT.