Owning a WordPress website means looking after it. WordPress itself, your theme and every plugin you install get regular updates, and many of those updates fix security holes. If nobody installs them, the site slowly becomes easier to break into.
This guide is for business owners who have a WordPress site, or are thinking about one, and aren't sure what keeping it safe actually involves. We explain what plugins are, why they are the weak point, what a sensible update routine looks like, and what it costs you in time.
By the end you'll know whether you can handle this yourself, or whether it belongs with someone whose job it is.
What plugins are and why sites collect them
A plugin is an add-on that gives WordPress a feature it doesn't have out of the box. Contact forms, booking calendars, SEO settings, image galleries, pop-ups and online payments usually come from plugins. Each one is written and maintained by a separate developer or company.
Most small business sites end up with a dozen or more. A developer adds a few during the build, the owner adds a couple later, and some stay installed long after anyone uses them. Every one of them is code running on your website, and every one needs updates for as long as it stays installed.
Why plugins are where the security risk is
Patchstack, a WordPress security company, counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, up 42% on the year before. 91% were in plugins and 9% in themes. WordPress core had just six.
Speed matters too. For the most heavily targeted vulnerabilities, Patchstack found the median time from public disclosure to the first attack was about five hours. Attackers use automated tools that scan thousands of sites for a known weak plugin. They don't need to know your business exists.
So the risk is rarely WordPress itself. It is the plugin that hasn't been updated, or the one whose developer stopped maintaining it.
What a proper update routine involves
Clicking Update all and hoping for the best is how sites break. A safer routine looks like this:
- Back up first. Take a full backup of files and database before any update, and check you can restore it.
- Update in order. WordPress core, then the theme, then plugins, checking the site between steps.
- Test what earns you money. Submit the contact form, make a test booking, load the site on a phone.
- Remove what you don't use. A deactivated plugin is still code on your server.
- Watch for abandoned plugins. If a plugin hasn't been updated in a long time, plan to replace it.
- Check renewals. Paid plugins often stop sending updates when the licence lapses.
When updates break things
Updates fix problems, but they can also cause them. Two plugins that worked together last month may clash after one of them changes. A theme may stop matching a new version of WordPress. The result can be a broken layout, a contact form that silently stops sending, or a blank page.
This is why many owners stop updating. The site works, the update feels risky, and there is never a good time. That choice feels safe, but each skipped update leaves a known hole open for longer.
What it costs you in time
Updates come out every week across a typical set of plugins. Doing them properly, with a backup and a quick test, takes time each week, plus longer when something breaks and needs fixing. That is time away from customers.
Leaving it costs more. Cleaning up a hacked site, restoring lost data, and getting Google to remove a security warning from your listing take far longer than routine updates. Our guide on what to do if your website is hacked walks through that process.
Who should be doing this work
You have three realistic options. Do it yourself, if you're comfortable with backups and testing and can set aside the time every week. Pay a developer or agency for a WordPress care plan. Or move to a website where updates and security are part of the hosting, so there's nothing for you to manage.
Lumeen takes the third approach. We build each site from scratch rather than on WordPress with plugins, and we host it ourselves. Updates, security, SSL, backups and DDoS protection are part of every hosting plan, from $24.99 a month inc. GST. You don't log in to update anything. If you want a change, you send it to us and we make it.
Key takeaways
- (01)
Plugins add most of WordPress's features, and they are where 91% of new WordPress vulnerabilities were found in 2025.
- (02)
The most targeted holes are attacked within hours of being made public, so updates can't wait for a quiet month.
- (03)
A safe routine is back up, update in order, test the form and bookings, and remove what you don't use.
- (04)
If nobody has time to do this every week, move the job to someone whose job it is.
Frequently asked questions
How often should I update WordPress plugins?
Check at least once a week, and install security updates as soon as they come out. Take a backup first and test your contact form and key pages afterwards.
Can I turn on automatic plugin updates?
Yes. WordPress lets you enable automatic updates for each plugin. It saves time, but an update can still break something with nobody watching, so you still need backups and regular checks.
Is WordPress itself insecure?
WordPress core had very few vulnerabilities in 2025. Most problems come from plugins and themes, especially ones that are out of date or no longer maintained.
Do I need to update plugins I've deactivated?
Deactivated plugins are still on your server. Update them or, better, delete the ones you don't use.
More answers on price, hosting and timing in our FAQ.