Why You Must Update Old WordPress Versions (2026)

Running an outdated WordPress install is one of the easiest ways to get your site hacked. Back in 2008, Google began testing warnings in Webmaster Tools for sites running an old, vulnerable WordPress version. Today the advice is the same, but the tools are better: WordPress can update itself, and Google Search Console alerts you if your site is hacked. Here’s why you should update old WordPress versions, what Google does now, and how to keep your site current in 2026.

Quick answer: Old WordPress versions, plugins and themes contain known security holes that bots scan for automatically. Keep WordPress core, plugins, themes and PHP up to date, turn on automatic updates, back up before major upgrades, and verify your site in Google Search Console so you’re alerted to hacked content or malware. Google no longer emails about specific WordPress versions, but it does flag sites that have already been compromised.

What Google did in 2008

In October 2008 Google ran a limited test in Webmaster Tools (now Search Console), sending Message Center warnings to webmasters running WordPress 2.1.1. That release was notorious because an attacker had broken into a wordpress.org server and modified the 2.1.1 download files. Google said it might expand the warnings to other web software if the test went well.

This was the sample message affected site owners saw:

At the time we thought it was a smart move. We also noted that a blog that hadn’t been upgraded in over a year was probably abandoned, and abandoned sites are exactly the ones attackers love.

What Google does today

Google doesn’t send version-specific WordPress warnings any more. Instead, the Security issues report in Google Search Console (external site) tells you if Google detects hacked content, malware or deceptive pages on your site. Visitors may see a browser warning, and your rankings can suffer until you clean up and request a review. Updating is how you avoid getting there.

Why old WordPress versions are risky

• Known vulnerabilities: once a security fix is released, the flaw it patches becomes public, and automated bots start probing every site that hasn’t updated.
• Plugins and themes: most WordPress hacks come through outdated plugins and themes, not core.
• Old PHP: unsupported PHP versions no longer get security fixes and slow your site down.
• Abandoned add-ons: plugins that haven’t been updated in years may never get a fix.

How to keep WordPress updated in 2026

1. Back up first. Use your host’s backups or a backup plugin before major updates.
2. Update core. Go to Dashboard > Updates and install the latest version. Minor security releases install automatically on most sites.
3. Turn on plugin and theme auto-updates. On the Plugins and Themes screens, click “Enable auto-updates” for trusted add-ons. See our guide to auto-update WordPress plugins and themes.
4. Remove what you don’t use. Delete inactive plugins and themes rather than leaving them installed.
5. Upgrade PHP. Check Tools > Site Health and ask your host to move you to a supported PHP version. Here’s how to upgrade PHP in WordPress.
6. Verify your site in Search Console so security alerts reach you.
7. Consider managed hosting if you don’t want to handle updates yourself. Hosted WordPress.com (external site) sites are updated for you.

Should you hide your WordPress version?

We once recommended removing the version number from your theme’s header so attackers couldn’t see it. It’s still a harmless tidy-up, but it’s not real protection: bots attack known flaws whether or not they can see your version number. Read more on how to hide your WordPress version and why updating matters more, plus our checklist to make WordPress faster and safer.

FAQ

Does WordPress update automatically?

Minor maintenance and security releases update automatically on most sites by default. Major versions, plugins and themes may need you to turn on auto-updates or update manually.

Is it safe to update WordPress?

Yes, especially with a recent backup. Problems usually come from incompatible plugins, so update those too and test your site afterwards.

How do I check my WordPress version?

Look at the bottom right of any admin screen, or go to Dashboard > Updates.

Will Google penalize my site for running old WordPress?

Not directly. But if an outdated site gets hacked, Google may show security warnings and your search traffic can drop until it’s fixed.