If hackers can drain billions of dollars in roughly 20 minutes from Binance, a crypto company with an enterprise-level security team, think about the millions of WordPress sites running plugins their owners haven’t touched since 2021.
AI bots don’t care if you’re a crypto giant or a small business with a contact form. They’re jiggling every doorknob on the internet at once, and old software is a door that’s been unlocked for years.
The Small Business Owner with a Full Calendar & a Dusty Website
One of my small business clients in Atlanta runs a brick&mortar wellness and continuing education business. She’s been running the business and successfully servicing her clients for 13 years: her word-of-mouth reputation and peer referrals are rock solid, and her Google reviews are great. What she needed was help growing: more online appointments, more website leads, and more student registrations.
We discussed where she wanted to go and reviewed her website. Her brand was established, her website was functional, but the site had seen better days. I asked her when the website backend was last updated.
She couldn't remember the last time her WordPress software was updated...
This is not uncommon. Her team had been editing page content and managing the booking software for years after their original website developer stepped away. But the user experience felt disjointed and some basic best practices weren’t being followed on the front end, not to mention it loaded very slowly. And like many other small businesses with WordPress websites, she hadn’t looked behind the curtain to check the machinery running the website because she was busy running her business.
In its current state, when people landed on the site, they could learn more about a few of her offerings and book an appointment, but the site wasn’t being found in search and services were spread out across multiple pages, making it challenging to navigate.
To help her small business grow, it was clear we had to update some website fundamentals: refresh the copy, apply SEO best practices, and create clearer paths for visitors to shop services and book appointments.
When I logged into the WordPress backend, almost everything needed version updates, including WordPress itself and the PHP running it. There were also a bunch of compatibility errors with plugins and they had stopped working. It was like running modern booking apps on a phone that hadn’t updated its operating system since 2021: features break, things freeze, and the security patches stop coming.
And this outdated code posed a major security risk.
Outdated software does a lot of quiet damage.
When your software is outdated, it opens security holes – this is true for any software you use. For websites, outdated code messes with performance – it drags down page speed, makes search engines trust you less, and keeps modern booking tools and forms from working smoothly, not to mention it leaves you vulnerable to hacking.
For a small business that runs on online appointments and website registrations, that means lost clients and potentially devastating business operations slowdowns.
Side note: just a few weeks after I flagged this for my client, a worldwide PHP security emergency became major news when major government sites and corporations had to temporarily take their sites offline to patch vulnerabilities. For most businesses on standard hosts, your provider should have handled the PHP patch by now. But for small businesses on private servers or custom hosts, you have to update this code yourself. See my recommendations below on what to do.
How We Updated Old Code Without Breaking The Website
I’m technically savvy, but for this kind of backend code work, I partner with an expert local developer I work with to handle the heavy lifting. The biggest risk of foundational code updates is a conflict with older software that causes the site to crash.
Before touching a single setting, we protected her website content by creating a full backup point of the site and database, so we could roll back immediately if anything went sideways. From here, my developer worked methodically:
- Updated PHP on the web host
- Updated WordPress
- Updated her design theme
- Updated all plugins
- Reviewed and tested the site to make sure forms and links worked
The site stayed live the whole time, with no interruptions for her or her clients. Backend maintenance isn’t glamorous, but her website is now up to current industry standards and positioned to grow her business with digital marketing.
What Can A Business Owner Do About Updating Their WordPress Website?
- If you use Managed WordPress Hosting: You are in a good starting position, but you are not completely off the hook. Managed hosting typically handles WordPress core updates, server-level PHP upgrades, and daily backups automatically. However, it rarely updates your third-party plugins or your design theme, which are the most common entry points for hackers. You still need someone logging in monthly to run plugin updates and visually check that nothing broke.
- If you use standard, unmanaged hosting (like basic shared plans): Your host is simply renting you server space; they are not watching the software inside it. My strongest recommendation here is to migrate to a reputable Managed WordPress host. Moving to managed hosting immediately takes server maintenance, core updates, and automated backups off your plate so you can focus on running your business.
- If you are on a private server or custom host (like my Atlanta client): You maintain full control over your environment, which also means you carry full responsibility for all the code running on it. Because custom setups often have unique configurations, clicking “update all” without a safety net can crash your site. You need a dedicated maintenance plan with a trusted web professional who will back up your database, test updates in a safe staging environment, and keep your PHP, core, and plugins current.
No matter which category your website falls into, software updates are not a “set it and forget it” task. Always factor in regular software updates for your website.
