WordPress website without maintenance: what to do now

Why missing updates are the main risk

WordPress itself is rarely the problem. According to Patchstack's report “State of WordPress Security in 2026”, a total of 11,334 new security vulnerabilities were found in the WordPress ecosystem in 2025, 42% more than the year before. 91% of them were in plugins, 9% in themes. Only 6 vulnerabilities were reported in WordPress core.

That means every plugin you have installed is a separate piece of software with its own bugs. Contact form, slider, cookie banner, page builder: each of them needs updates. WordPress.org says that plugins have deep access to your website and must therefore be kept up to date.

Then there's the speed. Patchstack found that around half of the serious vulnerabilities are attacked within 24 hours of becoming known. So if you only log in every few months, you're almost always too late. And 46% of vulnerabilities had no patch from the developer at all when they were disclosed. A plugin that is no longer maintained will never get one.

What the GDPR requires of you

As soon as your website processes personal data, you are a controller within the meaning of the GDPR. Even a contact form, appointment booking or comments count. Under Art. 32 GDPR, you must take appropriate technical and organisational measures that ensure a level of security appropriate to the risk. The Datenschutzbehörde (DSB, Austrian Data Protection Authority) describes this as a risk-based approach in which the state of the art also counts.

Running software with known vulnerabilities that were fixed long ago hardly fits this requirement. Whether there is a breach in an individual case is decided by the authority. But the follow-up obligation is clear: if there is a personal data breach, under Art. 33 GDPR you must report it to the Datenschutzbehörde without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to the people affected.

Under the principle of accountability, you must be able to prove in a dispute that you have met your obligations. A simple update log helps with that.

How to check your update status in five minutes

Log in to the WordPress admin area. A red counter next to “Dashboard > Updates” and “Plugins” shows pending updates. Under “Tools > Site Health”, WordPress itself checks whether there are critical issues, such as pending plugin updates, an outdated PHP version or background updates that aren't working. The “Info” tab shows you the WordPress version, active and inactive plugins and themes, and whether automatic updates are switched on.

• WordPress version: according to WordPress.org, only the latest version is officially supported.
• Plugins: are there updates? When was the plugin last updated in the plugin directory?
• Inactive plugins and themes: WordPress recommends removing unused themes. The same applies to plugins.
• PHP version: according to php.net, PHP 8.0 and 8.1 have reached end of life, and PHP 8.2 only receives security updates until 31 December 2026.
• Backups: is there an automatic backup, and have you ever tested a restore?

Your three options

Which option suits you depends on how much time you have and what your website needs to do.

Automatic updates: helpful, but no substitute

Since WordPress 5.5, you can switch on automatic updates for each plugin and theme individually. By default, WordPress runs them twice a day and sends you an email when an update has succeeded or failed.

WordPress.org recommends setting up regular automatic backups first so you can go back if an update breaks something. Automatic updates also don't help with plugins that are no longer developed, with paid plugins without a valid licence, or with an outdated PHP version on the server. The updates run via WordPress cron. Site Health shows you whether that works.

Step by step

1. Sort out access

   Make sure you have your own administrator access to WordPress and to the hosting. Without your own access, you can neither check nor switch.

2. Make a backup

   Back up files and database before you change anything. Many hosts offer this in the customer area, otherwise a backup plugin helps. Store a copy outside the server.

3. Check Site Health

   Open “Tools > Site Health” and note all critical issues, the WordPress version, the PHP version and the list of plugins.

4. Remove dead weight

   Delete inactive plugins and themes you don't need. Every plugin you remove is one less source of problems.

5. Install updates and test

   Update WordPress, plugins and themes. Then test the home page, contact form and all important features. If you have a shop: place a test order.

6. Replace outdated plugins

   Check in the plugin directory when a plugin was last updated. If it is no longer maintained, replace it or do without the feature.

7. Decide: maintain or switch

   Be honest: how much time does maintenance cost you each month? Compare that with a maintenance contract and with a new, leaner website.

8. Write down an emergency plan

   Write down who is responsible in case of an attack, where the backups are and how you reach the Datenschutzbehörde within 72 hours.

Common mistakes

• Putting off updates because the website “works anyway”. According to Patchstack, many serious vulnerabilities are exploited within a day of becoming known.
• Leaving inactive plugins installed. Deactivated code is still on the server.
• Using paid plugins or premium themes without a valid licence. Then updates often stop coming.
• Installing updates without a backup and having no way back if something goes wrong.
• Forgetting the PHP version on the server. It also only receives security updates for a limited time.
• Assuming the web designer from back then automatically takes care of updates, without a maintenance contract.

Frequently asked questions