Outdated website: the risk of leaving WordPress untouched

The company site went live a few years ago. It works and brings in leads. Nobody has touched it since. From the outside, everything looks fine. Inside, it runs on a stack of software that ages every month, and some of it no longer gets security fixes.

That is the picture for a large share of WordPress sites in Brazil and around the world. And on December 31, 2026, it gets worse: another version of PHP, the language WordPress runs on, stops getting fixes. In this article I show the numbers, what is actually at risk and what to ask whoever runs your site before the year ends.

One in three WordPress sites already runs unpatched

WordPress publishes live stats on the versions in use across the sites it tracks. When we checked on October 29, 2026, the PHP breakdown looked like this:

• 33.2% of sites ran PHP 8.1 or older, versions that no longer get security fixes;
• 14.9% were still on PHP 7.4, which lost support in November 2022;
• 22.5% ran PHP 8.2, which loses security support on December 31, 2026.

The dates come from the official PHP schedule. PHP 8.1 dropped off the list on December 31, 2025, and the unsupported versions page warns that these versions may have unpatched security flaws.

Add the two lines up: if nothing changes by year end, more than half of WordPress sites (55.7%) will run on PHP with no security fixes in January 2027.

WordPress says so itself on its requirements page. It recommends PHP 8.3 or newer and warns that older versions still work but have “reached official End Of Life” and “may expose your site to security vulnerabilities”.

Why “it works” doesn’t mean “it’s safe”

Unsupported software doesn’t stop working. It just stops getting fixed. The site loads, the form sends, the owner notices nothing. When a new flaw is found in that version, nobody ships the fix.

The risk isn’t only new flaws. Patchstack’s State of WordPress Security in 2026 report shows that of the 10 most attacked flaws on WordPress sites in 2025, 6 had been disclosed in 2023 or 2024. Attackers keep trying old flaws because they know many sites never applied the fix.

In practice, an untouched site becomes an easy target in three ways:

1. Unsupported PHP. The foundation of the site stops getting fixes. Any new flaw stays open for good in that version.
2. Old plugins and theme. Every plugin is software from another vendor. If nobody updates it, the fix exists but never reaches your site.
3. Abandoned plugins. Some vendors simply stop updating. When a flaw shows up, there is no fix to apply, and the only way out is to replace the plugin.

A hack rarely takes the site down. More often the site starts redirecting visitors to fake pages, shows up on Google with spam links or gets flagged as dangerous by the browser. You lose leads, Google rankings and trust, often before you know what happened. If it already happened, our guide on what to do when your site is hacked helps in the first hours.

What usually blocks the update

If updating fixes it, why do so many sites sit untouched? Almost always for one of these reasons:

• Nobody owns it. The site was delivered, the contract ended and maintenance was never agreed on.
• Fear of breaking it. An update once took the site down, and nobody has touched it since.
• Incompatible theme or plugin. An old component doesn’t run on the new PHP, and replacing it takes work.
• Lost access. The hosting or dashboard is in the name of whoever built the site, and the company can’t get in.

All of these can be solved. But none solves itself, and the longer you wait, the bigger the jump between the current version and a supported one.

What to ask whoever runs your site

Before any quote, ask for a written inventory. It comes down to five questions:

1. What PHP version runs on the site’s server?
2. What version of WordPress is it on?
3. How many plugins are installed, and when was each one last updated?
4. Does the theme still get updates from its vendor?
5. Is there a copy of the site to test updates before they go live?

With those answers, the plan is clear:

• PHP 8.1 or older: high priority. The site already runs unpatched. Upgrade to 8.3 or newer, testing on a copy first.
• PHP 8.2: you have until December 31, 2026. Schedule the update now, not in the last week of December.
• Plugins not updated in over a year: replace or remove them. One less plugin is one less door.
• Abandoned theme: weigh the cost of replacing the theme against rebuilding the site.

And don’t stop at the update. What protects you is the routine: update on a fixed schedule, test first, keep backups off the host. I covered that baseline in website backup and security, and the difference between fixing what broke and keeping it from breaking in corrective, preventive or evolutionary maintenance.

Update or rebuild?

Not every outdated site needs a rebuild. If it has few plugins, the theme is still maintained and PHP upgrades without breaking anything, updating solves it and costs little.

The math changes when the site depends on dozens of plugins, the theme stopped getting updates and every update turns into a project. In that case, you pay to keep alive a site that will age again the following year.

A site in custom code, with no exposed dashboard and no third-party plugins, has far fewer parts to update. That is the case for the sites we build and maintain on our own server, like amandanutri.com.br, a nutritionist’s site with 100% online care and booking via WhatsApp, and conversaovisual.com.br, a course sales page that scored 99 out of 100 on Google Lighthouse in October 2026.

You don’t have to decide in the dark. The five-question inventory shows how much work an update takes, and you can compare that number with the cost of rebuilding.

How we do it at the Studio

We have been shipping digital products since 2014, with over 600 projects in 13 countries. When a site comes to us for maintenance, we start with discovery: versions, plugins, theme, access and backups. The price is fixed after that discovery, and the deadline is written into the contract.

The code, files and access, including domain and hosting, stay in the client’s name. We have our in-house dev team, and we use Claude Code and Figma for design and build. Every system we deliver ships with an AI agent that runs daily, flags issues, suggests improvements and checks that the data makes sense.

If your site is on PHP 8.2 or older, support ends in a few weeks. Reach out through our website maintenance and evolution service and finish December with an updated site and a routine that keeps it from aging again.