You can check in under two minutes. Log in to WordPress, go to Dashboard, then Updates, and see what’s waiting. If there’s a list, your website is running older versions of its software than it could be, and some of those updates may be security fixes.
How do I check whether my WordPress website needs updating?
- Log in to your WordPress admin area. For most sites, that’s your web address followed by /wp-admin.
- In the left-hand menu, go to Dashboard, then Updates.
- Look at the three sections on that page: WordPress, Plugins and Themes.
- Note what’s waiting. On the Plugins page, clicking “View details” next to a plugin shows when its developer last updated it.
- Go to Tools, then Site Health. WordPress will flag critical issues here, including an outdated version of PHP.
If you can’t log in, or your account doesn’t have admin access, that’s a finding in itself. Someone should be able to answer these questions, and it’s worth knowing who.
What might I find?
- A WordPress update: a new version of WordPress itself is available.
- Plugin updates: usually the longest list.
- Theme updates: relevant if your site uses an off-the-shelf theme.
- Plugins that haven’t been updated by their developer in a year or more: a sign they may have been abandoned.
- Site Health warnings: including a PHP version that no longer receives security support.
Why do updates exist?
Some updates add features. Others exist purely to fix security vulnerabilities: weaknesses that could let someone into a website, or into the data behind it.
WordPress 7.1.2, released on 22 September 2026, is a clear example. It fixed one critical vulnerability and nothing else, and WordPress recommended that site owners update immediately. Five days earlier, WordPress 7.1.1 included 11 security fixes alongside its bug fixes.
Once a fix is published, the weakness it fixes becomes public knowledge too. That’s why the gap between an update being released and an update being applied matters.
Doesn’t WordPress update itself?
Partly. Unless automatic updates have been switched off, WordPress installs minor core releases by itself, which covers most security releases. Plugin and theme auto-updates are off by default, so unless someone has turned them on for each plugin, those updates wait for a person to apply them. Hosting providers also vary in what they manage for you, so it’s worth checking rather than assuming.
I’ve found a long list. What now?
Don’t panic. But don’t ignore it either.
A long list usually means the site has gone without attention for a while, so a few sensible steps come before any clicking:
- Take a full backup first, and confirm it has completed.
- Apply any WordPress security release as the priority.
- Update plugins in small groups rather than all at once, so if something breaks, you know which update caused it.
- Check the site afterwards, especially forms, checkout and anything connected to another system.
Updating thirty plugins in one click is how an ordinary Tuesday turns into a website outage. We’ll explain why in a later article.
Would you rather someone else checked every week?
If you’d rather this check happened on a schedule, without anyone on your team needing to remember it, that’s what Hatchet’s WordPress Care Plan is for.