Whether WordPress plugins are outdated or an SSL certificate has expired can usually be recognised by a few signs: pending update notices in the admin area, plugins that are no longer actively developed and browser warnings when the website is opened. With a little routine, both can be noticed early – and that is exactly why it pays to have your website checked regularly.
Why outdated plugins are a risk
Plugins are extensions that give a WordPress website additional functions, such as a contact form, a shop or an image gallery. Every plugin is a piece of software in its own right, with its own bugs. When security vulnerabilities are discovered, the developers usually release an update. But this also makes the vulnerability publicly known, and automated programs search the web specifically for websites that have not yet installed the update.
Plugins that are no longer developed at all are particularly critical. They no longer receive updates, even when new vulnerabilities become known. And deactivated plugins that are still installed can, depending on the case, also remain vulnerable.
How to tell whether your WordPress plugins are outdated
A few simple signs will help you or your agency assess the situation:
- Update notices in the dashboard: WordPress shows in the admin area when new versions are available for plugins, themes or WordPress itself. If these notices remain for weeks, that is a warning sign.
- Last update: in the plugin directory, you can see when a plugin was last updated. If that was a very long time ago, it is worth looking for an alternative.
- Unused plugins: anything that is no longer needed should not just be deactivated but removed.
- Visible version numbers: some version details appear in the website’s source code and can therefore also be recognised from the outside.
Important before every update: there should be a current backup. Updates usually go smoothly, but not always.
Expired SSL certificates: small, but very visible
An SSL certificate is a kind of digital ID card for your website that enables the encrypted connection (HTTPS). Certificates are only valid for a limited period, often only a few months, and must then be renewed. This usually happens automatically. But the automation can fail unnoticed, for example after a server move, a change of domain or a new configuration.
If the SSL certificate has expired, browsers show a prominent warning page instead of your website. Many visitors give up at this point, and those who stay wonder whether everything is in order with your business. So the risk is less an attack than a loss of trust that is immediately visible.
How to recognise a certificate problem
- The browser shows a security warning when the page is opened.
- The padlock symbol in the address bar is missing or crossed out.
- The website works with “www” but not without it – or the other way round.
- Subpages such as a shop or a customer portal at their own address have their own certificate, which expires independently of the main site.
Have your website checked regularly instead of relying on chance
Outdated software and expiring certificates are not a one-off problem; they arise again and again. A one-off check shows the status today; a regular check also notices tomorrow’s changes. Also clarify who is responsible for updates in your business: your agency, an IT service provider or someone in-house? Ideally, this should be set down in writing, for example in a maintenance contract.
You will find further points that every company website should meet in the guide Website check: 10 points for every company website. If you also want to keep an eye on your legal texts, the guide on possible deficiencies in the legal notice and privacy policy will help.
Being informed in good time with PlugTheBug
PlugTheBug checks your website regularly from the outside, among other things for externally recognisable signs of outdated software and for certificates that have expired or will expire soon. Nothing is attacked and nothing is changed in the process, and no login details are needed. Every finding is measured a second time before it is sent, so that only what really matters reaches you. If you would like support with fixing the findings, consulting is available for 129 € per hour, billed in 15-minute increments.
Would you like to know where your website stands? Request a check of your website or take your time to look at the PlugTheBug packages.