A WordPress site that has not been updated in twelve months usually looks completely fine. That is the trap. There is no warning light, no degradation you can see, no moment where it starts obviously failing.
The damage is cumulative and invisible right up until it is neither. Here is roughly how it goes.
Months one to three: nothing, apparently
The site works. Pages load. Orders come in. The only visible symptom is a growing number next to Updates in your admin, which you have long since stopped seeing.
Underneath, the gap is opening. Every plugin release you skip includes bug fixes, and some of them include security patches. When a WordPress plugin vulnerability is disclosed, it is published in public databases along with a description of the flaw. The patch and the roadmap for attacking unpatched sites arrive together.
Automated scanners crawl the web constantly looking for sites running the vulnerable version. They are not targeting you. They do not know who you are. They are checking every site they can find, and after a few months your site starts matching.
Months four to eight: small things start going wrong
This is where the quiet failures show up.
Your contact form stops delivering because your host changed its mail configuration and the old plugin version does not handle it. A payment gateway deprecates an API version and your outdated plugin is still calling it, so a subset of transactions fail. Your browser updates, tightens a security policy, and an old script stops loading, so a slider or a menu breaks on mobile only.
None of these announce themselves. You find out when someone tells you, or when you look at the numbers and they are down and you assume the market is slow.
Meanwhile the database is filling with revisions, spam and orphaned rows, and pages are getting incrementally slower.
Months nine to twelve: the real risk arrives
By now you are probably several core versions behind, possibly on a PHP version that no longer gets security patches, and running plugins with published vulnerabilities that have been public for the better part of a year.
Compromise is not dramatic. Most WordPress hacks are not defacement. They are quiet, because quiet is more profitable. Spam pages injected into a folder you never look at. Hidden links pointing to sites selling counterfeit goods. A redirect that only fires for visitors arriving from Google on a mobile device, so it never triggers for you.
You typically learn about it from a third party. Google flags the site in search results. Your host suspends the account. A customer says their antivirus warned them. By then the spam pages may already be indexed, and cleaning up the search visibility takes far longer than cleaning the site.
The part nobody warns you about: catching up gets harder
Here is the genuinely nasty bit. The longer you wait, the more dangerous the fix becomes.
Updating a plugin that is one version behind is a small change. Updating one that is fourteen versions behind means applying a year of accumulated changes in a single step, including any breaking ones. If two plugins each need a major version jump and they interact, you are now debugging a compound failure with no idea which change caused it.
Some plugins will not even let you skip that far. Others require a specific upgrade path, or a newer PHP version, which means updating PHP too, which risks breaking a different set of things.
So the site sits there, and every month the eventual fix gets more expensive. This is why neglected sites often end up needing a rebuild that would have been a routine hour of work if it had been handled all along.
How to dig out without making it worse
If you are reading this and quietly recognising your own site, do not go and bulk update everything right now. That is the fastest way to turn a slow problem into an immediate outage.
The fix: work in this order.
- Take a full backup of files and database, and store it somewhere other than the server.
- Run a malware scan first. If the site is already compromised, updating on top of the infection just hides it under new files.
- Check your PHP version in Tools, Site Health, Info, Server. Some updates will require you to move first.
- Copy the site somewhere private and do the updates there before touching live.
- Update WordPress core first, then plugins one at a time, checking the site between each.
- Delete anything you are not using rather than updating it. Fewer plugins, less to go wrong.
Expect this to take a few hours, not ten minutes, and expect at least one thing to break. That is normal for a year of debt.
Getting back to boring
The reason sites end up here is almost never carelessness. It is that maintenance is never the most urgent thing on any given day, so it loses to everything else for twelve months straight.
That is the problem Up Speed exists to remove. Updates get applied on a schedule rather than when you remember, they are tested before they go live, and if one breaks something we roll it back. Alongside that, scheduled off-site backups with 30 day retention, malware scanning, 24/7 uptime monitoring on 60 second checks, and a monthly report in plain English so you can see it is actually happening.
The Starter plan covers one site. If you are not sure how far behind you already are, a free site audit will tell you before you commit to anything.