The honest answer to what happens if you never update WordPress is: nothing, for a while. That is precisely why it is a common decision. The site works, updating has broken things before, and there is always something more urgent.
The cost is real, it is just deferred. Here is the sequence as it actually plays out, based on the sites we get called in to rescue.
Months one to six: nothing visible
The site runs normally. Update notices accumulate in the dashboard. Someone dismisses them.
What is happening underneath is that each disclosed plugin vulnerability with an available patch becomes a public target. Vulnerability databases such as the GitHub Advisory Database are open, so the list of sites running a known flaw is effectively a published list. Automated scanning finds them, and it does not care how small you are.
Most compromised WordPress sites were running a known vulnerability that had a patch available. That single fact is the whole argument for updating.
Months six to twelve: the compatibility trap closes
This is the phase people do not anticipate, and it is the expensive one.
Skipping one plugin update is trivial to reverse. Skipping fifteen is not, because you can no longer update anything in isolation. Plugin A needs a newer core version. Core needs a newer PHP version. Your theme breaks on that PHP version. Two plugins now require versions of a shared library that conflict.
What was a five minute task has become a project with a testing phase. The work did not disappear, it compounded, and it now needs a staging environment and someone who can debug rather than someone who can click.
Around twelve months: PHP goes end of life
PHP versions receive security support for a limited window. When yours passes it, your host will eventually force an upgrade, on their schedule rather than yours.
On a current site that is a non event. On a neglected one it is the day the site goes white, because old code that assumed loose typing meets a stricter runtime. You can check where your version sits on the official PHP supported versions page. Our note on which PHP version to run covers the choice.
Eighteen months onward: the visible failures
By now several things tend to arrive together.
- The contact form stops delivering. Usually a mail authentication change at the receiving end. It fails silently, so enquiries vanish for weeks before anyone notices.
- Payments or bookings break after a gateway deprecates an old API version.
- Search visibility drifts down. Not a penalty, just a slower, older site losing to maintained competitors.
- Something gets in. Often spam pages injected into a directory nobody looks at, discovered when Search Console reports pages you did not create.
What the recovery costs
Cleaning a compromised WordPress site is not one job. It is investigation, removal, verifying nothing remains, patching the entry point, rotating every credential, then requesting review if search engines flagged it. Published estimates put remediation in the several hundred to several thousand dollar range, and that excludes the lost business during downtime.
Against a care plan at fifty nine to two hundred a month, one incident typically costs more than a year of prevention. That is the entire economic case and it does not need embellishing. Our cleanup process sets out what recovery actually involves.
If you are already behind
Do not open the dashboard and click update all. On a neglected site that is how you turn a working site into a broken one.
- Take a full backup and verify it restores.
- Create a staging copy and do everything there first.
- Update in order: PHP compatibility check, then core, then plugins one at a time, testing between each.
- Remove plugins you no longer use rather than updating them.
- Only then promote to live, and take another backup first.
It is a day of work rather than an afternoon, and it is considerably less than the alternative.
Frequently asked questions
Is it really necessary to update WordPress plugins?
Yes, because disclosed vulnerabilities are published in open databases, which effectively advertises which sites are exploitable. Automated scanning finds unpatched sites regardless of size or traffic. The overwhelming majority of compromises we investigate involve a known flaw with a patch that was already available.
What happens if my PHP version is out of date?
It stops receiving security updates, and eventually your host forces an upgrade on their timetable. On a maintained site that is uneventful. On a neglected one it commonly produces a fatal error, because old code written for a looser runtime fails under a stricter one.
How do I safely update a WordPress site that is years behind?
Never with update all on the live site. Take a verified backup, build a staging copy, check PHP compatibility, then update core followed by plugins one at a time with testing between each. Delete unused plugins instead of updating them. Promote to live only once staging is stable.
How much does it cost to fix a hacked WordPress site?
Published estimates run from several hundred to several thousand dollars, covering investigation, malware removal, closing the entry point, rotating credentials and requesting search engine review. Lost business during downtime is on top, and for a site that generates leads that is often the larger number.
Can I just leave a WordPress site alone if it is only a brochure?
You can, but be clear about what you are accepting: a growing chance of compromise, a contact form that may fail silently, and eventual forced PHP migration that could take the site down. If the site genuinely does not matter, that trade is defensible. If it generates enquiries, it is not.