An Out-of-Date Theme Isn’t a Cosmetic Problem
When people think about an out-of-date website, they picture it looking dated. That’s the smallest part of it. Website software — WordPress itself, the theme, every plugin — gets security fixes the same way your phone does. When a flaw is found, it’s fixed and then published. That publication is the point: the moment a fix is announced, the flaw becomes public knowledge, and every unpatched site running that version becomes a listed target. Automated tools scan the whole internet looking for them. It isn’t personal and nobody chose your business. You’re a version number on a list. Going through the sites we host, we found one running a commercial theme several versions behind, sitting inside published security advisories — including one that doesn’t require anyone to log in or click anything. And the theme licence had lapsed, which meant it couldn’t receive updates even if someone had tried. That’s the trap with commercial themes and plugins. The licence isn’t just support. It’s the update channel. Let it lapse and the software keeps working, looks fine, and silently stops receiving fixes. We found no sign that site had been broken into. But we did find another, years ago, where a redirect had been injected through an administrator’s own browser session and sat there for months sending visitors somewhere else. Nobody noticed, because it only fired for visitors arriving from search. What we do about it now: every site we host gets its versions checked against published advisories as a routine item, not a favour. Lapsed licences get flagged. And anything that can’t be patched gets a plan rather than a hope. If you don’t know whether your theme is current, that’s worth ten minutes of somebody’s time this week.