At ATAK, most of the websites we build incorporate WordPress, and this should be no surprise. WordPress is nearly ubiquitous, powering 28% of all websites. In our work in web development for clients, we’ve worked with WordPress in considerable depth, sifted through many, many themes, and installed countless plugins and security updates. We’ve launched hundreds of websites since 2006, and we’ve learned a lot in the process.
We have talked about the benefits and drawbacks of open source software on the blog before. WordPress is an open source CMS, meaning that all WordPress websites are based on the same structural code that anyone can access and manipulate. This is one of WordPress’s strengths, in that this allows smart developers from around the world to build improvements for the WordPress CMS, which can become updates that are shared to everyone through WordPress updates.
There is one main concern, however: the popularity of the WordPress CMS increases the likelihood that your website could be targeted by hackers when a new vulnerability is uncovered. The popularity of WordPress attracts the attention of malicious developers who are trying to get a hold of as much personal user information as possible.
– Bleeping Computer
Because of this, WordPress is secured through patches and updates when vulnerabilities in the CMS are identified. This was previously a manual process, putting many sites at risk. Website administrators were shown a message at the top of their WordPress dashboard, which could confuse some users, and the message alone did not ensure that security updates were installed.
WordPress version 3.7 introduced automatic updates for maintenance and security, reducing the risk that many sites would fall prey to vulnerabilities found in the CMS. Below are some specific reasons why these updates are so important.
One of the biggest challenges faced by the internet is the technology arms race between bad guys who want to steal your information and hijack your website; and good guys (like us!) who want to create functional, secure websites for businesses.
When WordPress issues a security update, the community has discovered a part of WordPress that is vulnerable to hacking techniques. The tactics and technology are always changing, making regular updates a part of life online.
Browser standards, mobile usability standards, and other features of the always-updating internet technology scene, mean that website performance technology must also shift with time.
“In the most recent update to WordPress (version 4.8.2), there were nine security updates, most of them involving involving cross-scripting vulnerabilities. WordPress practices responsible disclosure. Part of that is making vulnerabilities public once they are fixed. As soon as a vulnerability is made public, the hackers know exactly how to exploit your site. This makes it even more important that you update immediately and don’t turn off the automatic updates that are now built into WordPress core.” – Jules Sherred, Developer at ATAK Interactive
Some of these are continual improvements, like site speed which is great for Search Engine Optimization (SEO), on top of improving user experience. With this in mind, the community of WordPress developers are constantly working to improve loading times for its websites. Thus, enhanced site speed is usually part of the package with a WordPress update.
From time to time, a larger update will come along which adds or upgrades built in WordPress features.
When you ignore these updates, you’re forfeiting the opportunity to give your visitors the best possible experience.
‘Bug fixes’ aren’t the highest priority for updates, unless you’re being impacted by one of the bugs. Usually, they just help every part of the site work the way it’s supposed to.
“Over 70% of the websites I’ve personally reviewed this past year were compromised due to either outdated WordPress plugins or outdated WordPress installations.” Jim Walker, Hack Repair Guy
Critical updates are going to need to be done no matter what; your business can’t afford to risk a data breach. Bug fixes and performance updates, however, can be spaced out so that they suit your development schedule and budget.
First things first: If your WordPress site includes custom coding and design, it’s best to leave the updates to your development team. Because WordPress functions often share code, unexpected complications can arise from updates that require a developer’s knowledge to navigate.
Similar to ensuring that your business operates with the most up-to-date practices and technologies available in your industry, making sure that your website is running on the latest version of WordPress should also be part of your routine in keeping your business competitive.
When WordPress makes a high-priority update, these fixes can be comparable to an antivirus software update. Threats and vulnerabilities are always changing within digital systems, which underscores the value of having a digital marketing partner who can be on the lookout for the latest risks, and how to avoid them.
A development team like the one at ATAK Interactive can help your business navigate every part of online security, from CMS vulnerabilities to transaction encryption.
If you think your website is in need of an update, talk to us and we can help identify exactly where you could use a bit of sprucing up and how to do it.