How to check if your WordPress site is still getting security updates

Published 4 Nov 2026

How to check if your WordPress site is still getting security updates. Four checks: PHP version still supported, WordPress on 7.1.4, plugins updated with none closed, and Site Health issues cleared.

A WordPress site can look perfectly fine from the front and still be running software nobody patches any more. The parts to check are PHP, WordPress itself and your plugins. You can check all three from your dashboard in about fifteen minutes, without any technical tools.

1. Check your PHP version

PHP is the language WordPress runs on, and your host provides it. Each PHP branch gets security fixes for a fixed period, then stops.

To find yours, go to Tools > Site Health, open the Info tab and expand Server. The PHP version is listed there.

Then compare it against php.net's list of supported versions. As of early November 2026:

  • PHP 8.5 gets security fixes until 31 December 2029.
  • PHP 8.4 gets security fixes until 31 December 2028.
  • PHP 8.3 gets security fixes until 31 December 2027.
  • PHP 8.2 gets security fixes until 31 December 2026, so it has under two months left.
  • PHP 8.1 stopped on 31 December 2025, 8.0 on 26 November 2023 and 7.4 on 28 November 2022.
PHP security support end dates as of November 2026. PHP 8.5 gets security fixes until 31 December 2029, 8.4 until 31 December 2028, 8.3 until 31 December 2027 and 8.2 until 31 December 2026. Support ended for 8.1 on 31 December 2025, 8.0 on 26 November 2023 and 7.4 on 28 November 2022.
Dates from php.net's supported versions page.

If you're on 8.1 or older, your PHP no longer gets any fixes. If you're on 8.2, plan the move now. Most hosts let you change the PHP version in their control panel, but test on a staging copy first, because older plugins and themes sometimes break on a newer PHP.

2. Check your WordPress version

WordPress's own hardening guide says it plainly: "Older versions of WordPress are not maintained with security updates." The latest release is 7.1.4.

Your version shows in Dashboard > Updates, and at the bottom right of most admin screens. If an update is waiting there, take a backup and then run it. If your site is a few major versions behind, updates were usually switched off at some point, or something on the site broke when someone tried to update. Find out which before you push ahead.

3. Check your plugins on WordPress.org

Plugins are where most of the risk sits, because there are many of them and each one is maintained, or not, by a different developer.

Go to Plugins > Installed Plugins and note anything with an update waiting. Then look up each plugin on wordpress.org/plugins and check three things on its page:

  • When it was last updated. The date is in the sidebar. A plugin last updated years ago isn't necessarily dangerous, but nobody may be watching it for bugs.
  • The "not tested" warning. WordPress.org adds a notice to plugins that don't support the last three major WordPress releases.
  • A closed notice. When a plugin is closed, its page says so, and closures after January 2018 include a date. Reasons include an author request, a guideline breach, a licensing problem and a security issue. WordPress.org doesn't publish the details, so treat any closed plugin as one to replace (more on that in what to do when a plugin is closed).

A closed plugin stops getting updates through your dashboard, and WordPress won't tell you it's been closed. The plugin page is the place to look.

Remove plugins you've deactivated and don't plan to use again. Deactivated plugins still sit on the server, and they're easy to forget about when updating.

4. Run Site Health

Tools > Site Health has a Status tab that sorts its findings into critical issues, recommended improvements and passed tests. WordPress's documentation lists security-related checks among them, including:

  • Background updates not working as expected, which means WordPress may not apply a security release on its own.
  • Could not reach WordPress.org, which stops the site checking for and installing updates.
  • Plugins waiting to be updated.
  • An outdated PHP version.

Deal with anything under critical issues first. The Info tab also has a button that copies the full report, which is handy if you want someone else to look.

What to do with the results

If everything is current, put a reminder in the diary to check again in a month. If something is out of date:

  1. Take a full backup of files and database.
  2. Update on a staging copy if your host offers one.
  3. Update WordPress, then plugins and themes, then PHP.
  4. Replace closed or abandoned plugins with maintained ones.

Want a second opinion?

If you'd rather not do this alone, or the checks turned up something you're not sure about, have a chat with us or run a free scan. We'll tell you what we find in plain English.

Further reading