The single most important ongoing task.
WHY
Out-of-date software is the leading cause of compromised sites on shared hosting. Attacks are automated: scanners find a known vulnerable version and exploit it, frequently within days of the vulnerability being published.
WHAT NEEDS UPDATING
The core application Every theme, template or skin Every plugin, module or extension, including ones you have disabled Any library bundled into custom code
A DISABLED EXTENSION IS STILL A RISK
Disabling does not remove the files, and many vulnerabilities are exploitable without activation. Delete what you do not use.
SAFE UPDATING
Take a backup first Update a few items at a time and check the site after each batch Test major updates on a staging copy for anything important Read the changelog for anything marked as breaking
AUTOMATIC UPDATES
Enable them where the application supports it and you trust the source.
Be aware they depend on cron. On our servers WordPress needs a real cron job, since HTTP wp-cron is blocked, or automatic updates never run.
TRACKING
Keep a note of what is installed and its version, particularly across several sites.
