Out-of-date software is the leading cause of hacked websites on shared hosting. Attacks are automated: scanners find a known vulnerable version and exploit it, often within days of the vulnerability being published.
WHAT NEEDS UPDATING
The core application (WordPress, Joomla, Laravel, a custom framework) Every theme, including ones you do not use Every plugin or extension, including deactivated ones Any JavaScript library bundled into a custom site The PHP version itself
A COMPLETE BUT UNUSED PLUGIN IS STILL A RISK
Deactivating a plugin does not remove its files from the server, and many vulnerabilities are exploitable without activation. Delete what you do not use.
SAFE UPDATING
Take a backup first. Update a few items at a time and check the site after each batch. Test major updates on a staging copy for business-critical sites. Keep a note of which extensions are abandoned by their developers and plan replacements.
AUTOMATIC UPDATES
Enable them where you can. On our servers, WordPress automatic updates depend on a real cron job, because HTTP wp-cron is blocked. See the WordPress cron article, or your auto-updates will silently never run.
