What actually happens if you never update WordPress

Nothing, for a while. That is precisely the problem — the consequences arrive long after the decision, so the two never feel connected.

Here is the honest timeline.

Months 1–3: genuinely nothing

The site works. Updates pile up in the dashboard. Someone dismisses the notification.

The only thing that has changed is exposure: each un-applied security release is a published flaw your site still has. Nothing bad has happened yet, and this is the period that convinces people updates do not matter.

Months 4–6: the first real risk

By now you are likely running at least one plugin with a publicly disclosed vulnerability. Scanners find sites by version number, automatically, without anyone choosing you.

You may also start seeing:

• A plugin misbehaving because it expects a newer WordPress
• Contact form submissions quietly failing
• Your host emailing about an outdated PHP version

Still no visible disaster. But the odds have changed materially.

Months 6–12: things start breaking

Two forces meet. WordPress core moves on, and your plugins do not. Your host upgrades PHP on their schedule, and your old plugins were never tested against it.

Typical symptoms: a white screen after the host changes PHP, a payment gateway that stops connecting because it uses a deprecated API, an editor that stops loading properly.

This is also where compromises start showing up. Redirect hacks, spam page injections, or a site quietly sending spam until the host suspends it.

Year 1–2: the updates themselves become risky

Here is the trap. The longer you wait, the more dangerous updating becomes.

Updating a plugin across two major versions at once is far riskier than a series of small steps, and after a year you cannot do it in small steps — the intermediate versions are gone. So each update is now a bigger leap with more to go wrong, which makes you more reluctant, which makes the next one bigger still.

Meanwhile some plugins have been abandoned entirely, and one or two may have been removed from the WordPress directory. There is nothing to update to.

Year 2+: rebuild territory

At this point:

• Several plugins are abandoned with no upgrade path
• Your theme may not work with current WordPress
• PHP has moved two or three versions past what your code supports
• Updating is genuinely likely to break the site
• The site has probably been compromised at least once

The honest advice at this stage is often to rebuild rather than repair. Cleaning and updating a site in this condition can cost more than replacing it — and a good provider will tell you so rather than taking the money.

The costs nobody counts

Search rankings. A slow site and a hacked site both cost you visibility, and the hacked one costs you far more than most people expect. Recovery takes weeks after the technical fix.

Trust. A customer who saw a Google warning on your site does not come back to check whether you fixed it.

Lost enquiries. A broken contact form is invisible to you and complete to your visitor. We regularly find forms that stopped sending months earlier.

Your own time. The emergency always arrives at the worst moment, and costs more hours than the maintenance would have.

The uncomfortable arithmetic

Maintaining a site properly is three to five hours a month, or $79 on a plan.

A single malware cleanup is $150–500. A rebuild is $2,000–10,000. A month of a hacked site in search results costs rankings that take longer than that to rebuild.

The maintenance is not expensive. It is just charged in advance, in small amounts, for something that feels like nothing happening — which is exactly what you are paying for.

If you are somewhere in the first year of this timeline, our free plugin will tell you precisely where. If you would rather stop the clock, the plans start at $79.