What We Find When We Take Over a WordPress Site

Most of the WordPress sites that land on our desk were not built by us. They arrive because something broke, or slowed down, or got flagged by a customer, and the person who built the site left the picture years ago.

I want to describe what we actually find when we open one up, because owners are often braced for a telling-off and that is not what any of this deserves. You were sold a website. Almost nobody was sold the habit that keeps one healthy.

Plugin sprawl

Thirty-odd plugins is common. Forty is not unusual. When we go through them, roughly a third are doing something the site needs, a third are doing something the site did need in 2019, and a third have been abandoned by their authors entirely.

That last group is the problem. An abandoned plugin does not stop working, which is why no one removes it. How Hackers Exploit WordPress Gaps covers what happens next. It just stops getting fixed, and every one of them is a door that nobody is minding.

Accounts belonging to people who left

Old developer logins. The agency before last. A marketing contractor from a campaign that ended three years ago. Sometimes a generic "admin" account whose password is in an email thread someone could still search.

None of these are malicious. They are just leftovers, and each one is a working key to your site held by somebody who has no reason to think about it.

A theme that stopped being maintained

Often a premium theme, bought once, with a licence that lapsed when the original invoice was paid. The theme keeps working, so no one notices that it also stopped receiving security updates the day the licence expired. We find themes last updated in 2019 fairly regularly.

PHP from another era

PHP is the language WordPress runs on, and old versions stop getting security fixes. We still find sites on versions that went out of support years ago, usually because "it works, don't touch it" was reasonable advice from someone who did not want to break anything.

It is reasonable right up until it is not.

Backups nobody has ever restored

Almost every site has backups. Very few have backups anyone has tested. There is a particular flavour of bad day where the backups have been running faithfully for two years into a folder on the same server that just went down, or where they turn out to have been silently failing since a plugin update in March.

A backup you have never restored is a hope, not a plan.

The £40 saving

Now and then we find a nulled plugin, which means a paid plugin obtained free from somewhere it should not have come from. Someone saved forty pounds. What arrived alongside it, more often than not, was malware, sitting undisturbed in a site that has been running fine ever since.

What we do about it

The order matters more than the individual steps. We audit first and change nothing, so we know what is there. Then we patch what needs patching, remove what is not earning its place, and close the accounts no one has used. Then we document it, which is the part that tends to get skipped and the part that saves you money next time.

Then a rhythm. Not "we ran the updates", but somebody who knows what your site is made of and notices when one of those things has a bad week.

Almost none of this is dramatic. It is a few days of unglamorous work, and at the end you have a site whose contents someone can name. Most of what turns up is the same list as The Security Spec That’s Actually a WordPress Problem List. Given how the last few weeks have gone with WordPress core, being able to name what you are running has stopped being a nice-to-have.

None of it is an argument against WordPress either. WordPress rewards attention and punishes neglect, and most owners were never told that was the deal.

If you have inherited a site and could not say what is on it, we will go through it and tell you plainly. Get in touch and we will take a look.