How to check if your WordPress site is up to date and secure
A plain checklist for a WordPress site: PHP version, core, plugins, users and files. About ten minutes, no jargon.
Nikolas Gannon · · 1 min read · Systems and security
A ten-minute check will tell you whether your WordPress site is up to date. Here is the list.
The checklist
- PHP version. Is it 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer? Those versions include the PHP2Shell fixes from October 2026.
- WordPress core. Is it on the latest release? Versions 6.9.5 and 7.0.2 fixed the wp2shell issue from July.
- Plugins and themes. Are they all updated? Remove any you no longer use.
- Admin users. Is every account someone you know?
- Recent files. Are there PHP files you did not create? That can be a sign of a webshell.
- Checksums. If you have WP-CLI,
wp core verify-checksumsconfirms your core files match the official release.
What the results mean
If everything is current and nothing looks unfamiliar, you are in good shape. Keep the monthly habit.
If something is out of date, update it. Your host can often help with PHP.
If you find unknown users or files, restore from a clean backup, change your passwords and update everything before going back online.
Worth knowing
A clean check today does not mean the site stays that way. Regular updates are what keep it there. If you would rather not think about it, the options are a maintenance plan, managed hosting or a static site, which has no PHP or plugins to update.
If you want a hand with the check, the free audit covers it.
Free resource: Website security check
Free resource: Website health check
Read next: Signs your PHP website has been hacked · Is WordPress safe after PHP2Shell and wp2shell?
Questions
How do I check my WordPress version?
It is shown on the Updates screen in the admin dashboard. Compare it to the latest release.
What is the most important check?
PHP version first, then WordPress core, then plugins. PHP is the layer everything else runs on.
How often should I check?
Once a month is a good habit, plus whenever a major security update is announced.