When WordPress stops behaving

Where the trouble usually sits

Patchstack, a WordPress security company, published its State of WordPress Security in 2026 report on February 25, 2026. It counted 11,334 new security holes reported across the WordPress world during 2025, up 42 percent from the year before. Of those, 91 percent were in plugins and 9 percent were in themes. WordPress core itself had six.

The same report says 46 percent of those problems had no fix ready on the day they were made public.

That is the honest shape of the risk. Every plugin is code written by someone else, and you are trusting that they still care. Count the plugins on your site today. If the number is over twenty and you cannot say what four of them do, that is where to start.

The PHP version under your site

WordPress runs on PHP, the language your host installs on the server. The official WordPress requirements page, published January 23, 2023 and last modified May 7, 2026, recommends PHP version 8.3 or greater.

The php.net end of life page lists PHP 7.4 as finished since November 28, 2022, and PHP 8.1 as finished since December 31, 2025. That page carries no update date.

WordPress.org also publishes a live count of the PHP versions its sites run on. Read in August 2026, it showed about 17.5 percent of installs still on 7.4, a version that stopped getting fixes almost four years ago. That feed carries no update date either. Your own version is usually listed in your hosting control panel, under a tab named PHP or Server.

The problems you only find by testing

A contact form that quietly stops emailing you looks fine from the outside. So does a backup that has never been restored. So does a page that only goes blank on a phone.

Three checks, each under ten minutes: - Send yourself a message through your own contact form, from a phone, on cell data. - Ask your host to restore last night's backup onto a test copy of the site. - Open the site in a private browser window and watch how long the first screen takes.

What to do next

Not every old WordPress site needs replacing. If yours loads fast, updates without drama, and the form still reaches your inbox, leave it alone and put the money somewhere it does more good. A rebuild is worth pricing when the plugin list is long, the page builder holds the layout hostage, and every update feels like a coin flip.

One limit on the numbers above. Patchstack counts problems reported across the whole WordPress world, not sites actually broken into. A large count there says the risk is real. It says nothing about whether your site was hit.

Start here. Write down your plugin list. Check your PHP version. Test your form. Those three answers tell you whether you have a maintenance job or a rebuild.