I've been putting this off since basically the Obama administration, but I finally sat down last night and patched the WordPress install this blog runs on. All the way up. Core, theme, every plugin. Took maybe forty minutes and nothing broke, which honestly surprised me more than it should have.
The kick in the pants was WannaCry. Yeah, I know, that was weeks ago now — mid-May, the whole ransomware mess that hit hospitals in the UK and a bunch of other stuff running old unpatched Windows machines. Not exactly the same threat model as a self-hosted blog, I get it. Nobody's holding my cat photos hostage for bitcoin. But watching that story unfold made me actually think about what "I'll get to it eventually" has been doing to my own little corner of the internet for the past, I want to say, fourteen months.
Here's the embarrassing part. I checked my plugin list before starting and found three plugins still active that I don't even remember installing. One was some SEO thing from 2014 that hadn't been updated since WordPress 4.1. I'm not going to name it because that feels unnecessarily mean to whoever abandoned that project, but it's gone now.
What I actually did, in order:
First, backup. Not the halfway backup I usually do where I just export posts as XML and call it a day — an actual full backup, database and wp-content folder, zipped and pulled down to my own machine, then also pushed to a separate S3 bucket because if my hosting account gets compromised I don't want my backup sitting right next to the thing that got compromised. This step alone took longer than the rest combined because my database export kept timing out until I bumped the PHP max_execution_time in php.ini. Small thing, cost me twenty minutes of confusion.
Second, I went through every plugin one at a time instead of just hitting "update all" like a maniac. Slow, but I wanted to see if anything threw errors on activation. Two did. One turned out to be a caching plugin conflicting with an update to Jetpack, which I fixed by just deactivating and reactivating in the right order. The other I just deleted, because it was a contact form plugin and I already have a contact form plugin, apparently, and had for years without noticing the redundancy.
Third, core update. This is the part people are always most scared of and it's the part that's genuinely the least scary these days. WordPress has had auto-updates for minor releases since 3.7, and honestly if you're not letting those apply automatically you should turn that on right now, this second, before you finish reading this sentence. There's no good argument against it for minor point releases. Major version jumps, sure, test those. But minor security patches sitting unapplied for months is just asking for it.
Fourth, and this is the one I actually feel a little proud of, I set up a real update cadence instead of "whenever I feel guilty enough." Third Sunday of the month, alarm on my phone, thirty minutes, check for updates, apply them, log out. I've broken enough New Year's resolutions to know a monthly recurring calendar reminder works better for me than any vague intention ever will.
None of this is exotic advice. Every security-conscious dev has been saying "keep your software updated" since forever, and WannaCry specifically was about unpatched SMB vulnerabilities in Windows, not PHP plugins, so the connection I'm drawing here is honestly a little loose. But sometimes you need a headline to make an abstract risk feel real enough to act on. I'd been meaning to do this maintenance pass since around February. It took an outbreak on the other side of the world hitting completely different systems to actually get me off the couch.
If you're running your own WordPress site and haven't looked at your plugin list in a while, go look at it. I'd bet real money you've got at least one thing installed that you forgot exists.