Is Your Contractor Website Behind on WordPress Security Fixes? We Read the Version on 906 Sites. 1 in 24 Still Lacks September's Critical Fix.

WordPress runs about 6 in 10 contractor websites we checked. Since Sept. 17 it has shipped four security releases, and one of them, on Sept. 22, fixed a bug its own team rated critical.

Most site owners never see any of this happen. WordPress is built to install security fixes by itself. So we wanted to know how often that actually works on contractor websites.

On October 29, 2026, we read the WordPress version on the home pages of 906 contractor websites across the US and Canada.

79.6 percent (about 4 in 5) already had the fix WordPress released the day before. But 38 sites (4.2 percent, 1 in 24) are still missing the critical fix from Sept. 22, more than five weeks later.

Below is what we found, how to check your own site in two minutes and what to ask the person who looks after it.

The Short Answer: Most Contractor WordPress Sites Patch Themselves. 1 in 24 Doesn’t.

Here's where the 906 WordPress sites that show their version stood on the morning of October 29, 2026:

Security fixes on the site	Sites	Share
Has the Oct. 28 fix (out the day before we checked)	721	79.6%
Has the Oct. 6 fix, not yet the Oct. 28 one	136	15.0%
Has the Sept. 22 critical fix, missing the Oct. 6 one	11	1.2%
Missing the Sept. 22 critical fix	38	4.2%

The top two rows are normal. A site that's one release behind on the morning after a release is usually just waiting for its next automatic update. WordPress's documentation says plainly, “By default, automatic updates of WordPress are enabled on most sites.”

The bottom row is the problem. A site that skipped a fix from five weeks ago, and every fix since, most likely has automatic updates switched off or failing. Nobody is coming to patch it.

How We Checked 2,050 Contractor Websites

We ran 128 Google business searches for eight trades (plumbers, HVAC, electricians, garage doors, pest control, roofers, painters and landscapers) in 16 cities, 8 in the US and 8 in Canada. That gave us 2,229 different websites. We asked Google to include businesses that hide their address, since many trades work from home.

We loaded each home page as plain code, without running any scripts, so our visit never fired anyone's analytics. The 282 that didn't answer properly got one more try in a headless browser. 129 showed a bot check, which we logged and did not try to get past. 38 didn't load, and a handful weren't the business's own site. That left 2,050 sites we could read, and 1,223 of them run WordPress.

WordPress usually announces its version in the page code, in a “generator” tag and on some of its own files. Where both showed, they agreed 425 times out of 430. 906 WordPress sites showed a version. 317 hid it, which some security plugins do, so they aren't counted either way.

Then we loaded every one of those 906 home pages a second time with a made-up ending on the address. That gets around most page caches, which can keep serving an old copy of a page for days. 110 sites showed a newer version the second time, so we used the second number. We matched each version to WordPress's own release dates.

What this can't tell you:

• Plugins and themes aren't in this check. They update separately from WordPress itself, and we didn't test them.
• Behind isn't the same as hacked. A missing fix means a known hole is open, not that anyone has used it. Some hosts also block known attacks at their firewall, which we can't see from outside.
• Hidden versions are a blind spot. About 1 in 4 WordPress sites hide the number, and they could be better or worse kept.
• One morning. Sites update all the time, so these numbers will shift.

We haven't named any business.

38 Sites Still Lack the Sept. 22 Critical Fix, Including Companies With 1,000+ Reviews

On Sept. 22, WordPress released version 7.1.2 to fix one bug. Under certain conditions, someone who isn't logged in could make the site load a PHP file from elsewhere on its own server, and the release notes say this “can lead to remote code execution (RCE).” In plain English, that means a stranger running their own code on your website.

The fix wasn't only for the newest version. WordPress says it was “backported to all branches eligible to receive security fixes (currently through 4.7).” Any site set to take automatic security updates got it, even one running a version from years ago.

38 of the 906 sites still don't have it:

• 6 are on the current 7.1 line but stopped updating before Sept. 22.
• 32 are on older versions and missed the backported fix too.
• 11 run a version released in 2025 or earlier. The oldest is 4.5.26, from March 2022, on a line so old WordPress no longer fixes it at all.

This isn't only a small-shop problem. 4 of the 108 sites in our data that belong to companies with 1,000 or more Google reviews are missing the fix. Sites for companies with fewer than 50 reviews did slightly better (3 of 151). Lots of reviews doesn't mean anyone is watching the updates.

We also looked at whether the companies Google showed in its top 3 were any different. Only 2 of 150 top-3 sites were missing the fix, against 36 of 756 for everyone else. That's too few sites to say anything about rankings, so we won't.

Nearly 1 in 5 Run an Older WordPress That Gets Fixes Only as a Courtesy

Being on an older version isn't automatically a problem, but it's worth knowing where you stand. WordPress's security page says, “While only the latest version of WordPress is officially supported, the Security Team also backports fixes to older versions as a courtesy.”

166 of the 906 sites (18.3 percent) run an older line than the current 7.1. Most of them, 134, still picked up the Sept. 22 fix through those courtesy backports. That fits a site set to take security fixes but not big version jumps, which was the default before version 5.6. WordPress's docs say: “Before WordPress 5.6, every site had automatic updates enabled for minor core releases and translation files only by default.”

The catch is that a courtesy isn't a promise. Lines older than 4.7 already get nothing. Canadian sites in our data were more likely to be on an older line: 23.8 percent, against 13.4 percent in the US. So were smaller companies: 21.9 percent of sites for companies with under 50 reviews, against 12.0 percent for those with 1,000 or more.

Check Your Host Too: More Than 1 in 5 Sites That Show PHP Run a Version With No Security Fixes

WordPress runs on a programming language called PHP, and your web host decides which version you get. On Oct. 21, WordPress posted a warning about two critical PHP bugs, and it included this line: “Versions of PHP prior to 8.2 no longer receive security updates from the PHP project.”

Most sites don't say which PHP they run, but 249 of the 1,223 WordPress sites did, in the information their server sends with each page. 56 of those 249 (22.5 percent) run a version older than 8.2, mostly 8.1 (29 sites) and 7.4 (21 sites). Another 60 run 8.2, which, according to PHP's own support schedule, stops getting security fixes on Dec. 31, 2026.

Treat that as a sample, not a census. The sites that announce their PHP version may not look like the ones that don't. But it shows the gap is real, and it's one WordPress auto-updates can't close. Only your host, or whoever manages your hosting, can change it.

How to Check Your Own Site in Two Minutes

If you can log in to your WordPress dashboard:

1. Go to Dashboard, then Updates. It shows your WordPress version, whether a newer one is waiting and whether the site updates itself.
2. Check your PHP version. WordPress says, “Within WordPress, you can see which version of PHP your site runs under Tools > Site Health > Info > Server.” Anything below 8.2 needs a word with your host.
3. Open the Plugins page. Look for update notices, and delete any plugin you don't use. A plugin you've switched off can still sit on the server.
4. Make sure backups run. If an update ever breaks something, a recent backup turns it into a quick fix.

If you can't log in, that's your first problem. Ask whoever built the site for an admin login in your name. We cover the other accounts you should own in our account ownership check.

One warning about checking from the outside: you can find the version by viewing your page's source code and searching for “generator,” but a page cache can show you an old copy. In our data, 110 of the 906 sites (about 1 in 8) showed an older number on the first load than on a fresh, cache-skipping one. The dashboard is the version that counts.

Who Should Be Doing This, and Where We Stand

If you pay someone for hosting or website care, ask them three things in writing: Are WordPress security updates installing automatically? Who checks plugins, and how often? What PHP version are we on? A good web person can answer all three in a minute. If you built the site yourself, the two-minute check above is your monthly job.

You should know where we stand. We don't build websites on WordPress, as our website design page says. So read this knowing we have a horse in the race.

Here's the counter-case, straight from our own numbers. About 4 in 5 WordPress sites we could read a version on had a security fix that came out the day before. For most contractors, WordPress is doing its job. If your site is current, your plugins are up to date and your host runs a supported PHP version, you don't need a new website. You need someone to keep checking. If it's years behind and nobody can log in, that's when a rebuild, on WordPress or anything else, starts to make sense.

For the other half of website security, the padlock in the address bar, see our test of 2,265 contractor sites for HTTPS problems.

Frequently Asked Questions