Are my WordPress plugins out of date?

Updated 2026-10-16

Short answer: out-of-date plugins are the most common way WordPress sites get broken into, because once a plugin's security hole is published, scanners look for every site still running the old version. Your plugin versions are often visible from outside your site, so if you can see them, so can they.

How to check it yourself

  1. Log in to WordPress, open Dashboard, then Updates, and look for core, plugin and theme updates.
  2. Open Plugins and look for "There is a new version available" under each one.
  3. Delete plugins you don't use, rather than just deactivating them.
  4. Turn on automatic updates for plugins you trust, and check the site after updates run.

What Preventionlabs shows

For WordPress sites, every report checks from outside, without logging in, the WordPress version against the latest release and the plugins whose versions it can see against their latest versions, and lists the out-of-date ones. It also checks whether xmlrpc is open and whether user accounts are listed publicly.

It only sees plugins that show their version from outside, so the Dashboard check above is still the complete list.

Price

First report free, no card needed. Then A$50 a month, up to 10 domains.

Run your first report free

More questions it answers