Hosted.com is calling out a problem that sounds boring until it costs a business its entire website: plugins that quietly keep running long after their updates, patches, or support have stopped.
WordPress plugins handle everything from contact forms and ecommerce to SEO and caching, so most sites end up running a handful at once. The trouble starts when a plugin stops receiving updates but keeps running anyway. According to Hosted.com, that is when known vulnerabilities go unpatched, and attackers specifically hunt for sites running older plugin versions because they make easier targets. The consequences range from malware infections and spam redirects to stolen data or a site going completely down.
Poorly coded or unsupported plugins create a second set of problems even without a direct attack. Some grab more permissions than they need, some clash with WordPress core software or other plugins, and the result is broken pages, missing features, or a site that simply loads slowly. For a business relying on that site to bring in customers, a security warning or a broken checkout page does real damage to trust, not just functionality.
“Outdated plugins are a security risk because they are common, visible to attackers, and often preventable,” said Wayne Diamond, Hosted.com’s CEO. He added that while most WordPress sites genuinely need multiple plugins, the real issue is whether anyone is managing them properly.
To address that gap, Hosted.com built several maintenance tools into its WordPress hosting plans. A Smart Update feature applies plugin updates automatically and then compares site pages before and after, so customers can catch anything that broke in the process. Staging environments let site owners test updates on an offline copy first, and the company uses a tool called Patchman to patch outdated WordPress core software separately from plugins. There’s also a one-click security setting aimed at smaller businesses and freelancers who don’t have the technical background to configure hardening settings manually.
Hosted.com’s broader point is straightforward: plugins aren’t inherently risky, but neglected ones are. The company is urging site owners to update regularly, test changes before pushing them live, confirm plugins still have active developer support, and stick to trusted sources when installing anything new.
