Area: Website and certificates

WordPress

With your WordPress site connected (read-only): core version, outdated or abandoned plugins and themes, inactive plugins and administrators.

What it can report

Open each one to see what it means and how to fix it.

Outdated WordPress core

What it means

Your WordPress core is behind the latest release. Older versions keep known holes that newer ones have already fixed.

What could happen

Attackers scan the internet for outdated WordPress sites. An unpatched core is one of the most common ways a site gets taken over.

How an attacker would use it

An automated scanner finds your version, matches it to a public exploit and uploads a backdoor through a known hole in the core.

How to fix it

In the WordPress dashboard, go to Dashboard → Updates and update WordPress.
Take a backup of files and database before updating, if your host doesn't do it for you.
After updating, open the site and the admin area to confirm everything still works.
Turn on automatic updates for minor releases if you can.

How to check it's fixed

Ward reads your site again at each scan. The finding disappears when the core matches a current supported release.

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.

Outdated WordPress plugins

What it means

These plugins have a newer version on WordPress.org. Updates often include security fixes.

What could happen

Outdated plugins are a common way into WordPress sites. Security plugins and ones left behind for months are especially attractive targets.

How an attacker would use it

A known hole in an outdated contact form or security plugin lets an attacker upload a file and take over the site.

How to fix it

In the WordPress dashboard, go to Plugins and update the ones in the list, starting with security-related plugins.
Read the changelog of major updates before applying them on a busy site.
Remove plugins you no longer need instead of leaving them outdated.

How to check it's fixed

Ward compares your plugin versions with WordPress.org at each scan. The finding disappears when every listed plugin is up to date.

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.

Abandoned WordPress plugins

What it means

These plugins are closed on WordPress.org or haven't been updated for more than two years. They no longer get security fixes.

What could happen

An abandoned plugin stays on the server with whatever holes it had. Attackers keep using old exploits against sites that never removed them.

How an attacker would use it

A years-old plugin with a public exploit is still installed. The attacker uses that known hole even though the plugin looks “inactive” in day-to-day use.

How to fix it

Decide whether you still need each plugin in the list.
In the WordPress dashboard, deactivate and delete the ones you can replace or drop.
For any you must keep temporarily, look for a maintained alternative and plan the migration.

How to check it's fixed

Ward checks WordPress.org again at each scan. The finding disappears when abandoned plugins are removed or replaced.

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.

Inactive WordPress plugins

What it means

These plugins are installed but deactivated. They aren't running, but their files are still on the server.

What could happen

Inactive plugins can still be reached if they have a known hole. Leaving them installed is an unnecessary door.

How an attacker would use it

An attacker requests a PHP file from an old inactive plugin and runs code through a hole that was never patched because nobody thought to update a disabled plugin.

How to fix it

In the WordPress dashboard, go to Plugins → Inactive.
Delete every plugin you don't plan to use again.
If you might need one later, note it down and remove it until then.

How to check it's fixed

Ward lists installed plugins at each scan. The finding disappears when inactive plugins are deleted.

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.

Outdated WordPress themes

What it means

These themes have a newer version available. The active theme serves every public page, so its updates matter most.

What could happen

Theme holes can let an attacker inject content or take over the site, especially in the theme that is live.

How an attacker would use it

A known hole in the active theme lets the attacker inject JavaScript into every page or upload a backdoor through a theme file.

How to fix it

In the WordPress dashboard, go to Appearance → Themes and update the ones in the list.
Update the active theme first, after a backup.
Remove themes you don't use, including old default themes you never switch to.

How to check it's fixed

Ward compares theme versions with WordPress.org at each scan. The finding disappears when the listed themes are up to date.

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.

Too many WordPress administrators

What it means

Your WordPress site has more administrator accounts than it needs. Each one can install plugins, change themes and create users.

What could happen

Every administrator is another master key to the site. The more there are, the more chances one password is stolen.

How an attacker would use it

One of several admins who barely uses the dashboard falls for a phishing email. The intruder installs a malicious plugin and takes over the site.

How to fix it

Decide who really needs to be an administrator: two or three people are usually enough.
In the WordPress dashboard, go to Users and change the role of the rest to Editor or Author.
Use strong, unique passwords and, if possible, a security plugin that adds MFA for admins.

How to check it's fixed

Ward lists administrators at each scan. The finding disappears when there are three or fewer.

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.