What an Outdated WordPress or Joomla Site Costs: Security, SEO and Lost Leads

An outdated website costs you in three ways. Attackers have an easier time getting in, search engines and AI assistants trust the site less, and visitors who wanted to contact you leave without doing it. None of these shows up as an invoice, and because the site keeps loading and looks fine, fixing it keeps getting put off.

This autumn we ran technical health checks on 29 small and mid-sized business websites, most of them WordPress, two on Joomla and one on Drupal. The results below come from those checks. We left out client names, but every number is from a real site.

What counts as an "outdated" website?

A website is outdated when any layer it runs on no longer gets security fixes, and that covers more than the design. There are four layers to check:

• The CMS core. Joomla 3 stopped getting free security fixes on 17 August 2023, and its paid extended support ended in February 2025. Joomla 4 lost security support in October 2025.
• The PHP version underneath. PHP 7.4 and 8.0 have been unsupported for years. PHP 8.1 lost security support on 31 December 2025, and PHP 8.2 loses it on 31 December 2026, two months from now.
• Plugins, extensions and themes. This is where most WordPress vulnerabilities live. Patchstack's 2026 report counted more than 11,000 new vulnerabilities in the WordPress ecosystem in 2025, and the large majority of them were in plugins.
• The server configuration. That means TLS versions, security headers, and what the server reveals about itself.

A site can have a fresh design and still run on an unsupported stack, and an old-looking site can be perfectly safe.

What we found in 29 website health checks

Two of the 29 sites weren't reachable during the check. One had been down for months behind a certificate that expired more than a year earlier. On the other 27, this is what came up:

• 27 of 27 were missing some or all of the standard browser security headers (HSTS, X-Content-Type-Options, X-Frame-Options, Content-Security-Policy).
• 11 still accepted TLS 1.0 and 1.1, encryption protocols that browsers dropped years ago.
• Most told any visitor exactly which software versions they ran, through a generator tag, a readme file or a server header.
• 5 ran an end-of-life CMS or PHP version: two Joomla 3 sites, one on PHP 7.4, one on PHP 8.1 and one on a WordPress branch several major versions behind. A sixth ran a WooCommerce version several years old.
• 4 let anyone list the site's admin usernames through the WordPress REST API.
• 3 had certificate or domain setups that showed some visitors a browser security warning.
• 3 were showing a "Coming Soon" placeholder on the main domain, while a working site sat on a full install behind it.

None of the problems was exotic, and most are the kind that pile up when nobody revisits a site after launch.

The security cost of an outdated site

Most attacks on small business sites are automated. Bots scan millions of domains, read the version numbers sites advertise, and try known exploits for those versions. A site that publishes "Joomla 3.10" or "PHP 7.4" in its headers has told the scanner which exploits to try first.

On an unsupported stack, newly found vulnerabilities never get fixed. Joomla 3 has had no official security release since its extended support ended, so a flaw disclosed next month will stay open on every Joomla 3 site for good. Patchstack also reports that close to half of the vulnerabilities it tracked had no patch available when they were disclosed. Even well-maintained sites go through exposure windows, and on a neglected site those windows never close.

The fallout is usually boring and expensive. Spam pages get injected into your domain, your server is used to send phishing email, customer form data leaks, or the hosting provider suspends the account. Cleaning up a compromised site almost always costs more than keeping it updated would have, and that's before the time lost and the awkward emails to customers.

The username and header problems are cheap to fix

Some of the findings above take minutes to fix. Closing the WordPress user endpoint, hiding version banners, adding security headers and turning off old TLS versions are all short configuration changes. If a site still has all of these problems, nobody has been looking after it.

The SEO cost: how rankings slip

Google doesn't rank a site lower because of its PHP version, but it does react to the problems that tend to come with an old, unattended stack.

• Certificate warnings. If part of your traffic hits a "Your connection is not private" screen, those visits bounce immediately. Google treats HTTPS as a ranking signal, and a broken certificate setup undercuts it.
• Wrong canonical and sitemap URLs. In two of the sites we checked, the canonical tags and the XML sitemap pointed at a temporary server hostname instead of the real domain. That tells Google to index the wrong address, so rankings can end up on a URL nobody should ever see.
• Broken sitemaps. Several sites had a sitemap.xml that redirected to a 404 page, so search engines had to discover new pages on their own.
• Slow, plugin-heavy pages. Old themes and outdated plugins tend to load scripts on every page. That shows up in Core Web Vitals and in mobile rankings.

The same signals matter for AI search. ChatGPT, Perplexity and Google's AI Overviews pull from pages they can crawl cleanly and trust. A site that throws certificate errors or has its canonical tags pointing somewhere else is a weak source to cite. We cover the difference between the two kinds of visibility in our GEO vs SEO guide.

Lost leads that analytics never records

In our experience this is the cost business owners underestimate most, because analytics doesn't show it. A visitor who never got through left no trace.

Three examples from the checks:

1. A contact link pointing to another company. One homepage showed the right email address on screen, but the link behind it went to an address on a completely different company's domain, left over from a copied template. Anyone who clicked "email us" was writing to the wrong business.
2. A finished site nobody could find. One client had a complete new website live on a subdomain, while the main domain had shown a "Coming Soon" page for more than a year. Search traffic, ad clicks and business cards all led to the placeholder.
3. A security warning on the front door. On the sites with certificate problems, a visitor typing the www version of the address got a full-page browser warning. Most people close the tab at that point, and few come back to try another address.

None of these showed up as an error in the site owner's dashboard, yet each one was costing them enquiries.

How to check your own site in 15 minutes

You don't need to be technical to run a first pass:

1. Open your site with and without "www", over http and https. All four should land on the same secure address with no warning.
2. Check your CMS version. In WordPress it's under Dashboard > Updates. In Joomla it's on the System Information page. If you're on Joomla 3 or 4, or WordPress hasn't been updated this year, flag it.
3. Ask your host which PHP version you run. Anything below 8.2 is already unsupported, and version 8.2 runs out at the end of this year.
4. Run your domain through a free header scanner such as securityheaders.com. A grade of D or F means the basics are missing.
5. Click every contact button and submit your own form. Confirm the email arrives where it should.
6. Open yoursite.com/sitemap.xml. It should load a list of your pages instead of a 404.

If more than two of these fail, a plugin update won't cover it and the site needs a proper review.

Update, harden or rebuild?

Not every outdated site needs a rebuild. Here's roughly how we decide:

• Harden and update when the CMS is still supported and the problems are configuration: headers, TLS, version exposure, plugin updates. This is usually a few hours of work.
• Migrate when the CMS or PHP version is end-of-life but the design and content still work. Moving a Joomla 3 site to a supported version, or a WordPress site to a current PHP release, often means replacing extensions that were never updated.
• Rebuild when the migration would touch nearly every template and plugin anyway, or when the site no longer reflects the business. Our breakdown of what drives website cost explains what that decision usually involves.

Our view is that maintenance is the cheaper option almost every time. Most of the findings above are an afternoon of work while the site is still supported, and a full migration once it isn't.

Frequently asked questions

Is an outdated WordPress site a security risk if nothing has happened yet?

Yes. Automated bots look for known vulnerable versions, and they don't need to target you on purpose. Not having been attacked yet only means the site hasn't been picked up by a scan that matched it.

Can I stay on Joomla 3 if I keep my extensions updated?

Not safely. The Joomla 3 core has had no official security releases since extended support ended in February 2025, and most extension developers have dropped Joomla 3 too. Updated extensions can't make up for a core that no longer gets fixes.

Does an old PHP version hurt my Google rankings?

Not directly. Older PHP versions are slower, though, and the plugins and themes that rely on them are often heavy and unmaintained. You feel it in page speed, in Core Web Vitals and in security incidents, all of which do affect rankings.

How often should a business website be checked?

Updates should happen monthly at minimum, and security updates as soon as they're released. A full technical health check, covering certificates, headers, redirects, sitemaps and forms, is worth doing at least twice a year and after any major change.

Where we come in

Ruler builds and maintains business websites, and we run the same health checks described here on the sites we look after. If you're not sure what's running under your website, or you suspect it's been a while since anyone checked, our web team can review it and tell you plainly whether it needs updating, hardening or a rebuild. You can get in touch here.