Security · fix guide

How to update outdated website software

Old jQuery, an unsupported WordPress version and leftover Flash are easy for attackers and browsers alike to spot. Here's how to find where each comes from and update or replace it without breaking the site.

Published October 22, 2026Updated October 22, 2026By Remidiy

Short answer: update the software your site runs on to a version that still gets security fixes. For WordPress that means the current release (7.1 as of October 2026). For jQuery it means the latest 3.x at the very least, or 4.x. Flash can't be updated at all: it has to be replaced with HTML, video or an image.

Back up first, update on a copy of the site if your host offers staging, and test your forms, menus and booking widget afterwards. Old core software usually sits on old PHP too, so check that as well (below).

Outdated software is one of the easiest things for an attacker to find. Version numbers appear in your page source, and automated scanners match them against public lists of known flaws. Each section below matches a finding from the website checker.

The site loads jQuery 1 or 2

Fix soon Shown in the checker's Security tab as “jQuery 1.12” (or whichever version it found).

jQuery is a JavaScript library that many themes and plugins use for menus, sliders and forms. The checker flags it when your page loads a jQuery file whose name carries a version below 3, such as jquery-1.12.4.min.js or jquery-2.2.4.js. Files without a version in the name, like the copy WordPress ships in wp-includes, aren't read. So no finding doesn't prove every copy on the site is current.

Why it matters

The jQuery team supports only the latest version: the 1.x and 2.x branches get no fixes, and 3.x receives only critical security patches (jQuery: version support). Several cross-site scripting flaws were fixed only in 3.x; jQuery 3.5.0, for example, was mainly a security release (jQuery blog). An old copy also tends to mean the theme or plugin that bundled it hasn't been updated either.

How to fix it

WordPress

View the page source (Ctrl+U), search for jquery, and look at the path of the old file. /wp-content/themes/name/ or /wp-content/plugins/name/ tells you which theme or plugin loads it. Update that theme or plugin. If it has no update, it's abandoned: replace it. Don't just block the old file, because whatever depends on it will break.

Hand-built or older custom sites

Replace the old <script> line with the current release from jquery.com/download.
Load the jQuery Migrate plugin temporarily. It restores removed features and logs a console warning for each one the site uses.
Fix each warning using the jQuery upgrade guides (3.0 and 4.0 cover most changes), then remove Migrate.

How to check it's fixed

Search the page source for jquery again, then click through the menus, sliders, galleries and forms with the browser console open (F12). Run the checker again to confirm the finding has gone.

WordPress is out of date

Fix soon Shown in the checker's Security tab as “WordPress 5.8” (or whichever version it found).

WordPress adds a <meta name="generator"> tag naming its version to every page. The checker flags it when that tag shows WordPress 5 or older. A 6.x or 7.x version is listed as a fact rather than a problem.

Why it matters

Only the latest version of WordPress is officially supported. The security team backports critical fixes to older branches “as a courtesy” (WordPress security), but its releases page says only the most recent 7.1 release is “safe to use and actively maintained” (WordPress releases). Even with courtesy fixes, current plugins and themes stop supporting old cores, so their own security updates stop installing. Old WordPress is also usually running on an old PHP version.

How to fix it

Back up the files and the database. Use your host's backup tool, or a backup plugin that stores copies off the server. Use your host's staging copy if it has one.
Check PHP. WordPress recommends PHP 8.3 or newer (requirements). Find yours with these four methods and update it if needed.
Update plugins and the theme under Dashboard → Updates, then update WordPress on the same screen (Updating WordPress). A jump from 5.x usually goes straight to the current version, as long as your PHP meets its minimum.
Test the pages that earn you money: contact form, booking, checkout, menus.
Turn on automatic updates for WordPress on the Updates screen, and for each plugin you trust on the Plugins screen (automatic updates).

If a plugin or theme breaks on the new version and has no update, it's abandoned and needs replacing. Hiding the generator tag doesn't fix anything; it only hides the version.

How to check it's fixed

Dashboard → Updates should say you have the latest version, and the checker should list the new version under its facts.

The page still uses Flash

Fix soon Shown in the checker's Security tab as “Uses Flash”.

The checker flags any reference to a .swf file or the application/x-shockwave-flash type in your page's HTML.

Why it matters

Adobe ended Flash Player at the end of 2020, and browsers removed it; Chrome did so in version 88, in January 2021 (Chromium Flash roadmap). Whatever the Flash element showed, whether an intro, a video, a menu or a gallery, is now a blank box for every visitor. If it was your navigation, search engines can't follow it either.

How to fix it

Video: convert it to MP4 and use an HTML <video> tag, or upload it to YouTube or Vimeo and embed that.
Animation, banner or intro: replace it with a still image or a simple HTML and CSS version. Most intros can just go.
Menu or gallery: rebuild it as ordinary HTML links and images, which also helps search.
Content worth keeping as-is (an old game or interactive piece): the open-source Ruffle emulator plays many .swf files in modern browsers.

Then delete the leftover <object> and <embed> tags. A site old enough to use Flash usually needs more than this one fix; the maintenance checklist covers the rest.

How to check it's fixed

Search the page source for .swf and shockwave; neither should appear.

Outdated PHP

PHP is the language WordPress and most shared-hosting sites run on. Unlike jQuery, it's a server setting, not part of your page. It only shows up when the server announces its version in a header (see hide your server version). PHP branches older than 8.2 no longer receive security fixes, and 8.2 itself stops on 31 December 2026 (php.net supported versions). Older and unpatched versions are also exposed to the PHP2Shell flaw.

Run the PHP vulnerability checker to see whether your site is affected. Then read PHP2Shell explained for the fixed versions and the steps for cPanel, GoDaddy and WordPress.

Sources

jQuery: version support
jQuery upgrade guides and jQuery Migrate
WordPress.org: security (only the latest version is supported)
WordPress.org: releases
WordPress.org: Updating WordPress
Chromium: Flash roadmap
php.net: supported versions

Common questions

Is it safe to run an old version of WordPress?

No. Only the latest release is officially supported; older branches get critical fixes only as a courtesy, and current plugins and themes stop supporting old cores. Back up, then update from Dashboard → Updates.

How do I find out which version of jQuery my site uses?

View the page source and search for “jquery”: the file name or a ?ver= number usually shows it. In the browser console (F12) you can also type jQuery.fn.jquery and press Enter.

Will updating jQuery break my site?

It can, if old code relies on features that were removed. Load the jQuery Migrate plugin while you test: it logs each problem in the console so you can fix them, then remove it.

Can I still play Flash content on my website?

Not with Flash Player; browsers removed it in early 2021. Convert videos to MP4, rebuild menus and galleries in HTML, and use the open-source Ruffle emulator only for content you can't recreate.

Should I update plugins or WordPress first?

Back up first, then update plugins and the theme, then WordPress itself, and test after each step. If something breaks you'll know which update caused it.

How do I check whether my PHP version is outdated?

Use the PHP vulnerability checker or the methods in What PHP version is my site running?. PHP older than 8.2 no longer gets security fixes.

Find what else is out of date. The website checker reports old libraries, CMS versions and server software along with security, speed and SEO. For PHP specifically, use the PHP vulnerability checker. Keeping all of this current is part of our website maintenance if you'd rather not do it yourself.