A component of your site needs updating
We told you that a plugin, theme or application on one of your sites has a known security weakness. Nothing has been placed on your site. Here is what that means and what to do about it.
We watch the applications running on the sites we host. When a plugin, a theme or the application itself is reported to have a publicly known security weakness, and the version on your site is one of the affected ones, we tell you.
This is not the same as harmful code
Nothing has been placed on your site. Nobody has broken in, no file has been added or changed, and your site is working normally.
What we are telling you is that a door is known to be open. Somebody has published a weakness in a version of software you are running, the people who wrote it have usually already released a fixed version, and until you install it the weakness can be used against your site.
If we ever find that something has been placed on your site, you get a different message that says so, and it asks you to change passwords and remove files. This message does not.
Why it still matters
Published weaknesses are the most common way a site is broken into. The advisory is public, so automated tools start looking for affected versions within days — and they do not pick their targets, they scan everything. Most of the compromised sites we see were running a component with a fix available.
What to do, in order
- Update the component we named. Sign in to your site's administration area, find it in the plugins or themes list, and install the latest version. This is usually the whole job.
- Update everything else while you are there. Every plugin, every theme, and the application itself — including the ones you do not use. An inactive plugin can still be exploited, because the files are still on the server.
- Delete what you no longer use. An abandoned plugin that nobody updates is a permanent open door. Deactivating is not enough; remove it.
- Turn on automatic updates for plugins and themes, so the next one is closed before you hear about it.
- Take a backup before a large update, and if an update breaks the site, restore it and open a ticket — do not put the old version back and leave it there.
What if there is no update yet?
Occasionally a weakness is published before a fix exists. In that case, remove or deactivate the component until the fix arrives if you can manage without it, and open a ticket if you cannot — there are often other ways to close the specific gap in the meantime.
We can do it for you
If you would rather not touch your site's administration area, open a ticket from the Support section of your dashboard and say so. Updating components on a site we host is something we are happy to do.