Research · October 2026
We checked 583 UK business websites. 199 run software WordPress lists as insecure.
We audited the public websites of established UK companies that run an out-of-date WordPress release. The median company reports 37 staff in its latest accounts at Companies House.
UK company websites on a WordPress release at least a year old
run a version WordPress.org itself lists as insecure
run a release line that came out four or more years ago. The oldest dates from June 2012.
failed a standard security certificate check, which can make browsers warn visitors away
When their WordPress came out
Most of these sites run a release from the last three years, and WordPress.org already lists more than a quarter of those as insecure. Every site on a release from before 2017 runs an insecure version, apart from one.
| Line from | Sites | Insecure |
|---|---|---|
| 2012 | 2 | 2 |
| 2013 | 1 | 1 |
| 2014 | 1 | 1 |
| 2015 | 9 | 9 |
| 2016 | 11 | 10 |
| 2017 | 25 | 19 |
| 2018 | 4 | 3 |
| 2019 | 23 | 13 |
| 2020 | 30 | 7 |
| 2021 | 27 | 6 |
| 2022 | 60 | 20 |
| 2023 | 77 | 21 |
| 2024 | 132 | 39 |
| 2025 | 181 | 48 |
| Total | 583 | 199 |
What this means if one of them is yours
An insecure WordPress version has published security holes that will never be fixed in that version. Automated scanners look for exactly these, and a compromised site is usually used to send spam or host malware under your domain before anyone notices. Google can then mark the site as dangerous in search results.
The usual fix is a maintenance contract that keeps WordPress, the theme and every plugin patched, for as long as the site exists. The other fix is to stop running software on your website at all. A site built as plain pages has no versions to fall behind on.
Think your site was one of the 583? We don't publish the list. Send us your address and we'll tell you what we found, and what we'd do about it.
How we checked
Chose the companies
Accounts filed at Companies House by UK companies with turnover of roughly £0.75m to £7.5m, or 10 to 50 staff where no turnover was filed, plus three published growth lists.
Found each website
We kept a site only if it showed the company's registration number or registered name and address, or if a published list linked to it.
Read it as a visitor would
We fetched each homepage and its news feed and read the WordPress version the site announces.
Compared with WordPress.org
We looked up each version in WordPress.org's version-check service and dated each release line from its release archive.
Checked the certificate
We noted each site whose security certificate failed a standard check.
Notes on the sample
We chose sites that looked out of date, so these figures describe these 583 sites and not UK websites in general. Sites that hide their WordPress version couldn't be checked and aren't counted. We checked the WordPress version only, not plugins, themes or server software, so the real number of exposed sites is higher than 199, not lower. Results are as of October 12 and 13, 2026.
Want the same check on your site?
Send us your web address. We'll run the same checks and reply within one working day.