We hope you would never hire an employee, show them the ropes, and leave them all independently without continually mentoring and training them. Your website is an employee and often the first thing a new customer will see. Continual maintenance, or website employee training, allows you to keep everything humming along as efficiently as possible. Since WordPress has come out, it is averaging more than 27 updates per year and over 60 in the past five years. Plugins or add-ons are not even in this total and produce higher updates, often daily.
WordPress is reasonably secure for an online application that allows an unlimited number of plugins. There are always new exploits malicious people come out with to bring heartache to your business. Updates help solve this by closing known security holes and increasing overall system functionality.
Below is a chart of the number of updates per year (as of 06/08/2021).
| Year | Updates | % of All Updates |
| 2003 | 4 | 0.77% |
| 2004 | 6 | 1.16% |
| 2005 | 7 | 1.35% |
| 2006 | 5 | 0.97% |
| 2007 | 17 | 3.28% |
| 2008 | 9 | 1.74% |
| 2009 | 9 | 1.74% |
| 2010 | 7 | 1.35% |
| 2011 | 10 | 1.93% |
| 2012 | 7 | 1.35% |
| 2013 | 7 | 1.35% |
| 2014 | 16 | 3.09% |
| 2015 | 42 | 8.11% |
| 2016 | 48 | 9.27% |
| 2017 | 95 | 18.34% |
| 2018 | 59 | 11.39% |
| 2019 | 71 | 13.71% |
| 2020 | 64 | 12.36% |
| 2021 | 35 | 6.76% |
| Total | 518 | |
| Average | 27.26 | |
| Average (last five years) | 64.80 |
Plugins are often where the majority of security breaches occur on WordPress. Some are due to a developer not fully understanding the PHP language, security techniques, bad programming, etc. Most software developers take great pride in the work they do. They are human, and mistakes happen as no one is perfect. It is not uncommon for updates to occur on a weekly or more frequent basis. We have seen security updates happen multiple times per day for a single plugin.
According to WP Beginner, in 2019, it is not uncommon for a site to have 20-30 plugins, with the number increasing each year. If you have 20 plugins, you could have 2-3 updates per day, ranging from security fixes to new/improved functionality.
There is a good chance you have a virus scanner and an equally good chance you have a malware scanner on your computer. Your website should have both of these as well. Any files uploaded should go through a virus scanner and a malware scanner. If you do not, you are risking not only your website but your business having a bad first impression.
Google goes through 2-4 "Core Updates" per year. A core update is considered a significant update. Beyond the core updates, Google goes through over 500-600 minor updates per year. This means your website's search engine performance needs to be constantly monitored and adjusted for these needs.
We see all too often businesses doing one backup per month or even no backups ever. A backup should be done daily for the average site and even multiple times per day for bustling websites.
Great you have a backup, but what are you going to do with it? Are you going to blindly trust that the information is accurate and will restore without fail? Or are you going to take time to validate on a test server that the data is good and valid? We're hoping that you will be testing the information that it works. It is never a good feeling that you find the need to restore files or your database, and the data is corrupted and won't work.
A critical factor in providing a good user experience (UX) has an experience that is responsive and quick. The user experience should be intuitive and easily understandable by your visitors, where they do not have to re-learn the internet to navigate your website.