Plugin behind

Why it matters

Plugins are written by thousands of different makers, and holes are found in them every week. The fix comes in a new version. As long as the old one runs, the hole is open, and bots look for it within days.

How Snaglist checks it

This is part of the security check, a separate check next to the crawl, in Studio and Bureau, and only on a site you have verified. Snaglist only looks at what any visitor can see from outside. It never logs in, guesses no passwords and sends no attacks. It recognises plugins by the addresses of their files on the site, reads the version where the site shows it, and compares it with the newest version on wordpress.org. Plugins that are not on wordpress.org cannot be compared.

Common causes

• Updates for plugins are not switched on
• A paid plugin whose licence expired
• A plugin that is no longer used but is still installed

How to fix it

1. Make a backup of the site.
2. Update the plugin.
3. No longer used? Delete it completely. Deactivating is not enough.
4. Switch on automatic updates for plugins you trust.
5. Run the security check again to confirm.

How it shows in the report

In the report for your client this appears under the heading "A plugin is out of date". When everything is in order, the report says: "The visible plugins are up to date".