WordPress security updates: is your site patched?

Your site is patched, meaning protected by the security fix, only once that fix is installed, not when an update email arrives. For WordPress security updates, check the installed version and ask your host (the company that keeps your site online) to confirm the September fix before paying anyone for emergency work.

What changed on 22 September?

On 22 September 2026, WordPress released version 7.1.2 to fix a serious security vulnerability, a weakness attackers could use, and recommended updating immediately. That makes checking your site a job for now, not something to bundle into a future redesign.

The announcement is not evidence that your own site has been hacked. It also doesn't tell you whether your hosting company has already dealt with the fix. A site can look normal while still needing an update.

How to check your WordPress version

Sign in using the WordPress admin address you normally use, rather than following an unexpected update email. Open Dashboard > Updates and look for the installed version. Note the version number and when you checked it, so you have something specific to discuss with your host.

If it shows 7.1.2, you've confirmed that the release containing this fix is installed. That does not prove every part of the website is secure. If it shows a different version, ask your host which release contains the fix for your site and whether that release is installed.

If you cannot see the Updates screen, your account may not have the required access. Don't start changing permissions just to find it. Ask whoever manages the site to check for you.

Ask for the installed version and confirmation that the vulnerability covered by the September release has been addressed. A general reply about security being included in your hosting package doesn't answer that question.

How to update WordPress safely

Start by checking whether your host is already handling the update. If they are, agree who will do it and who will test the site afterwards. You don't want to make changes while someone else is working on the same installation.

Before a manual update, take a fresh backup of the website files and its database, which holds stored content and settings. Confirm that the backup completed and that you know how to restore it. A backup button you have never checked is not much of a recovery plan.

For a site with bookings, payments or custom features, test the update on a separate copy where available. That gives you a way to spot problems without affecting customers. If you don't have that option, ask your host for a safe way to apply the fix promptly rather than leaving it waiting indefinitely.

Use the update offered through the WordPress dashboard or your host's management system. Don't download a supposed security fix from an unsolicited email. Let the update finish, then check the installed version again rather than assuming that clicking the button completed the job.

Now test the things that bring in business. Open the site on your phone, submit an enquiry and check that it reaches the right inbox. If you take bookings or payments, test those through your usual safe testing process too.

For a garage in Livingston, an MOT enquiry reaching the service desk matters more than a green status message. Check the customer confirmation as well as the message received by the garage. A working homepage tells you neither of those things.

Why are WordPress automatic updates not working?

Automatic updates may have been switched off, restricted by hosting settings or stopped by an error. The site might also lack storage space or permission to change its files. Those are things to investigate, not reasons to assume someone has neglected the site.

There is a difference between automatic updates being enabled and an update actually completing. An email saying that an update failed needs attention, but receiving no email doesn't prove success either. Check the installed version and ask the host to look at the update record.

Ask when the last update was attempted, whether it completed and what prevented it if it failed. Your host should be able to investigate without asking you to experiment with unfamiliar settings. If their system handles updates separately, ask when this security fix was applied.

A manual update can close the immediate gap, but it doesn't repair a broken automatic update process. Once the fix is in, have whoever manages it check why the expected update didn't happen. Otherwise the same uncertainty returns with the next release.

What makes a backup useful?

A useful backup is one you can restore, not simply one listed in a hosting dashboard. Check what it contains, when it was taken and who can recover it if you cannot sign in. Ask how you would get access if the hosting account itself became unavailable.

For a salon in Musselburgh that takes online bookings, restoring an older copy could leave recent appointments missing from the website. Before restoring, work out which bookings or enquiries arrived after the backup and where else they were recorded. Restoring the pages is only part of getting back to work.

An older backup may also bring back the software fault you were trying to fix. If a restore is needed, the missing security update still needs to be applied before normal use resumes. Where there are signs of a break-in, get help choosing a clean backup and checking the cause rather than repeatedly restoring the same problem.

When you should not buy emergency security work

A security release alone is not a reason to buy an emergency package or rebuild your website. First check whether your host has already applied the fix. If it is installed and the site checks out, you may have no extra work to buy.

If your existing provider handles updates, keeps recoverable backups and checks that enquiries still work, use that arrangement. You don't need a second company doing the same job because a worrying headline appeared. Carrying on with your normal checks can be the right decision.

A rebuild should address a separate problem, such as a site that no longer supports what your business needs. This release does not establish that problem. Ask anyone proposing a rebuild to explain why applying the fix to the existing site is not enough.

The advice changes if you find unfamiliar administrator accounts, altered pages or visitors being sent somewhere unexpected. Those signs deserve investigation rather than an update followed by an assumption that everything is sorted. Fixing a weakness and removing an intruder are different jobs.

What useful website security looks like

WordPress itself is only part of the site. Plugins are add-ons that provide features such as forms, while the theme controls much of the design. These need their own update checks, so a current WordPress version is not a complete security report.

Access matters too. Check who can administer the website and remove access that is no longer needed. My guide to Cyber Essentials and extra sign-in checks explains another part of protecting the accounts used to manage a business site.

Useful website security means knowing who applies fixes, who checks for failures and who restores the site when something goes wrong. The aim is to keep your site online and taking enquiries, with a recoverable backup rather than a rebuild as the starting point after a bad day.

Keep a simple record of the installed version, the update date and the results of your enquiry or booking tests. Add the backup status and the person responsible for recovery. That gives you something more useful than a vague assurance that everything is covered.

If you can't confirm the fix or who would restore your site, the consultation (opens in a new tab) is free. I'll help you work out whether anything needs doing.