Outdated or unsupported components deserve a maintenance review; age alone does not establish a vulnerability.
Watch for
White screens after updates, broken forms, mixed HTTP assets, and no known backup restore test.
Next step
Use incidents to define the right care plan
Use the following worksheet to turn this article into an operating decision. It is a practical plan for a Bangladesh small business, not a claim about a particular client or an industry benchmark. Adapt it to your current workflow and constraints.
-
List recent form failures, update conflicts and recovery gaps. Plugin age alone does not prove a site is vulnerable.
-
Decide which checks are scheduled and which incidents trigger urgent response. Ask how the supplier records findings and completed actions.
-
Run a monthly review of renewals, form delivery and restore readiness. Escalate repeated failures to a root-cause fix rather than paying for the same temporary repair.
Write this before requesting proposals
Describe the current process, the failing step, the intended users and what a correct outcome looks like. Prepare representative test data so suppliers can demonstrate the same task. Ask separately about recurring costs, third-party dependencies and work excluded from support.
When to change the plan
Resolve missing access, failed acceptance checks or unclear team ownership before paying for the next stage. Use evidence from a small pilot. If scope grows, agree revised time and costs rather than relying on unsupported guarantees.