How Long Does WordPress Support Older Versions Before EOL?
WordPress's Actual Security Support Policy
Unlike many software products with a hard end-of-life cutoff after which no further security patches are issued, WordPress core has a track record of backporting critical security fixes even to quite old major versions, reflecting the platform's scale and the real-world consequences of leaving millions of old installations completely unpatched. This is genuinely reassuring compared to harder EOL policies elsewhere, but it doesn't mean staying on an old version indefinitely is actually a good idea.
Why Staying Current Still Matters
- Plugin and theme developers don't maintain the same long-tail support commitment core does — most stop testing against or supporting WordPress versions more than a release or two behind current, meaning compatibility risk grows even if core itself remains technically patched.
- New features and performance improvements only ship in current versions, so an old install misses out on meaningful capability, not just security patches.
- PHP version requirements tend to rise over time alongside WordPress versions, and hosting providers eventually deprecate old PHP versions regardless of what WordPress itself requires, forcing an update conversation either way.
- A very outdated combination of WordPress, PHP, and plugins becomes progressively harder and riskier to update in one large jump, compared to staying reasonably current with smaller, more manageable updates along the way.
A Reasonable Approach
- Don't panic about running slightly behind current, given WordPress core's strong security patching track record.
- Don't let updates lapse indefinitely either, since plugin compatibility and available features both erode over time.
- Keep a regular update cadence, tested on staging first, rather than either updating blindly or avoiding updates entirely.
Running a significantly outdated WordPress site and need a safe path forward? See WordPress bug fix.