{"id":102,"date":"2026-10-26T10:06:28","date_gmt":"2026-10-26T09:06:28","guid":{"rendered":"https:\/\/mspbusiness.com\/en\/it-news\/nearly-one-in-three-sme-websites-runs-outdated-software\/"},"modified":"2026-10-26T11:13:05","modified_gmt":"2026-10-26T10:13:05","slug":"nearly-one-in-three-sme-websites-runs-outdated-software","status":"publish","type":"post","link":"https:\/\/mspbusiness.com\/en\/security\/nearly-one-in-three-sme-websites-runs-outdated-software\/","title":{"rendered":"Nearly one in three SME websites runs outdated software"},"content":{"rendered":"

Some 30.5 per cent of websites belonging to Dutch SMEs run outdated software. That is the finding of measurements carried out by web agency Bureau Imago across 1,280 businesses in the days following the disclosure of two critical PHP vulnerabilities on 21 October. Support for PHP 8.2 ends on 31 December. The agency estimates that more than 800,000 Dutch websites will then be running on a PHP version that no longer receives updates.<\/strong><\/p>\n

Bureau Imago, a marketing and web agency based in Utrecht, uses a broad definition of outdated software. It covers a PHP version that no longer receives updates, a WordPress version that WordPress.org classifies as insecure, a plugin that is at least one version behind, or a plugin that has been removed from the WordPress directory for security reasons. For each city and sector, the sample comprises the thirty businesses with the most Google reviews in Utrecht, Amsterdam, Rotterdam, Eindhoven, Groningen and Zwolle.<\/p>\n

WordPress plugins lagging behind<\/h3>\n

Of the SME websites measured, 57 per cent run on WordPress. On 44 per cent of those sites, at least one plugin is one version behind; on 23 per cent, a plugin is a full major version behind. On 4 per cent of the WordPress sites, a plugin is running that WordPress.org has removed for security reasons and for which no further updates will therefore be released. Of the WordPress sites that display their version number, 15 per cent run a version that WordPress.org classifies as insecure.<\/p>\n

Across all sites measured, 8 per cent are visibly running on a PHP version that no longer receives updates. Among the sites that disclose their PHP version, the figure is more than a quarter.<\/p>\n

Differences between sectors<\/h3>\n

In all twelve sectors examined, between a fifth and just over a third of sites run outdated software. The agency measured the highest shares among law firms (36 per cent), roofers (35 per cent), and landscape gardeners and dental practices (both 34 per cent). Restaurants scored lowest at 21 per cent. Each sector comprises between 52 and 126 sites, with a margin of error of around 8 percentage points. The agency itself notes that the results should be read as groups rather than as an exact ranking.<\/p>\n

End of support for PHP 8.2<\/h3>\n

According to WordPress.org data, 59.6 per cent of WordPress installations run on PHP 8.2 or older. By combining that percentage with figures from SIDN, the registry for Dutch .nl domains, and W3Techs, Bureau Imago arrives at an estimate of more than 800,000 Dutch WordPress sites that will be running on PHP without updates from 1 January. Worldwide, the figure would be more than 50 million. These are rounded estimates, not counts. WordPress.org also includes test and backup installations in its figures.<\/p>\n

Security company Patchstack reports that the number of reported vulnerabilities in WordPress plugins and themes rose from 1,382 in 2021 to 11,334 in 2025. According to Patchstack, around half of the severe vulnerabilities are exploited within a day of disclosure.<\/p>\n

Method and limitations<\/h3>\n

The agency requested each site’s homepage once and read the PHP version from the server header. 72 per cent of the sites do not display that version. For WordPress sites, the public readme files of the plugins loaded by the homepage were also requested, an average of four per site. Paid plugins and hidden versions are not included, which means that, according to the agency, the actual share is higher. Nothing was tested or attacked. Bureau Imago adds that outdated software does not automatically mean a site is vulnerable.<\/p>\n

Commercial interest<\/h3>\n

The research is not unconnected to one of the agency’s own services. According to partner Sylvester Bongers, large organisations apply updates on the same day, whereas sites belonging to small business owners are often still in the state in which they were delivered years ago. Bongers says that keeping WordPress, plugins, themes and PHP up to date on older sites often leads to problems. According to the agency, attackers are using AI to find and exploit vulnerabilities more quickly. Bongers believes that rebuilding without WordPress is the better choice for most business owners.<\/p>\n

To that end, Bureau Imago recently launched Resite Now. The service converts an existing WordPress site into a static site without WordPress, plugins or PHP, while retaining the text, photos and web addresses. The company says this is done with AI in a matter of hours, and that a member of staff checks every page before it goes live.<\/p>\n

If you want to check the state of a WordPress site yourself, you can find outdated components under Dashboard, Updates. The PHP version can be found under Tools, Site Health, Info, Server, or in the hosting provider’s customer portal.<\/p>\n","protected":false},"excerpt":{"rendered":"

Bureau Imago measured 1,280 Dutch SME websites: 30.5 per cent run outdated software. Lagging WordPress plugins and the end of PHP 8.2 support demand administrators’ attention.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"mspb_bron_id":1169407,"mspb_url_nl":"https:\/\/mspbusiness.com\/security-en-privacy\/bijna-een-op-de-drie-mkb-websites-draait-verouderde-software\/","mspb_url_de":"https:\/\/mspbusiness.com\/de\/security\/fast-jede-dritte-kmu-website-laeuft-mit-veralteter-software\/","mspb_url_en":"","mspb_beeld_url":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/10\/hero-1793005575540.png","mspb_beeld_klein":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/10\/hero-1793005575540-400x225.png","mspb_auteur":"Redactie","mspb_beeld_alt":"","mspb_video":"","_yoast_wpseo_metadesc":"Bureau Imago examined 1,280 Dutch SME websites: 30.5 per cent run outdated software, partly due to lagging WordPress plugins.","footnotes":""},"categories":[3],"tags":[],"layout":[6],"class_list":["post-102","post","type-post","status-publish","format-standard","hentry","category-security","layout-news"],"_links":{"self":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/102","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/comments?post=102"}],"version-history":[{"count":1,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/102\/revisions"}],"predecessor-version":[{"id":103,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/102\/revisions\/103"}],"wp:attachment":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/media?parent=102"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/categories?post=102"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/tags?post=102"},{"taxonomy":"layout","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/layout?post=102"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}