02 / The WordPress treadmill
Hours on plugins. Minutes on pages that earn.
Every hour on updates is an hour not spent on the page losing clicks. Opportunity cost is the real WordPress bill.
PluginsEvery plugin is another update — and another way a page can break.Unused plugins should be deleted. Quality varies. One bad update can take down a money page.
SecurityMost holes are in plugins, not WordPress itself.In 2025, 91% of new WordPress security holes were in plugins. Nearly half had no patch the day they went public. Paid plugins were not safer — 76% of those holes were exploitable.
ThemesA routine update can quietly break the front end.Core, theme, and plugins are built by different teams. One change can collapse a layout — which is why a staging pass is part of the job, every time.
UpkeepClicking Update on every site is the job that never ends.At a hundred sites, almost half of agencies still update plugins one site at a time, by hand.
The loginA one-word fix still starts at a login screen.wp-admin is a common attack target. Official docs say add 2FA via a plugin — another plugin — because core does not ship it.
Broken linksOld URLs break after every plugin or theme change.A permalink change means remapping every link that pointed to the old address.
The editorMillions of sites still install the old editor on purpose.The default editor changed. Slugs, layouts, and links sit on top of the same plugin stack.
UnpushedUnpushed moves you off the treadmill once. After that, the work is the page — previewed, approved, and checked — so upkeep stops stealing from growth.