WordPress Security Updates End for Versions 3.7 to 4.0

WordPress has warned users that it will stop providing security updates for versions 3.7 through 4.0 as of December 2022, and it advises everyone to move to the latest release. What does that really mean for your site? Here’s our breakdown of the announcement and what you can do about it.

WordPress, an Everyday Business Tool

WordPress is the most widely used content management system (CMS) in the world, powering more than 40% of all websites.

That popularity shows how capable the platform is. WordPress makes it easy to build professional business websites, publish content, and grow the online visibility of businesses, local shops, blogs, and more.

So what does this announcement mean, and how does it affect your site?

Outdated Sites: WordPress Shakes Things Up

In September, WordPress announced that versions 3.7 through 4.0 will no longer receive security updates starting December 1, 2022.

Anyone still running these outdated versions will leave their site more exposed to hacking after that date. Learn the warning signs of a hacked WordPress site.

The reason given is organizational. By setting aside the oldest versions, the team can focus on current releases instead of spending extra effort maintaining very old ones.

Here’s how WordPress explained it. Officially, only the latest version of WordPress is supported. Historically, the security team has backported security fixes to older versions as a courtesy, in the hope that those sites will update automatically, and so far those backports have covered every version that supports automatic updates.

Versions 3.7 through 4.0 now account for less than 1% of all installations, a level at which the benefit of providing those updates is outweighed by the effort required. By dropping support for these old versions, WordPress says, newer versions will become more secure, because more time can be spent on their needs.

Which Version Should Affected Sites Update To?

The obvious questions: who is affected, and if you are, which update should you choose?

Affected sites will display a permanent notice in the dashboard and should be updated quickly.

WordPress advises site owners to update to the latest release, currently version 6.0.2.

That said, WordPress will continue to provide security backports for version 4.1, released in December 2014, and later.

In theory, owners of older sites could move to version 4.1 to avoid introducing instability caused by old themes, plugins, or PHP versions.

But WordPress doesn’t recommend it: security fixes are backported to older versions, but hardening improvements are not.

Security updates are patches designed to block specific critical vulnerabilities. Hardening means improving the code itself to make it more secure.

Is Updating WordPress Risky for My Site?

That’s the question everyone is asking. If you jump from version 3.7 to 6.0.2, how will your site react?

Some argue that requiring users of old versions to update to the latest release is risky, because it could leave them with a broken website.

One commenter pointed out that skipping eight years of releases in one go is a risky move, and that offering only this option may discourage many site owners from updating at all. In their words, the choice becomes: press the button and hope eight years of updates don’t break anything, or leave the version that has worked so far and hope for the best.

It’s a dilemma with downsides either way: keep the outdated version and risk a hack, or update and risk a broken design or slower performance. It’s a classic case of being caught between a rock and a hard place.

But remember: according to WordPress statistics, the old versions affected by this decision account for less than 1% of all installations. So the change shouldn’t affect many users of the popular CMS.

Our Team’s Advice

If you own a website, this news may raise questions and doubts, and that’s perfectly normal. Your website is a business tool, a digital storefront, a shop, or an information hub. In short, it’s part of your daily operations, and it deserves care.

We work with WordPress a lot. It’s a capable platform that can meet many different needs across industries. For local businesses and freelancers, it’s an accessible, intuitive tool for getting online. As a business grows, WordPress can scale up to meet the needs of larger companies. It’s a platform that can grow with you.

But to keep a site fast and secure, you need to update it regularly, just like your phone or computer, and take a full backup before any big jump (see our WordPress backup strategy guide). Our guide on how to update WordPress safely walks through the process, and how to secure a WordPress site covers PHP versions and more.

Where Things Stand in 2026

WordPress went a step further in July 2025, when it stopped providing security updates for versions 4.1 through 4.6. Officially, only the latest version is supported, so the safest choice is still to run the current release, along with up-to-date plugins and themes (see how to deal with vulnerable WordPress plugins).

Questions About Your WordPress Site?

Référenceur is a French-speaking digital marketing agency from Belgium and Luxembourg that builds and maintains WordPress sites and works with U.S. businesses remotely, through video calls, shared screens, and monthly reporting. If you have questions about your site’s health, security, or WordPress version, get a free assessment. If your site has already been compromised, see our hacked WordPress site repair service.