End-of-life software & why it's risky

What "end of life" means for website software, why it's a serious security risk, and what to do about it.

Software doesn't last forever. When the company or community behind a piece of software stops supporting it, that software reaches what's called "end of life." Using end-of-life software on your website is one of the most serious risks you can take. This guide explains why — and what we do about it.

Quick summary

End-of-life software no longer receives security updates. That means known vulnerabilities stay permanently open. Attackers actively target sites running end-of-life software. When we identify end-of-life components on your site, we'll recommend an upgrade path and help you prioritize it.

What "end of life" means

Every piece of software — WordPress, PHP, a plugin, a theme — is maintained by developers: sometimes a company, sometimes a community, sometimes one person. Those developers release updates: bug fixes, new features, and importantly, security patches (fixes for newly discovered vulnerabilities).

"End of life" (often abbreviated EOL) means the developers have officially stopped maintaining that software. No more updates. No more security patches. Any vulnerabilities discovered from that point forward will never be fixed.

Permanently open doors

A vulnerability in end-of-life software is like a permanently unlocked door. Security researchers and hackers discover new vulnerabilities all the time. On supported software, those holes get patched. On end-of-life software, they stay open forever.

Common examples of end-of-life software on websites

Software	What goes EOL	Risk if outdated
PHP	Versions become EOL on a published schedule	Server-level vulnerability; sites can be compromised at a deep level
WordPress core	Older versions (only the latest version is officially supported)	Core platform vulnerabilities; WordPress backports security fixes to older versions as a courtesy, not as a promise
Plugins	Abandoned or deprecated plugins	Each new vulnerability is permanent; often targeted by automated attacks
Themes	Abandoned themes	Design and code vulnerabilities; no fixes available
Third-party integrations	APIs and services that close down	Broken functionality; potential security gaps

Why attackers target end-of-life software

When a security researcher finds a vulnerability in a plugin, responsible practice is to tell the developer privately first, so a fix can be released before the details become public. On supported software, the developer can then ship that fix.

With end-of-life software, that patch never comes. Once the details of the vulnerability are public, every site still running that software is much more open to attack.

Most attacks aren't aimed at anyone in particular. Attackers use automated tools that probe huge numbers of websites, looking for known weaknesses such as specific outdated versions. Being a small business doesn't protect you. The tools don't care.

How we handle end-of-life risks

We track software versions. We monitor the WordPress, plugin, and theme versions on your site and compare them against published EOL timelines, where the developer publishes one.

We alert you early. When software on your site is approaching end of life, we notify you and discuss options before it becomes an emergency.

We recommend an upgrade path. For each EOL component, we'll recommend the right action — whether that's an upgrade, a replacement, or in rare cases, an architectural change.

We prioritize critical risks. If something is already end-of-life and actively vulnerable, we'll recommend treating it as urgent.

What upgrading involves

Upgrading end-of-life software isn't always as simple as clicking a button. In some cases:

A plugin with no equivalent replacement needs to be rebuilt
A PHP version upgrade requires testing that your theme and plugins support the new version
An old theme may need to be replaced entirely

These can be small or substantial projects. We'll give you a clear picture of the work involved and help you plan accordingly.

Staying current is usually far cheaper than recovering from a security incident caused by outdated software.

Common questions

How do I know if my site is running end-of-life software?

We check this as part of your care plan. If you're not on a care plan, contact us for a site audit — we'll review your software stack and flag anything at risk.

My site looks fine — does it matter if software is outdated?

Yes. End-of-life software rarely causes visible problems until it's exploited. A site can run on a vulnerable old plugin for months before being hacked. Looking fine is not the same as being safe.

What's the difference between an outdated plugin and an end-of-life plugin?

An outdated plugin has updates available that you haven't applied yet. That's fixable — we apply the updates. An end-of-life plugin has no more updates at all. No amount of waiting will fix a vulnerability in it. It needs to be replaced.

PHP version — what is that?

PHP is one of the programming languages WordPress is built on. Your hosting server runs a specific version of PHP. Older versions of PHP stop receiving security updates on a published schedule. We coordinate PHP upgrades with your host as part of your care plan — see Software updates explained.

Need a hand?

If you're stuck, email support@chykalophia.com and we'll help. Include your website address and a screenshot if you can.