In reply to Tim Baker.

I had WP for 15+ years. I am subscribed to WPTavern newsletter, about 100 WordPress universes people, WordPress itself. So I know I don’t need to worry about delayed updates.
I also use Wordfence that tells me if anything has an update.
Also, I log in every day around 9am.

I used to say that I would have no plugins that have not been updated a year or longer, now it’s 6 months. If it hasn’t been updated in 6 months or longer…I get a replacement.

Unlike the average person, I do install plugins and go through the settings. I have 2fa. I change all my passwords around every 6 months. I don’t use admin. My password is a mix of upper and lower case letters with symbols. The password is over 25 characters. I have a password manager. I have 2fa on all my online accounts including hosting and domain registrar.

Relying on auto-updates, makes people lazy. Look at this update, the previous one broke things for people.

WordPress itself is not the issue, it’s crappy coded plugins. So many abandoned plugins, I think the oldest I have seen was 5-6 years since last update. There is no reason to have that on the repository.

Heck, I am so good at updates that I updated to WordPress 6.2.2. BEFORE the WPTavern article came.

Also, obviously if I have let’s say akismet on my main website, if I have let’s say 7 other websites and they have akismet, I will be updating those websites as well.