"I'll update it next month" is one of the more expensive sentences in WordPress. Not because updates are risky — because not updating is riskier, and the gap between the two usually isn't visible until something goes wrong.
Vulnerabilities are public the moment a patch ships
When a plugin author fixes a security issue, the changelog and the diff are public. That means anyone looking for targets can see exactly what was broken in the previous version — and exactly which sites haven't updated yet. Delaying an update doesn't buy safety, it buys a longer window for someone else to notice.
Automated scanners don't care how small your site is
Most attacks on WordPress sites aren't a person manually targeting your brand. They're bots scanning thousands of sites for a specific known vulnerability, then exploiting whichever ones haven't patched it. "We're too small to be a target" doesn't hold up against that kind of automation.
Nobody hacks your site because they hate your brand. They hack it because a scanner found an open door.
Small, frequent updates are safer than big, rare ones
Updating one plugin at a time, weekly, means if something does conflict with your theme or another plugin, it's easy to isolate and fix. Updating twelve plugins at once after months of delay makes it much harder to tell what broke what — which is exactly why sites that skip updates for a long stretch often stay unpatched even longer, out of fear of what might happen when they finally do it.
What we actually do every week
On every maintenance plan, updates go out on a set schedule: applied on a staging copy first, checked against the live theme and key pages, then pushed to production during low-traffic hours. If anything looks off, it gets rolled back and flagged before it ever reaches your visitors.
It's not glamorous work. It's also the single biggest reason the sites we manage don't end up needing the more expensive kind of help — the kind that starts with "we've been hacked."