17% of Accounting Firm Websites Run Outdated Software vs 4.7% of Restaurant Websites

A client needs to upload last year's tax documents, so they open their accountant's website to find the portal link. The site looks the same as it did three years ago, and underneath it probably is the same: the WordPress release, the theme and the code library that runs the menu have not been touched since launch. Nobody visiting can see that, but anyone scanning for old software can.

Outdated software is the most common kind of website neglect, and it matters because every old release carries flaws that have been published and fixed in the newer one. A website that has not been updated keeps those flaws open. It also tends to break in small ways first: forms that stop sending, sliders that stop loading, pages that look wrong on a new phone.

How often that happens depends heavily on the industry. 17% of accounting firm websites run outdated software, the highest rate of 15 industries, against 4.7% of restaurant websites. Law firms and dental practices sit just behind accountants, and software companies do worse than plumbers. The one pattern that holds everywhere is the platform: in all 15 industries, WordPress websites are out of date more often than websites on other platforms.

On September 23 and 24, 2026, we checked business websites in 15 industries, each taken from a US Google Business Profile, the free listing a business keeps on Google Search and Maps. The industries range from accounting firms, law firms and financial advisors to plumbers, roofers, restaurants, hotels, manufacturers and SaaS companies, with between 234 and 809 websites in each. For each website we checked the WordPress, jQuery and Drupal versions and whether its server names its own software.

A website runs outdated software when any of three components is behind: WordPress, the software behind a large share of business websites, older than version 7.1; jQuery, a code library many sites load for menus, sliders and forms, older than version 3.5.0, the release that fixed two publicly documented security flaws; or Drupal 7, 8 or 9, releases that no longer get security updates. Many platforms hide their version number, so we also report the share that is out of date among the websites that do show one. A server that shows its software announces the name of the program it runs to every visitor, a detail most security guides recommend keeping private.

That is about one accounting firm website in six, ahead of law firms at 15.5% and dental practices at 15.4%. At the other end, restaurants have the lowest rate at 4.7%, followed by auto dealers at 5.3% and financial advisors at 6.6%. An accounting firm website is more than three times as likely to run outdated software as a restaurant's, even though accountants hold tax returns, payroll records and bank details and restaurants mostly publish a menu.

The ranking does not follow how technical an industry is. 14.9% of SaaS company websites run outdated software, the fourth highest rate, and more than the websites of plumbers at 9.7%, HVAC companies at 10.5% and roofers at 11.4%. A software company's marketing website is often run by the marketing team on WordPress or a site builder, separate from the product and the engineers who patch it, so it drifts while the product stays current.

It does not follow how sensitive the data is either. Financial advisors, who work under compliance rules and often use website platforms built for their industry, have the third lowest rate at 6.6%. Accountants, dentists and lawyers, who handle data just as private, have the three highest rates. The pattern points to whether someone owns the updates, not to what the business does.

Many website platforms hide which version they run, which keeps the overall rates down. Where the version is visible, the picture is much worse: 59.5% of accounting firm websites that show a version are out of date, followed by real estate at 48.4%, law firms at 47.3%, hotels at 45.6% and SaaS companies at 45.1%. In those five industries, close to half or more of the websites that can be checked from outside run an old release.

Auto dealers are the clear exception. Where a dealer website shows its version, 16.5% are behind, the lowest share of 15 industries and well under restaurants at 28.9%, the next lowest.

How often the version shows varies too. 39.1% of dental websites show which version they run, the highest share of 15 industries, against 26.3% of real estate websites. A visible version makes it easy for the owner, or anyone else, to see when the website has fallen behind.

The gap between WordPress and other platforms appears in all 15 industries. It is widest among auto dealers, where WordPress runs 12.5% of websites, often a side site for a service department or a single promotion. It is more than five times among roofers, 20.2% against 3.6%, and more than four times among plumbers and law firms. The highest WordPress rate belongs to real estate: 26.9% of WordPress real estate websites run outdated software, often because plugins, including listing plugins, have been skipped.

The likely explanation is ownership more than WordPress itself. A hosted builder or an industry platform updates its own software; a WordPress website needs someone to update its core, its theme and every plugin, and on a small business website that job often has no owner. It fits the numbers: WordPress sites make up a large part of the outdated websites even where WordPress is a minority: about 63% of outdated financial advisor websites and about 55% of outdated restaurant websites run on WordPress, which powers 30.6% and 25.6% of those industries.

Two industries break the pattern in a useful way. Among accounting firms and dental practices, websites on other platforms are also out of date often, 14.4% and 14%, so the problem there is wider than one platform.

The two components behind most outdated websites point to different industries. 11.3% of law firm websites run a WordPress release older than 7.1, the highest rate of 15 industries, followed by roofing at 9.3%. Old jQuery is most common on accounting firm websites at 8.8%, followed by dental at 7.7% and SaaS at 7.5%.

The difference says something about how each website fell behind. Roofing and plumbing websites load current jQuery, 2.6% each and joint-lowest with restaurants, but skip WordPress updates: they were built on current tools and then left alone after launch. An old jQuery file usually means the opposite, an old theme or plugin that has not been replaced in years, which is the pattern on accounting and dental websites.

Versions of jQuery before 3.5.0 carry two publicly documented flaws that can let an attacker run malicious code in a visitor's browser, which is why security scanners flag them. A skipped WordPress release leaves its own published fixes unapplied. Both are cleared by the same routine: apply updates when they are released.

That is the highest rate of 15 industries, ahead of SaaS companies at 10.4%, real estate at 10.3% and medical practices at 8.8%. Financial advisors are at the other extreme: 0.7% of financial advisor websites name their server software, and the auto dealer rate is 16 times that.

A server name on its own does not break anything, but it tells automated attack tools which known weaknesses to try, and hiding it is one setting on the web server or hosting platform. It is also the one measure here where auto dealers, among the most up to date industries on software versions, come last, which shows that a platform can keep the software current while leaving the server settings at their defaults.

Find out who updates your website, by name. The industries with the most current websites are the ones where a platform or a provider does the updates for every customer at once; the ones with the most outdated websites are those where the owner runs WordPress and the job belongs to nobody. If you cannot name the person or company that applied the last update, the answer is probably no one.

Then check the three things this study measured. Ask whoever manages the site which WordPress release it runs and when the theme and plugins were last updated; find out which jQuery version the site loads and replace any theme or plugin that brings in one older than 3.5.0; and ask your host to stop the server from announcing its software name. List every website your business runs, including old landing pages and side sites, because those are where outdated software collects.

Finally, make it routine. Updates every month, a test of every form after each round, and a short log of what changed. If nobody on your team has time for that, a provider of wordpress maintenance services can apply the core, theme and plugin updates on a schedule and report what was updated each month.

Embed this research

Cite this study