The (Un)usual Suspects – Studying Reasons for Lacking Updates in WordPress

The (Un)usual Suspects – Studying Reasons for Lacking Updates in WordPress

Speakers: Maria Hellenthal

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=UXPoHBv8HB8

Overview

In the realm of cybersecurity, the perennial challenge of keeping software up-to-date remains one of the most critical yet frequently overlooked aspects of defense. Maria Hellenthal's talk, "The (Un)usual Suspects – Studying Reasons for Lacking Updates in WordPress," delivered at the NDSS Symposium, delves into the complex human factors behind the widespread phenomenon of outdated Content Management Systems (CMS). This presentation highlights a significant security gap: despite the well-known risks associated with unpatched software, a substantial portion of websites, particularly those built on popular platforms like WordPress, continue to operate with known vulnerabilities.

The core of this research is to understand why website owners fail to update their CMS, moving beyond purely technical explanations to explore the psychological, economic, and organizational barriers. By employing a rigorous qualitative research methodology inspired by grounded theory, Hellenthal and her team uncover critical, previously underemphasized factors such as the perceived value of the website and the dynamics of delegation in website management. This work is crucial for improving overall web security, as it provides a framework for identifying at-risk websites and designing more effective strategies to encourage timely updates, thereby protecting not only individual site owners but also the broader online ecosystem from automated exploitation.

Background

▶ Watch: Introduction: The widespread problem of outdated CMS (0:00)

Content Management Systems like WordPress, Joomla, and Drupal have become the backbone of the internet, powering an estimated 43% of all websites. Their immense popularity stems from their user-friendly interfaces, extensive plugin ecosystems, and ability to democratize web presence for individuals and businesses alike. However, this accessibility comes with a significant security trade-off. The vast codebase of CMS platforms, often extended by thousands of third-party plugins and themes, inherently introduces numerous potential vulnerabilities. When these vulnerabilities are discovered, they are frequently disclosed publicly, often with accompanying proof-of-concept exploits.

The danger is compounded by the sheer scale of CMS adoption. A single vulnerability in a widely used CMS or popular plugin can instantly expose millions of websites to attack. Attackers can automate the scanning and exploitation of these known flaws across a massive number of sites, leading to widespread compromises that can result in data breaches, malware distribution, defacement, SEO spam, and even the weaponization of compromised sites for further attacks. The most effective and straightforward defense against these known threats is to keep the CMS and its components fully up-to-date with the latest security patches. Yet, alarming statistics reveal a significant disconnect: recent reports indicate that over half of all CMS installations in the wild lack the latest security patches. This persistent gap between known solutions and actual implementation underscores a deep-seated problem that extends beyond mere technical capability.

Prior research has explored update behavior in other computing ecosystems, such as end-users managing their personal devices or system administrators responsible for enterprise infrastructure. These studies have identified common factors like a lack of threat and risk awareness, a high perception of update risks (e.g., fear of breaking functionality), insufficient technical competence, understanding, and skills, and high update costs in terms of both time and money. While these factors are undoubtedly relevant, Hellenthal's research specifically targets the unique context of website owners and their CMS, aiming to determine if these previously identified factors hold true and, more importantly, to uncover any novel, CMS-specific dynamics that contribute to the reluctance to update. This study therefore seeks to fill a critical gap in understanding, providing a more nuanced and context-specific explanation for a pervasive security issue.

Key Findings

▶ Watch: Methodology: Grounded theory and data triangulation (1:25)

The research, inspired by grounded theory, employed data triangulation through semi-structured interviews with two distinct groups: website owners with outdated CMS installations and web professionals (developers and hosting providers). This approach allowed for an open, bottom-up exploration of the non-updating phenomenon without relying on pre-existing hypotheses. Through iterative coding and analysis until data saturation was achieved, the study identified six key categories influencing update behavior.

Four of these categories resonated with findings from prior literature on update behavior in other ecosystems, confirming their relevance to CMS owners:

1. Lack of threat and risk awareness: Many owners simply don't understand the severity of vulnerabilities or the potential impact of a compromise.
2. High perception of update risks: The fear that an update might break website functionality, themes, or plugins is a significant deterrent.
3. Lack of technical competence, understanding, and skills: Website owners, particularly those without a technical background, may find the update process daunting or beyond their capabilities.
4. High update costs: Both in terms of the time required to perform updates and the potential financial cost if professional help is needed, these expenses can be prohibitive.

However, the study's most significant contribution lies in the identification of two novel key categories that proved to be "far more decisively" influential in determining update behavior for CMS owners: the value of the website and delegation.

The value of the website emerged as the central and most important category. Researchers found a dichotomy:

• Low Website Value: Many participants, even those with business websites, expressed little to no motivation to care for their site, either content-wise or technically. For these owners, the website simply held minimal perceived importance or utility. An anecdotal example from the Q&A highlighted a woman planning to retire who saw no point in investing money or effort into updating her old, albeit important, business website.
• High Website Value, but still outdated: Intriguingly, other participants considered their website's importance to be high or very high, expressing motivation to keep it updated, yet their systems remained unpatched. This "puzzle" led to a deeper breakdown of the "value" category and its interaction with other factors.

The second novel factor, delegation, played a critical role, particularly for those who valued their website but still didn't update. Many website owners had delegated tasks to external collaborators (freelancers, agencies) during website creation or ongoing maintenance. The study identified four dimensions of these delegation relationships, with the formalization degree being a crucial example.

• Informal Delegation: When collaborations were based on loose verbal agreements or a "mutual exchange of favors," rather than formal contracts, significant issues arose:
• Responsibility diffusion: No single party felt explicitly responsible for updates. The website owner assumed the agency handled it, while the agency assumed the owner would specify update requests.
• Disabling: External collaborators sometimes introduced complex plugin structures or custom code, making the website owner feel "not able anymore to touch the website" or fearful of breaking it by attempting updates themselves.
• Inhibitions to reach out: Owners were reluctant to "bother" their informal collaborators with update requests, especially if the initial agreement was for a one-off build.

These insights culminated in the development of a framework of barriers preventing updates, which categorizes non-update scenarios primarily based on the perceived value of the website. This framework provides a structured approach to understanding the complex interplay of factors and offers a valuable tool for identifying website owners who might still be persuaded to update their systems.

Technical Deep Dive

▶ Watch: Two novel factors: Website value and delegation (3:40)

While the talk focuses on human factors, the "technical deep dive" here pertains less to code vulnerabilities and more to the rigorous methodology employed and the framework derived, which represents the structured output of the research. The study's strength lies in its adherence to grounded theory, a systematic qualitative methodology. Unlike traditional research that starts with hypotheses, grounded theory begins with data collection and analysis, allowing theories to "emerge" from the data itself.

The process involved:

1. Open Coding: Initial interviews were conducted with both website owners and web professionals. The transcripts were then broken down into discrete parts, and each part was assigned an initial code representing its core meaning. For example, statements about fear of breaking the site might be coded as "update risk perception."
2. Axial Coding: Related codes were then grouped into broader categories. For instance, "update risk perception," "lack of technical skill," and "cost of updates" might all fall under a higher-level category like "Perceived Barriers to Updating."
3. Selective Coding: This final stage involved identifying a core category that explains the central phenomenon (non-updating behavior) and relating all other categories to it. In this research, the "value of the website" emerged as this central, overarching category.

Data Triangulation was a key methodological strength, using two distinct data sources (website owners and web professionals) collected via the same method (semi-structured interviews). This allowed the researchers to cross-validate findings and gain a more objective and comprehensive view, enriching the themes identified from the website owners' perspectives with the insights of industry experts. The process continued until data saturation, meaning no new themes or categories emerged from additional interviews, ensuring the robustness and completeness of the findings.

The resulting framework of barriers preventing updates is the most significant technical output, providing a structured way to understand the complex interplay of factors:

1. Scenario 1: Low Website Value

• Root Cause: The website owner places very little or no value on their website (e.g., it's an old, forgotten personal blog, or a business site that no longer generates revenue).
• Behavior: This significantly diminishes any motivation to update, leading to outright neglect in both technical and content-related terms.
• Impact: This factor is so strong that it "overshadows" other potential influences like a lack of risk awareness or technical skills. Even perfectly crafted vulnerability notifications are likely to fail here because the fundamental motivation to care for the asset is absent. This has profound implications for the effectiveness of standard security advisories.

1. Scenario 2: High Website Value, High Perceived Technical Skills

• Root Cause: The website owner values their site highly and perceives themselves as technically competent enough to manage it independently. They typically do not engage external collaborators.
• Behavior: When these owners fail to update, it is primarily due to a lack of risk awareness. They might be confident in their abilities but unaware of specific threats or the importance of regular patching.

1. Scenario 3: High Website Value, Low Perceived Technical Skills, Full Delegation

• Root Cause: The website owner values their site highly but recognizes their own limited technical skills, leading them to fully delegate website management (including updates) to a professional web agency or freelancer.
• Behavior: Even in this seemingly ideal scenario, updates can be inhibited. An example cited was a web agency and owner jointly deciding not to update an important, old website because they "didn't want to break anything," preferring to wait for a new site to be built. This highlights the perception of update risks even among professionals, or a lack of clear update policies in the service agreement.

1. Scenario 4: High Website Value, Low Perceived Technical Skills, Partial & Informal Delegation

• Root Cause: The website owner values their site but has limited technical skills, leading to partial delegation of tasks, often based on loose verbal agreements or mutual favors rather than formal contracts.
• Behavior: This scenario frequently leads to responsibility diffusion, where neither the owner nor the informal collaborator takes ownership of updates. It can also result in disabling, where the owner feels unable to interact with a complex site setup by the collaborator, or inhibitions to reach out to the collaborator for update requests. These issues are so potent that they "overshadow" other factors like risk awareness.

This framework is a powerful analytical tool, offering a nuanced understanding of why website owners, even those who acknowledge their site's importance, may still fall behind on critical security updates. It moves beyond a simplistic view of "technical incompetence" to reveal a richer tapestry of motivational, organizational, and interpersonal barriers.

Demo / Proof of Concept

▶ Watch: Delegation dimensions leading to update issues (4:45)

Maria Hellenthal's presentation, "The (Un)usual Suspects," did not feature a traditional technical demonstration or a proof of concept in the sense of showcasing an exploit, a tool, or a system in action. This is entirely consistent with the nature of the research, which is a qualitative study focused on understanding human behavior, motivations, and decision-making processes regarding software updates.

Instead of a live demo, the "proof" of this work lies in the robust qualitative data gathered through semi-structured interviews and the systematic application of grounded theory methodology. The findings—the identified categories, the nuanced insights into website owners' perspectives, and the resulting framework of barriers—serve as the empirical evidence. The strength of the research is derived from the depth and saturation of the interview data, triangulated across different participant groups, which collectively reveal the complex underlying reasons for lacking updates. The framework itself acts as a conceptual model, demonstrating how these identified factors interact to produce specific non-updating scenarios.

Defensive Implications

▶ Watch: Framework scenarios: Website value determines update behavior (6:40)

The findings of "The (Un)usual Suspects" provide crucial insights for cybersecurity defenders, particularly those involved in vulnerability management, incident response, and security awareness campaigns. The primary implication is that a one-size-fits-all approach to encouraging updates is ineffective; strategies must be tailored to the website owner's motivation (website value) and their operational context (delegation).

1. Addressing Low Website Value Scenarios:

• Acknowledge Limitations: For websites with genuinely low perceived value, traditional vulnerability notifications, no matter how well-crafted, are likely to fail. The fundamental motivation to care for the asset is absent.
• Focus on External Enforcement/Decommissioning: Hosting providers might need to play a more active role, either by enforcing automatic updates for neglected sites (if technically feasible and agreed upon) or by flagging and potentially decommissioning sites that pose a persistent threat to the hosting environment and other users. This shifts the burden from the unmotivated owner to a party with a vested interest in overall security.

2. Tailoring Communication for High Website Value Scenarios:

• Comprehensive Risk Communication: For owners who value their website, vulnerability notifications should be significantly improved. They must communicate not only the direct risks to the website owner (e.g., data loss, defacement) but also the broader risks to the entire online community (e.g., site used for malware distribution, phishing, or as a botnet node).
• Clear Responsibility and Accountability: Notifications should explicitly state that the website owner is ultimately responsible and accountable for the security and vulnerabilities of their website, even if tasks are delegated. This helps counter responsibility diffusion.
• Suggest Technical Support: When appropriate, notifications should recommend seeking professional technical support or managed update services. This acknowledges the lack of technical competence barrier and provides a concrete solution.

3. Mitigating Delegation-Related Barriers:

• Encourage Formal Agreements: Security advocates should encourage website owners to establish formal contracts with web developers and agencies that explicitly outline responsibilities for ongoing maintenance, including regular security updates and patching schedules. This addresses responsibility diffusion.
• Transparency in Website Architecture: Developers should be encouraged to build websites with maintainability in mind, providing clear documentation of plugin usage and custom code. This helps prevent disabling by making the site less opaque for owners or future developers.
• Managed Update Services: For owners with low technical skills but high website value, promoting managed WordPress hosting or dedicated update services can offload the burden and ensure timely patching without the owner fearing "breaking things."
• Address "Fear of Breaking Things": For owners or even agencies hesitant to update due to fear of breaking functionality, promoting the use of staging environments for testing updates before deploying them to live sites is critical. Highlighting robust backup and restore solutions can also provide a safety net, though it's important to counter the misconception (identified in the Q&A) that backups are an alternative to updating, rather than a complementary safety measure.

4. Enhancing Risk Awareness:

• Targeted Education: Develop educational materials that clearly explain common attack vectors, the impact of compromise, and the ease of automated exploitation against outdated CMS. These should be framed in terms relevant to business owners, focusing on reputational damage, SEO penalties, and potential loss of customer trust.

The research highlights that the human element is not a simple variable but a complex interplay of motivations, perceptions, and relationships. Defenders must move beyond generic warnings and adopt a more nuanced, empathetic, and strategically segmented approach to fostering a culture of timely updates.

Key Takeaways

• Pervasive Risk: Over half of all CMS installations globally lack the latest security patches, posing a serious and widespread risk to the entire online community dueating to automated exploitation of known vulnerabilities.
• Beyond Technical Skills: While factors like lack of technical competence, update costs, and perceived risks are relevant, the study reveals that the value of the website and the dynamics of delegation are far more decisive in influencing update behavior.
• Low Value, High Neglect: Websites perceived as having low value by their owners are highly susceptible to neglect, making traditional vulnerability notifications largely ineffective as there's no inherent motivation to care for the asset.
• Delegation Pitfalls: Informal delegation relationships (e.g., loose verbal agreements with developers) frequently lead to responsibility diffusion, disabling (owners feeling unable to touch complex sites), and inhibitions to reach out, all of which impede timely updates.
• Tailored Communication is Key: Effective security communication must be highly tailored. For high-value websites, warnings should be comprehensive, articulate community-wide risks, assign clear accountability, and suggest professional support options to overcome specific barriers.
• Framework for Intervention: The research provides a valuable framework of barriers preventing updates, which can be used by hosting providers, security researchers, and web professionals to identify specific non-update scenarios and design targeted interventions to encourage better security practices.

About the Speaker(s)

Maria Hellenthal is the presenter of "The (Un)usual Suspects – Studying Reasons for Lacking Updates in WordPress" at the NDSS Symposium. Her work, as presented in this talk, focuses on critical research into the human factors influencing cybersecurity practices, specifically the update behavior of website owners using Content Management Systems. The transcript and metadata do not provide further details about her specific title or affiliation beyond her name and role as the speaker for this important work.