How to Fix Hostinger WordPress Security Update Warnings
Quick Answer If Hostinger sends an email stating that your website needs security updates, sign in to your Hostinger account directly, open hPanel, select th...
Quick Answer
If Hostinger sends an email stating that your website needs security updates, sign in to your Hostinger account directly, open hPanel, select the affected WordPress website, and review the security recommendations in the WordPress Updates or Security section. Back up the website and its database before applying updates, then update the affected plugins and test the website.
For example, a warning about dryblendfoods.com lists several plugins that need attention, including All-In-One Security (AIOS), Elementor, Duplicator, LiteSpeed Cache, Slider Revolution, WooCommerce, and Yoast SEO. The email indicates that Hostinger has identified update or security concerns; it does not, by itself, prove that the website has been hacked.
What Does the Hostinger Security Update Email Mean?
Hostinger monitors WordPress installations for available updates and known software vulnerabilities. Its dashboard can display security information based on the Patchstack vulnerability database and recommend actions for affected plugins or themes.
A plugin vulnerability is a weakness in software that could potentially be exploited to affect website security. Installing the appropriate security update can address known vulnerabilities, although keeping software updated does not eliminate every security risk.
The email may identify plugins that have updates available or have been flagged by a security check. Review the actual recommendation in hPanel rather than assuming that every listed plugin has the same vulnerability or requires the same action.
Plugins Listed in the Hostinger Email
The example notification for dryblendfoods.com identifies the following plugins:
- All-In-One Security (AIOS)
- Code Snippets
- Duplicator
- Duplicator Pro
- Elementor
- Elementor Pro
- Site Kit by Google
- Header and Footer Scripts
- Smash Balloon Instagram Feed
- WPBakery Page Builder
- LiteSpeed Cache
- Ohio Extra
- Slider Revolution
- WooCommerce
- Yoast SEO
These plugins perform different functions, including website design, e-commerce, backups, caching, analytics, search engine optimization, and security. Their presence in the notification does not establish that every plugin is compromised.
Some plugins may be required by the active theme or another plugin. For example, Elementor Pro may depend on Elementor, while Ohio Extra may provide functionality for the Ohio theme. Check the website's configuration before removing or disabling anything.
How to Update WordPress Plugins in Hostinger hPanel
Step 1: Sign in to Hostinger safely
- Open the official Hostinger hPanel website by entering the address directly in your browser.
- Sign in using your Hostinger account credentials.
- Navigate to Websites and open the dashboard for the affected website.
- Locate the WordPress Updates or Security section. The exact menu label can vary with the dashboard interface and hosting plan.
Do not rely solely on the email's links. Signing in directly helps reduce the risk of phishing, in which a fraudulent message attempts to steal account credentials.
Step 2: Review the security recommendations
Open the installed plugins section and review each plugin's current version, update availability, security status, and recommended action. Hostinger's WordPress management interface can display whether a vulnerability has been detected and provide an update or other recommended action.
Use the official Hostinger guide to managing WordPress themes and plugins if you need help locating these controls.
Step 3: Back up the website
Before updating plugins, create a current backup containing both the website files and the database. The files contain WordPress, themes, plugins, uploaded media, and configuration files. The database contains posts, pages, settings, orders, and other application data.
- Open the backup section in hPanel.
- Check the available backup dates and confirm that a suitable restore point exists.
- Create a fresh backup if the hosting plan and interface provide that option.
- Keep an additional copy outside the hosting account when practical.
- Make sure you know how to restore the backup before proceeding.
If you use Duplicator or another backup plugin, confirm that the backup completed successfully and that its files are accessible. Do not assume that a backup exists merely because the plugin is installed.
For additional guidance, see the official WordPress backup documentation.
Step 4: Update the affected plugins
- Return to the Hostinger Updates or Security section.
- Select the plugins for which an update is available or follow the specific recommendation shown by Hostinger.
- Apply the updates and wait for each operation to finish.
- Check for failed updates or compatibility warnings before continuing.
- If a plugin update is unavailable in hPanel, open the WordPress administration dashboard and select Plugins.
- Review the available update details and use the official update control where appropriate.
When updating directly through WordPress, the official documentation explains the procedure in Manage Plugins.
Use legitimate update packages from the official plugin developer or an authorized source. For premium plugins such as Elementor Pro, Duplicator Pro, or Slider Revolution, ensure the appropriate license or authorized update access is available when required.
If a plugin has no available update, do not attempt to resolve the warning by downloading an unknown ZIP file or replacing its files manually. Review the security recommendation, check the developer's official release information, and seek assistance if a supported fix is not available.
Step 5: Test the website
After the updates finish, open the website in a browser and check the features that matter to its operation.
- Open the homepage and several important internal pages.
- Check page layouts, navigation menus, images, and mobile responsiveness.
- Test contact forms and other important submissions.
- For WooCommerce, verify product pages, cart operations, checkout, and payment integration using an appropriate test procedure.
- Sign in to the WordPress administration dashboard and check for PHP errors, update failures, or new warnings.
- Clear the relevant cache if recent changes are not visible, and then test again.
How to Confirm That the Security Warning Is Resolved
Return to the WordPress Updates or Security section in hPanel and review the status of each affected plugin. Confirm that updates have completed and that the original recommendations have been addressed.
If a warning remains, determine whether it refers to an outdated version, a known vulnerability, an unsupported plugin, or another recommendation. A successful update does not necessarily mean that every security warning will disappear immediately.
Where the dashboard provides vulnerability details, compare the installed version with the affected and fixed versions documented by the plugin developer or security advisory. Do not rely on the plugin name alone to determine whether a specific vulnerability applies.
What If a Plugin Update Breaks the Website?
If the website stops working, displays a critical error, loses its layout, or experiences checkout problems after an update, investigate the most recent change first.
- Record the error message and identify the plugin that was updated immediately before the problem appeared.
- Check whether the WordPress dashboard and hPanel remain accessible.
- Review the plugin developer's compatibility notes and the website's PHP and WordPress requirements.
- If a suitable backup exists, restore the affected website using Hostinger's supported recovery procedure.
- After recovery, test the website and arrange a controlled update or compatibility investigation before trying again.
Restoring a full backup can overwrite newer website content, orders, form submissions, and database changes made after the backup was created. For a busy online store, consider whether a targeted recovery is more appropriate than restoring the entire website.
If the website is important to business operations and the cause is unclear, ask a qualified WordPress technician or hosting support team to investigate before making further changes.
Should You Purchase Patchstack?
The Hostinger email includes a Patchstack promotion offering an additional service. Hostinger's dashboard uses the Patchstack vulnerability database to inform certain security alerts and update recommendations. The promoted Patchstack service is a separate offering, not the same thing as applying available plugin updates in hPanel.
You do not need to purchase the promoted service merely to investigate the warning or apply an available update. Review the service's current features, coverage, pricing, and terms on the official Patchstack website before deciding whether it meets your security requirements.
Automated vulnerability protection can complement regular maintenance, but it should not replace software updates, secure account access, backups, or incident response.
Why Inactive Websites Also Need Security Updates
An inactive website is not necessarily a secure website. If a WordPress installation remains accessible on the internet, vulnerable plugins or themes may still provide an attack path even when the website is no longer actively maintained.
Hostinger warns that an affected website can put other websites on the same hosting plan at risk. The degree of risk depends on the hosting environment, permissions, isolation, and the nature of the vulnerability.
For websites that are no longer required, consider whether they should remain online. If a website must be retained, keep WordPress, its themes, and its plugins maintained. If it is no longer needed, create any required archival backup and remove the installation using an appropriate procedure rather than simply abandoning it.
Recommended WordPress Security Maintenance
- Keep WordPress core, themes, and plugins updated.
- Remove plugins and themes that are no longer required, after checking dependencies and preserving any necessary data.
- Use trusted software sources and maintain valid licenses for premium extensions.
- Keep recent, restorable backups of website files and databases.
- Use strong, unique passwords and enable two-factor authentication where available.
- Limit administrator access to people who need it.
- Monitor hosting security alerts and investigate unexpected changes.
- Test important website functions after maintenance.
- Review security recommendations for every WordPress installation on the hosting account, including inactive sites.
For additional security practices, consult the official WordPress hardening guide.
Frequently Asked Questions
Does the Hostinger email mean my website has been hacked?
No. An update or vulnerability warning does not by itself prove that an attacker accessed the website. Review the specific finding in hPanel. If you also observe unexpected administrator accounts, unfamiliar files, redirects, or other suspicious changes, investigate for a possible compromise.
Can I update all the listed plugins at once?
Bulk updates may be available, but they are not always the best choice for a website with many interconnected plugins. Back up the website first, review compatibility information, and update in a controlled sequence if the website is business-critical.
Do I need to update inactive plugins?
If an installed plugin is not required, consider removing it after confirming that no active feature depends on it. Merely deactivating a plugin is not the same as removing its files. If you retain an inactive plugin, keep it maintained or remove it when it is no longer needed.
What if hPanel says a plugin is vulnerable but no update is available?
Check the plugin developer's official security advisories and supported versions. Follow the mitigation recommended by the developer or Hostinger. If the plugin is abandoned or cannot be secured, plan a compatible replacement and test it before removing the existing functionality.
Is a WordPress backup plugin enough to protect my website?
A backup plugin can be useful, but protection depends on whether the backup includes both files and the database, completes successfully, and can be restored. Keep a separate copy when possible and periodically verify your recovery procedure.
Will buying Patchstack automatically fix every security issue?
No security service can be assumed to address every vulnerability or configuration problem. Review the service's documented coverage and continue to apply software updates, maintain backups, and investigate security alerts.
Sources
Was this guide useful?
Your answer helps us keep BISONKB accurate and practical.