Log into almost any WordPress site and something will be asking to be updated. Most boards leave it, quite reasonably, because nobody wants to be the person who pressed the button that broke the website.
An update is three different things
WordPress itself is one part. The plugins that add features are another, and there are usually somewhere between ten and thirty of them. The theme that decides how everything looks is the third. They are made by different people, on different schedules, and they all have to keep working together.
That is why updates occasionally go wrong. Not because any one piece is bad, but because a small change in one can upset another.
Why we copy the site first
Every month we make a private copy of your site and run the updates there. If a plugin shifts the layout or breaks a form, it happens on the copy, where nobody can see it. We fix it there, and only then do the same work on the live site.
It sounds cautious because it is. It also means that in seven years we have not had to tell a client their site went down during an update.
What happens if you leave it
Old plugins are the most common way a small website gets hacked. Not because someone chose to attack a church in Groningen, but because automated software goes looking for known holes and finds one that was patched two years ago.
If nobody is currently looking after this for your organisation, send us a message and we will tell you what state things are in.