Back in 2009 Google started notifying webmasters through their Webmasters Tools (later renamed Google Search Console) that they were running outdated software in some instances. That is good idea, but it clearly needs some work as of 2017, seeing as last night we got the following email:
Recommended WordPress update available for http://www.whitefirdesign.com/
To: Webmaster of http://www.whitefirdesign.com/,
Google has detected that your site is currently running WordPress 4.7.0 or 4.7.1, an older version of WordPress. Outdated or unpatched software can be vulnerable to hacking and malware exploits that harm potential visitors to your site. Therefore, we suggest you update the software on your site as soon as possible.
Following are one or more example URLs where we found pages that have outdated software. The list is not exhaustive.
https://www.whitefirdesign.com/blog/category/outdated-server-software/
https://www.whitefirdesign.com/blog/category/sucuri-security/
Recommended Actions:
1 Update to the latest release of WordPress Visit the WordPress site for instructions on how to download and install the latest release.
2 Check your site for hacked content Because there was a vulnerability on your site, it’s possible that your site might have been compromised. We recommend you check your site for any suspicious activity. You can see if Google has detected any hacked content on your site in the Security Issues section of Search Console.
3 Stay up to date on new releases Remember that older or unpatched software might be vulnerable to hacking or malware, so it’s important to install new software releases when they come out.
Need more help?
• Read more about outdated software and vulnerabilities in our Help Center. • Check your site for hacked content using the Hacked Sites Troubleshooter. • If your site was compromised, read our guide for hacked sites. • Ask questions in our forum for more help – mention message type [WNC-641200].
Because this blog, like hopefully almost all WordPress installations, hasn’t had the automatic background updates feature disabled, it already was updated. In fact the update to 4.7.2 happened as of midday on January 26, the day the update was released. That was 11 days before the email was sent out. Seeing as we haven’t removed the meta generator tag from the blog, the version is included on every page’s source like this:
<meta name="generator" content="WordPress 4.7.2" />
Our guess would be that they are still processing pages crawled from before the update happened, which include the previous version number, and they are basing the claim of outdated software on that, which is obviously problematic.
It also worth noting that they are failing to capitalize the “p” in WordPress, instead referring to it as “WordPress”.