Do I need to keep my CMS, plugins and themes updated?

Yes - out-of-date website software is one of the most common ways small business sites get compromised, because attackers scan the web for the exact flaws that each update fixes. Updating is maintenance, not optional:

• Why it matters - when a flaw is patched, the details become public, and automated tools immediately start hunting for sites still running the old version.
• Plugins and themes count too - an abandoned or unpatched add-on is just as much a way in as the core platform, and it is easy to forget the ones you no longer use.
• Remove what you don’t use - every inactive plugin or theme is still code on your server; deleting it is one less thing to patch and one less way in.

Turn on automatic updates where your platform offers them, and uninstall anything you no longer use.