Every few months a client forwards me a headline about a new WordPress release and asks the same thing: do I need to do anything? This time the answer has two parts. WordPress 7.1 is a feature release you can plan for, and WordPress 7.1.4, released on October 28, 2026, is a security release you should not leave sitting. Here is what changed and how I handle both on client sites.
Where WordPress stands right now
WordPress 7.0 (“Armstrong”) shipped on May 20, 2026, after a delay from its original April date. It raised the minimum PHP version from 7.2 to 7.4, and real-time collaboration was pulled before release because of stability and server-load concerns. WordPress 7.1 (“Mary Lou”) followed on August 19, 2026. The current version is 7.1.4, which is a security release.
What 7.1 added
These are the changes that matter most to a business site owner, based on the official announcement:
- Responsive styles. You can style blocks differently for different screen sizes from Global Styles or block settings, without custom CSS, and preview the result at each size.
- A new media editor. One window for cropping, flipping, rotating and editing image metadata.
- Better image handling. Resizing and compression can run in the browser, and there is native support for AVIF and HEIC images.
- New Tabs and Playlist blocks, plus improved Notes for leaving feedback on a draft, with @mentions.
- A fully iframed post editor for all themes, matching the Site Editor.
Nothing here forces a redesign. The responsive styling is the biggest practical gain, because mobile tweaks that used to need a developer and a CSS file can now be done in the editor. The iframed editor is the item I test most carefully, since plugins or custom blocks that touch the editor interface are the likeliest to misbehave.
Why 7.1.4 is the one to act on
The 7.1.4 notes list fixes for 22 vulnerabilities and recommend updating immediately. They include several stored cross-site scripting flaws, mostly exploitable by users with Contributor access or higher, a leak of unpublished Customizer changes to unauthenticated visitors, a denial-of-service issue, and a race condition during core updates that could lead to remote code execution. The fixes were also released for older branches, for example 7.0.8 and 6.9.11, so a site that cannot move to 7.1 yet can still be patched. WordPress states that only the most recent version is actively supported, so older branches are a short-term position, not a place to stay.
Many sites receive minor security updates automatically, but not all do. Some hosts or plugins turn automatic updates off, and I regularly find sites that missed several. If you are not sure, check the version shown under Dashboard, then Updates.
How I update a client site
- Take a full backup of files and database, and confirm it can be restored.
- Check the PHP version with the host. WordPress recommends PHP 8.3 or greater, and PHP 7.4 is only a legacy minimum that the requirements page describes as end-of-life.
- Update plugins and the theme first where they have compatibility notes, and remove any that are no longer maintained.
- For anything that earns money, update a staging copy first and test forms, checkout, login, search and the page types that matter.
- Update the live site, then repeat the quick checks and watch for errors over the next day.
For a security release I move faster, since the risk of waiting is larger than the risk of the update. For a feature release like 7.1, a few days of testing is reasonable.
When to bring someone in
If your site runs an old PHP version, depends on abandoned plugins, or breaks every time something updates, the release itself is not the problem. That is usually a sign the site needs a cleanup, and slow admin screens often point to the same cause, as I describe in why a WordPress site gets slow. Regular updates are also the core of any sensible care plan, and I explain what to pay for in what WordPress maintenance actually requires.
I handle updates, staging tests and clean-ups for WordPress sites in the US and UK. See my care and maintenance services, or get in touch and tell me which version your site is on.
