What version of WordPress is my site on, and does it matter?
It matters less than the PHP version and more than most people think. WordPress itself is updated several times a year, and most hacked WordPress sites were simply out of date: the core, a plugin or a theme with a known hole that had already been fixed upstream.
How the check knows
WordPress writes its version into the page, in a “generator” tag, and into the addresses of its own files. The check reads either and asks wordpress.org what the current release is. It also counts the plugins it can see from the files a page loads, which is a lower bound, not the real total, and recognises the common page builders by their files.
What it means for you
Being one minor version behind is normal and WordPress usually patches that itself overnight. Being a major version or more behind means security fixes you don’t have, and often a theme or plugin that nobody has touched in years. A long plugin list isn’t wrong in itself, but each one is code someone else maintains, or doesn’t, and each one is a way in. Page builders are fine for building; they bring a lot of code to every page and are the usual reason a site has a speed ceiling.
What you can do yourself
Log in, open Dashboard, then Updates. Take a backup first, or make sure your host takes one. Update WordPress, then the plugins, then the theme, and look at the site after each step. Delete plugins you don’t use rather than just deactivating them. Turn on automatic updates for the plugins you trust.
When it’s a developer’s job
If an update breaks the site, if the theme was customised by someone who’s gone, if a plugin hasn’t been updated in years, or if you daren’t press the button because last time it went wrong. That last one is common and nothing to be embarrassed about. It’s also most of what a care plan is: someone presses the button, checks nothing broke, and writes down what they did.