Hacker News Reader

A shitload of small business sites that were built years ago and haven't been touched since.

If they are static sites that shouldn't be a problem. Many are probably not though.

My suspicion is at least half are unpatched WordPress installs.

My suspicion is closer to 95%

And the remaining 5% are unpatched Joomla and Drupal installs.