If you are running an old version of Drupal 8, it is likely that your site can be compromised by the known vulnerabilities. And to guard your site against possible hacks, you should update Drupal core to latest stable release in 8.x branch.
Drupal 8 core update
If you are not using or managing your Drupal 8 website using composer, here are the steps to update your Drupal 8 core:
- Tack backup of your site, both codebase and the Database. Download latest release of Drupal 8 core.
- Copy all the files and directories from downloaded version except 'sites' and 'modules'. We assume you did not make changes to any core modules or themes. If you need to, take a backup of .htaccess and 'profiles' directory as well.
- Overwrite your site codebase with copied files and directories.
- Restore all the files that you previously modified.
- Perform DB update and composer update.
- At this stage, do not perform an update to contrib modules. Contrib module updates are not consistent and you can not rely on them to be act so. This is very efficient method when you did not alter any core or contrib module/theme files.