Keeping WordPress updated is the single most effective thing you can do for your site’s security. Most hacked WordPress sites were running software with a known, already-fixed vulnerability.
Updates can also break things, which is why many site owners put them off. This process keeps both risks low.
What needs updating
- WordPress core: minor releases (security and bug fixes) install automatically by default. Major releases add features and need more care.
- Plugins: the most common source of vulnerabilities, and the most frequent updates.
- Themes: including your parent theme if you use a child theme.
- PHP: the language WordPress runs on, managed by your host. Old versions stop receiving security fixes.
Before you update
- Back up. Run a fresh backup of files and database. See how to set up remote backups.
- Read the changelog for major updates, especially for page builders, ecommerce, and membership plugins. Look for warnings about breaking changes.
- Use staging if you have it. Many hosts offer a one-click staging copy. Update there first for big changes.
Updating, step by step
- Go to Dashboard → Updates.
- Update plugins first, a few at a time rather than all at once, so you know which one caused a problem.
- Update themes.
- Update WordPress core.
- Clear any caching plugin, your host’s cache, and your CDN cache.
After you update
Check the pages that matter most: the home page, a typical post, your contact form, and your checkout or booking flow. Log out and view the site as a visitor, too.
Should you turn on automatic updates?
For well-maintained plugins on simple sites, yes. In Plugins, click Enable auto-updates for each one you trust. For complex plugins that run a store, memberships, or your page builder, update manually so you can test right away.
Recent versions of WordPress can roll back an automatic plugin update that causes a fatal error, which makes automatic updates safer than they used to be.
If an update breaks your site
- Check your email. When WordPress detects a fatal error, it emails the administrator a link to recovery mode, where you can deactivate the problem plugin.
- No dashboard access? Connect with SFTP or your host’s file manager and rename the plugin’s folder in
wp-content/plugins. That deactivates it. - Roll back to the previous version with a rollback plugin, or restore your backup.
- Report it to the plugin developer with the error message, so it gets fixed.
Updating PHP
Check Tools → Site Health to see your PHP version and whether WordPress recommends an upgrade. Your host’s control panel usually lets you switch versions. Test on staging first, since very old plugins may not support newer PHP.
Keep track
Updates are part of a broader routine. See the WordPress maintenance plan checklist and the monthly security checklist.
