The little red number next to Dashboard > Updates It gets higher every week, but you’re afraid to click “Update” because you’re worried your site will go down afterward. You can update WordPress safely by first creating a backup, performing the updates in small batches (plugins first, then the theme, then the WordPress core), and checking after each batch to make sure your site is still working. Below, you’ll find the order in which I update, what I let run automatically, and what to do if something goes wrong.
What Types of Updates Does WordPress Have, and How Risky Are They?
A WordPress site receives updates at three levels: the core, the theme, and the plugins, and each level carries its own risks. The core is WordPress itself. Minor maintenance releases are issued—such as from 6.8.1 to 6.8.2—which primarily fix security vulnerabilities and bugs. WordPress installs these automatically by default, and they almost never cause any issues. Major releases, such as from 6.8 to 6.9, add new features and sometimes change things that plugins rely on. With such a release, I usually wait a few days until the first fix release is available.
Theme updates affect the design. They’re especially risky if someone has ever edited the theme files directly, because the update will overwrite those customizations without warning. That’s why customizations should be placed in a child theme, a subtopic that keeps your customizations safe. Plugin updates are the most common and cause the most conflicts. That makes sense, since you’re having software from dozens of different developers work together. There’s something else to consider as well. Translations also receive updates, and the PHP version on the server changes accordingly. A plugin that requires a newer version of PHP than the one your server is running may no longer work after an update, so if in doubt, check the requirements on the plugin page.
Here's how to update in the correct order
The safest order is to create a backup, check the requirements, install plugins in small batches, install the theme, and finally update the core—with a quick test after each step.
- Back up your files and your database. This is the step that makes up for everything. You can read about how to do this properly in the Guide to WordPress Backup and Migration.
- If your site relies on revenue, test major updates on a staging environment, a copy of your site that won't bother anyone if something goes wrong.
- For major updates, read the changelog and check each plugin Tested up to and the required PHP version.
- Choose a quiet time. Not Friday afternoon at 5:00 p.m., and if you're shopping online, not during peak hours.
- Update the plugins in groups of two or three via Dashboard > Updates, then the theme, and finally WordPress itself.
- After each update, check the site. Does the homepage load, does the contact form work, and can you complete the checkout process?
Why plugins first? Developers often release a version that’s ready for the next WordPress release, so if your plugins are up to date, the new core will land on a foundation that’s ready for it. If something breaks all at once after thirty updates, you won’t know which one is to blame. With updates in pairs, you’ll know within a minute. Also pay attention to premium plugins and page builders. They only update with a valid license, and an expired license is a hidden cause of outdated software. You can read more about this in Install, manage, and update plugins.
Automatic updates: what to turn on and what to turn off
Automatic updates are safe for minor core versions and simple add-on plugins, but not for the components on which your site’s functionality depends. Since WordPress 5.5, you can under Plugins > Installed plugins per plugin Enable automatic updates click on, and at View > Themes You can do that on a per-theme basis. I always leave automatic core maintenance updates enabled, because those are your security patches. A plugin that only handles a redirect or adds a minor setting can safely update automatically.
I update your e-commerce plugin, your page builder, your theme, and everything related to payments or forms manually. Fully automatic updates sound hassle-free, but in practice, it means your site could go down at 3 a.m. while no one is watching. WordPress does send an email to the administrator’s address after an automatic update, so make sure that address is being monitored. If a plugin hasn’t received any updates for a long time, the question isn’t when to update it but whether it should still be there. In Clean up outdated plugins You can read my take on that.
If an update breaks your site
If an update breaks your site, disable the most recently updated plugin or theme, and if that doesn’t help, restore the backup from before the update. First, I clear the cache, because a broken layout is surprisingly often just an old cached version. If that doesn’t help, I deactivate the plugin that was updated most recently. If you can no longer access the dashboard, rename the folder for that plugin via the file manager or SFTP to wp-content/plugins, after which WordPress disables it.
If your site gets stuck on a message saying it's temporarily unavailable due to scheduled maintenance, it means an update was interrupted. In that case, delete the file .maintenance in your site's root directory and run the update again. If you want to revert to the previous version of a single plugin, you can do so using a rollback plugin like WP Rollback. This is faster than restoring a full backup, but only if you’re certain that plugin is the source of the problem. Afterward, report the issue to the developer and wait for a fixed version. The complete troubleshooting guide, explaining what each symptom means, can be found in Site Down After an Update.
Make it a regular habit
The best update strategy is a boring one: set a fixed time each week or every two weeks to back up, update, and check your site. Fifteen minutes a week is safer than spending an afternoon every quarter on thirty updates. The longer you wait, the greater the risk. An updated site can be brought up to date in five minutes, but a neglected site becomes a project because you’ll have to bridge multiple major versions at once. Use the WordPress Maintenance Checklist as a guideline. The general maintenance schedule is listed in WordPress Management: The Complete Guide.
If you'd rather not do this yourself, we at Surver will take care of it for you with WordPress maintenance. We update the core, themes, and plugins every month. The extent of our subsequent checks depends on your package—ranging from no checks for the Personal plan to a functional check for the Business plan, and for the Enterprise plan, we first test the updates on staging. If your site has been down for a while, catching up on those issues is also included. If you’d rather do it yourself on our Managed WordPress Hosting, then create a staging environment by cloning your installation in Installatron, and restore a backup using JetBackup 5 in cPanel. Be sure to create a fresh backup before restoring, because the current state is not automatically saved.
Frequently Asked Questions
How often should I update WordPress?
Check for updates at least once a week, and install security updates as soon as possible. For a small site without an online store, checking once every two weeks is also fine, as long as automatic core maintenance updates are enabled.
What happens if I don't update WordPress?
Your site will continue to work as usual for now, but known vulnerabilities in old plugins and themes are being actively exploited by bots. Outdated software is the most common cause of hacked WordPress sites that I come across. In addition, each subsequent update is getting larger and therefore riskier.
Will I lose my content during a WordPress update?
No, your pages, posts, and settings are stored in the database, and an update only replaces software files. However, customizations made to a parent theme may be lost, which is why you should always make a backup first. At Surver, we also create daily, weekly, and monthly backups for our shared hosting plans.
