Why update at all
When a security hole is found in a popular plugin, the author releases a fix and the vulnerability becomes public. From that moment, automated scanners across the internet look for sites that haven’t installed the fix yet. You don’t have to be an important target. Being on the results list is enough.
But updates aren’t only about security:
- compatibility: new versions of PHP, browsers and WordPress itself need up-to-date plugins,
- performance: newer versions are often faster and lighter on resources,
- bug fixes: some annoying issues simply disappear after an update.
What needs updating
- WordPress core: minor maintenance releases usually install automatically, major versions need to be started manually.
- Plugins: the most common source of vulnerabilities, as there are many of them, written by many different authors.
- The theme (and the parent theme, if you use a child theme).
- The PHP version on the server, set in the hosting panel. Old versions stop receiving security fixes.
- Translations: low-risk, but worth installing too.
Watch out for abandoned plugins. If a plugin hasn’t been updated in a long time or has disappeared from the official directory, it won’t get any more fixes. Replace it with something maintained, or build the feature into the theme.
What can go wrong
An update changes code, so sometimes things stop fitting together: a plugin clashes with the new theme, a form looks different, or the site shows a critical error. The risk grows when:
- updates have been put off for months and several versions need to be skipped at once,
- the site relies on many plugins, especially heavy page builders,
- someone once edited a theme or plugin’s files directly, as a quick fix. An update will overwrite those changes.
So not updating isn’t the answer. The answer is updating regularly, following a proven procedure.
A safe procedure, step by step
- Make a fresh backup of the files and database. Details in the guide to website backups.
- Read the changelog for bigger updates. If the author mentions breaking changes, plan for testing.
- Try it on a test copy first (a staging site), especially for stores and major versions. Many hosts let you create one in a single click.
- Update one thing at a time, not everything at once. If something breaks, you immediately know the cause.
- Test the key paths: the home page, the contact form, logging in, and in a store, adding to cart and placing an order.
- Keep an eye on the site for the next few hours: error logs, customer emails, orders.
How often
- Security fixes: as soon as possible, ideally within a few days of release, and immediately for critical vulnerabilities.
- Everything else: regularly, e.g. every week or two. Small, frequent steps are safer than one huge update every six months.
Automatic plugin updates make sense for simple sites and well-established, popular plugins. For an online store or custom code, it’s better to have someone review every change.
Checklist
- I know who updates my website and how often.
- A backup is made before every update.
- I have a staging site, or at least a plan to quickly roll back to the previous version.
- There are no abandoned or unused plugins on the site.
- The server runs a supported PHP version.
- I don’t use “free” copies of paid plugins and themes from unofficial sources.
- After updating, I check forms, logins and (in a store) the checkout.
