How to Update WordPress Safely Print

Why updating matters, and why people fear it

Keeping WordPress updated, its core, its themes, and its plugins, is the single most important thing you can do for your site's security. Outdated software is how the overwhelming majority of WordPress sites get hacked, as our article on hacked sites explains. So updates are not optional housekeeping, they are your main defence.

And yet people put them off, for one understandable reason: the fear that an update will break the site. That fear is not irrational, an update occasionally does cause a problem. But the answer is not to stop updating, which leaves you exposed. The answer is to update in a way that makes a breakage both unlikely and easily undone. That is what this article is about.

The one rule: back up first, every time

If you take nothing else from this article, take this: always take a backup immediately before updating. A backup taken five minutes before an update is the difference between a broken update being a minor annoyance and being a disaster. If something goes wrong, you restore the backup and you are exactly where you started, then you try again more carefully.

Our article on backups covers your options, and a cPanel full backup or a proper backup plugin both do the job. This habit alone removes almost all the risk from updating, because the worst case stops being "my site is broken" and becomes "I restore and try again."

Update in the right order

When several things need updating at once, do them in this order, and one at a time rather than all together, so that if something breaks you know exactly what caused it:

1. Back up first, as above.
2. Update plugins, one at a time where you can, checking the site after each.
3. Update your theme.
4. Update WordPress core itself.
5. Check the site properly after each step, not just that the homepage loads, but that the important pages, forms, and features actually work.

Doing them one at a time is slower, and it is how you avoid the situation where five things updated together, something broke, and you have no idea which one did it.

Let each update finish

A surprising number of update problems come from simply not letting an update complete. Do not close the browser tab mid-update, do not start a second update while one is running, and do not navigate away until WordPress confirms it is done. An interrupted update is exactly what leaves a site stuck on the maintenance message, the problem our article on the stuck maintenance mode message deals with. Start an update, let it finish, then move to the next.

If an update breaks something

• Restore your backup. This is why you took it. You are back to a working site in minutes, with nothing lost.
• If you did not back up and the site is down, deactivating plugins is your first move, as our article on deactivating all plugins describes, since a plugin update is the most common cause.
• If you are stuck, open a support ticket and tell us what you updated and what happened. Knowing the update that triggered it points us straight at the fix.

The hands-off alternative

All of this is doable yourself, and doing it regularly is the price of running your own WordPress site. But it is genuinely a recurring chore, and one that has to be done often to be worth anything, an update done once a year protects you for a week and exposes you for fifty-one.

This is exactly why we offer a WordPress update service: we keep your core and licensed plugins updated every week, backup discipline included, so it actually gets done and gets done safely. Our article on the WordPress update service covers it. If keeping on top of updates is something you would rather simply know is handled, that is what the service is for, and it removes the fear and the chore in one go.

Good to know

The safest site is one that is updated little and often, because small, frequent updates are less likely to break anything than a big backlog applied all at once after months of neglect. So whether you do it yourself or have us do it, regularity is the real secret, not caution. Back up, update promptly, let each finish, and check the result, and updating stops being something to fear and becomes the quiet routine that keeps your site secure.