What you need
- WordPress administrator access
- A recent backup of files and database
- A staging site, if your host offers one
Steps
Back up your site first
Before any update, make a fresh backup of both your files and your database. WordPress itself reminds you of this on the Updates screen. Use your backup plugin’s Backup Now button or your host’s backup tool, and confirm the backup finished. If an update goes wrong, this is how you get back to a working site in minutes.
Review what needs updating
Go to Dashboard, then Updates, to see everything waiting in one place: WordPress itself, plugins, themes and translations. Click a plugin’s view details link to read its changelog. Note any large version jumps or plugins that run important features, like forms, booking or checkout. Those deserve extra attention and should be updated one at a time.
Check compatibility
Open Tools, then Site Health, and look at the Info tab to see your PHP version. WordPress currently recommends PHP 8.3 or newer. On each plugin’s page in the WordPress plugin directory, check when it was last updated and which WordPress version it was tested with. A plugin with no updates in a year or more may be abandoned, so look for a maintained replacement.
Test on a staging site when you can
A staging site is a private copy of your website where you can try updates without affecting visitors. Many hosts offer one-click staging or a clone tool in their control panel. Apply the updates there first, click through your key pages, then repeat on the live site. For a simple brochure site, a good backup may be enough instead.
Update in a sensible order
Start with WordPress core by clicking the update button at the top of the Updates screen. Then update plugins, and finally themes. On a small site you can select all plugins and update them together. On a site that takes payments or bookings, update the most important plugins individually so you know exactly which one caused a problem.
Check your site right away
Open your site in a private browser window and on your phone. Visit the homepage, a few inner pages and any forms or checkout steps, and submit a test form. Clear your caching plugin or server cache if you use one, so you see the current version. Catching a problem in the first few minutes is far easier than hearing about it from a customer.
Recover if something breaks
If a plugin causes a fatal error, WordPress pauses it and emails the site’s admin address a link to recovery mode, where you can deactivate the plugin. If you cannot reach the dashboard at all, open cPanel File Manager, go to wp-content, then plugins, and rename the folder of the plugin you just updated. If the site is stuck on a maintenance message, delete the .maintenance file in your main WordPress folder.
Turn on auto-updates where it makes sense
WordPress installs minor maintenance and security releases automatically on most sites. You can also turn on auto-updates for trusted plugins on the Plugins screen, one at a time or in bulk, and for themes under Appearance, then Themes. WordPress emails you after each automatic update. Keep critical plugins, like your store or page builder, on manual updates so you can watch them closely.
Common Mistakes
- Updating without a backup and then having no clean version to go back to when the site breaks.
- Editing your theme’s files directly, so the next theme update wipes out your changes. Use a child theme instead.
- Ignoring updates for months, which leaves known security holes open and makes the eventual jump riskier.
FAQ
How often should I update WordPress and plugins?
Check for updates at least once a week. Apply security releases as soon as they appear, since attackers move quickly once a vulnerability is public. Larger feature updates can wait a few days while other site owners report any issues, but they should not sit for weeks. A regular weekly routine keeps each round of updates small and easy.
Should I turn on automatic updates for everything?
Not always. Automatic updates are great for small, well-maintained plugins and for WordPress security releases. For plugins that run critical features, such as your online store, membership area or page builder, many owners prefer manual updates after a backup so they can test right away. Combine auto-updates with automatic daily backups for the best protection.
What if a plugin has not been updated in years?
Treat it as a risk. An abandoned plugin will not get security fixes and may stop working with newer WordPress or PHP versions. Look for an actively maintained plugin that does the same job, test it on a staging site, then switch. If the feature is no longer needed, deactivate and delete the plugin entirely.