How to update WordPress safely, step by step

Updates do three jobs. They fix security holes, they fix bugs, and they add features and compatibility with newer versions of PHP and browsers. Of these, security is the one that cannot wait. When a weakness in a plugin is made public, automated tools begin scanning the web for sites still running the old version within a short time. A site that is a few weeks behind is a very easy target.

People avoid updating because they fear breaking the site, and that fear is reasonable. A plugin update can occasionally clash with the theme or another plugin. The answer is not to stop updating, but to update with a safety net: a backup, a tested process and a quick way back. Done properly, an update is a routine ten minute task rather than a gamble.

Small sites benefit most from habit. Pick a regular time each week, perhaps Monday morning, and work through the update screen. Sites that are updated weekly rarely have more than a handful of changes at once, which makes any problem easy to trace. Sites that are left for a year arrive at a pile of major version jumps, and that is where the real trouble starts.

WordPress can apply minor core updates automatically, and you can also turn on automatic updates for individual plugins and themes from the Plugins and Themes screens. For a simple brochure site, automatic updates for trusted, well supported plugins are a sensible choice, because the security benefit outweighs the small risk of something going wrong.

For a shop, a booking site or any site where downtime costs money, be more careful. Let minor core updates run automatically, but update plugins by hand after a backup, ideally on staging. A broken checkout plugin that goes unnoticed overnight can cost far more than a few days of delay.

Whatever you choose, do not rely on automation alone. Automatic updates can fail quietly, and a plugin the author has abandoned never gets a fix at all. Look at the Updates screen each week and read any emails WordPress sends about failed updates.

First, stay calm and avoid making more changes. If you see a white screen or a critical error, our guide to the WordPress white screen of death walks through the fixes. The most common cause after an update is a single plugin or theme, so the first move is usually to disable the one you just updated.

If you cannot reach the dashboard, rename the plugin folder inside wp-content/plugins using the file manager or SFTP. WordPress then treats that plugin as inactive and the site often returns at once. Once you are back in, check for a newer version, read the plugin support forum and decide whether to wait for a fix or replace it.

If the damage is wider, restore the backup you took before you began. That is exactly what it is for. Contact our live chat (open 24/7) if you would like help bringing back a copy, and tell us the time you started updating so we can pick the right one.

Imagine a small business site with eight plugins and a custom child theme. On Monday morning you open the Updates screen and see three plugin updates and one minor core release. You take a backup, let core update, load the home page, then update the plugins one at a time. After the second, the contact form looks odd. You roll that single plugin back, note the problem and move on with the rest.

The whole session takes about fifteen minutes, and because you changed only a few things you knew exactly where to look. Compare that with a site left for a year, where dozens of updates arrive together and a fault could come from any of them. Small, regular steps are the safest approach, and they are also the least stressful.