WordPress updates: keep your site safe and working

Why WordPress updates matter for your business

An outdated plugin with a known vulnerability can leave an opening even when your password is strong. The WordPress security handbook recommends keeping plugins updated and removing unused ones. Updates belong alongside access controls, monitoring and backups in your WordPress security checklist.

• Protect inquiries

  A broken form can look normal until someone submits it. After updating, send a labeled test and confirm it reaches the staff inbox and any connected customer system.

• Keep sales moving

  A store needs more than a working homepage. Test product options, shipping, payment and confirmation because these functions can depend on different plugins.

• Keep public pages intact

  Check important landing pages, titles and links after changes. Updating software is not a promise of better Google rankings; the practical goal is to preserve a useful, accessible site.

Start with the functions that bring your business money or qualified leads. Our WordPress website guide connects those priorities to design, speed and ongoing care, so maintenance supports the whole customer journey.

WordPress updates reach beyond the dashboard

Minor core updates have been automatic by default on most sites since WordPress 3.7. New installations since 5.6 can also enable major core updates by default, with exceptions such as version-controlled installs. Check your actual settings against the official update documentation.

PHP runs WordPress code; the server operating system supports the environment underneath it. Neither is updated by clicking Update Plugins. Ask whether your host handles these layers and who checks the site after a version change or restart.

WordPress auto update: choose a middle path

Since WordPress 5.5, administrators can opt into automatic updates for individual plugins and themes. The official auto-update guide explains the controls. A WordPress plugin auto update setting authorizes installation; it does not establish that the new version works with your particular site.

• Minor core fixes

  Usually keep these automatic, backed by scheduled backups and alerts. Someone still needs to investigate a failed installation or a change in customer-facing behavior.

• Lower-impact plugins

  Consider automation when the component is maintained, recovery is tested and a failure would be contained. Revisit the decision when the plugin's role or dependencies change.

• Critical components

  Stage major core releases, WooCommerce, payment gateways, page builders and custom integrations. These components can interact in ways their individual release notes cannot fully predict.

define('WP_AUTO_UPDATE_CORE', 'minor');

How to disable auto updates selectively

Use the individual plugin or theme toggle to disable its automatic updates. For major core automation, ask your maintainer to review the core setting above, host controls and any overrides. Record who will install deferred releases and when they will review them.

Make update notifications reach the right person

WordPress normally sends emails after automatic core updates and after plugin or theme auto-update attempts. Plugin/theme reports can include successes and failures; their default recipient is the site's administration email, as shown in the WordPress notification reference. For a standard single site, verify that address in Settings > General.

How to run WordPress updates safely

Staging is a private copy where you can test without interrupting customers. Use the same relevant hosting settings as production, and record a working baseline before changing anything. Our maintenance checklist places this process within weekly and monthly care.

1. Step 1

   Review scope and urgency

   List installed and target versions, licenses and vendor requirements. Identify security fixes, dependencies and database migrations, then choose a maintenance window around the business's busiest customer activity.

2. Step 2

   Back up and verify recovery

   Capture matching files and database, confirm the independent copy is accessible and identify the restore owner. Follow our WordPress backup guide and account for orders or inquiries received after that backup.

3. Step 3

   Prepare protected staging

   Clone a current copy, restrict access and block indexing. Disable live payments, customer emails, webhooks and scheduled integrations; route test mail to a controlled inbox and restrict copied customer data.

4. Step 4

   Apply changes in the supported order

   Follow vendor dependencies, updating critical components individually and checking between changes. Keep PHP and major application changes separate where practical so a failure has a clearer cause.

5. Step 5

   Test forms, checkout and key pages

   Compare against the baseline on desktop and a phone. Confirm inbox delivery, payment and order records where relevant, inspect errors and stop if a business-critical check fails.

6. Step 6

   Deploy the tested changes

   Take a fresh live backup, then apply the tested versions or deploy selected code. Never overwrite new live orders or submissions with the staging database; plan database migrations and any pause in writes explicitly.

7. Step 7

   Monitor and use the recovery plan if needed

   Clear relevant caches, repeat critical live tests and watch errors and background jobs. If a failure appears, stop further changes and choose repair or rollback while preserving new records, then document the result.

Test the actions that bring leads and sales

A page loading successfully does not prove the site works. Choose acceptance tests before the update, using specific pages, devices and expected results. For a bilingual site, include both language versions rather than assuming one passing test covers both.

If a change affects products, cart behavior or payment, use the deeper checks in our WooCommerce optimization guide. Save the test result and the affected URL, so a later issue can be traced to evidence rather than memory.

Update a WordPress theme without losing changes

Updating a parent theme can overwrite direct edits in its files. A WordPress child theme keeps supported custom overrides separate, but those overrides still need compatibility testing. Before updating, identify where the site's design and custom behavior actually live.

For sites built with Elementor, Divi or WPBakery, the builder, theme and add-ons can depend on each other. Our page builder guide explains these choices. Record the tested combination instead of treating each component as an isolated update.

WordPress update failures: recognize and recover

Failures can appear as a blank screen, a critical-error notice, a broken layout or an update that never finishes. A quieter failure is a form or payment request that stops working. Preserve the error, timestamp and recent version changes before trying unrelated fixes.

1. Confirm

   Identify what failed

   Check the public site, admin access, host status and logs. An interrupted update can involve file permissions, storage, downloads or incompatible code; the symptom alone does not identify the cause.

2. Contain

   Stop adding changes

   Pause further deployments and preserve the current database. Have the maintainer isolate the suspect component or restore a compatible version, checking whether its data format changed before rolling back.

3. Recover

   Verify the repair

   Repeat customer tests and confirm new records remain intact. If a full restore is needed, coordinate preservation and reconciliation of recent orders and inquiries before replacing data.

wp plugin update --all --dry-run
wp core verify-checksums

The plugin dry run previews available plugin updates without installing them. Core checksum verification compares core files with the official release; it does not verify your themes, plugins or business functions.

What a WordPress update service should include

When you hire someone to update a WordPress website, ask how they will prove it still works and recover if it does not. Request a written scope covering critical plugins, hosting responsibilities, test journeys and unresolved compatibility issues.

Component: [name, old version, new version]
Backup: [time, location, restore owner]
Staging: [tests and result]
Live: [deployment time and checks]
Deferred: [reason, owner, review date]
Recovery: [action taken, if any]

Fer Marketing's WordPress maintenance plans start at $250 per month per site, with a fixed written quote before work. We review updates weekly, test critical changes, maintain backups and monitor the site. Fernando Marcano, our founder and an IT engineer, brings more than 20 years of hands-on IT experience.

Agencies can use staging on their domain and white-label WordPress care, with NDA and non-solicitation available. Contact us through WhatsApp or fer@fer.marketing for a same-business-day reply, 9 AM to 9 PM ET; payment is by card through Stripe after scope is agreed.