# WordPress updates: keep your site safe and working

> WordPress updates replace older core, plugin and theme software with releases that fix security flaws, correct bugs or add features. A safe update plan combines backups, a private test copy and checks that customers can still contact you or buy. Automate selectively, give alerts an owner and keep a tested way back.

Canonical: https://fer.marketing/wordpress-updates
Author: Fernando Marcano, Fer Marketing
Updated: 2026-10-17

- **Routine:** Weekly review, urgent fixes sooner
- **Automation:** Minor core fixes, with oversight
- **Testing:** Staging before critical changes
- **Recovery:** Matching files and database

## Why WordPress updates matter for your business

An outdated plugin with a known vulnerability can leave an opening even when your password is strong. The [WordPress security handbook](https://developer.wordpress.org/advanced-administration/security/hardening/) recommends keeping plugins updated and removing unused ones. Updates belong alongside access controls, monitoring and backups in your [WordPress security checklist](https://fer.marketing/wordpress-security-checklist).

- **Protect inquiries.** A broken form can look normal until someone submits it. After updating, send a labeled test and confirm it reaches the staff inbox and any connected customer system.
- **Keep sales moving.** A store needs more than a working homepage. Test product options, shipping, payment and confirmation because these functions can depend on different plugins.
- **Keep public pages intact.** Check important landing pages, titles and links after changes. Updating software is not a promise of better Google rankings; the practical goal is to preserve a useful, accessible site.

Start with the functions that bring your business money or qualified leads. Our [WordPress website guide](https://fer.marketing/wordpress-web-design) connects those priorities to design, speed and ongoing care, so maintenance supports the whole customer journey.

## WordPress updates reach beyond the dashboard

Minor core updates have been automatic by default on most sites since WordPress 3.7. New installations since 5.6 can also enable major core updates by default, with exceptions such as version-controlled installs. Check your actual settings against the [official update documentation](https://developer.wordpress.org/advanced-administration/upgrade/upgrading/).

| Layer | What changes | Usual approach |
| --- | --- | --- |
| Core: minor | Fixes, security | Auto + checks |
| Core: major | Broader features | Staging first |
| Plugins | Site functions | Assess impact |
| Themes | Layout, templates | Visual tests |
| PHP | Code runtime | Host + staging |
| Server OS | System packages | Host + monitoring |

PHP runs WordPress code; the server operating system supports the environment underneath it. Neither is updated by clicking Update Plugins. Ask whether your host handles these layers and who checks the site after a version change or restart.

> **Read the change, not just the version number:** A small plugin release can alter a payment integration or database structure. Review the vendor's release notes, requirements and supported upgrade order, especially when the site has fallen behind several releases.

## WordPress auto update: choose a middle path

Since WordPress 5.5, administrators can opt into automatic updates for individual plugins and themes. The [official auto-update guide](https://wordpress.org/documentation/article/plugins-themes-auto-updates/) explains the controls. A WordPress plugin auto update setting authorizes installation; it does not establish that the new version works with your particular site.

- **Minor core fixes.** Usually keep these automatic, backed by scheduled backups and alerts. Someone still needs to investigate a failed installation or a change in customer-facing behavior.
- **Lower-impact plugins.** Consider automation when the component is maintained, recovery is tested and a failure would be contained. Revisit the decision when the plugin's role or dependencies change.
- **Critical components.** Stage major core releases, WooCommerce, payment gateways, page builders and custom integrations. These components can interact in ways their individual release notes cannot fully predict.

**Example core policy in wp-config.php**

```
define('WP_AUTO_UPDATE_CORE', 'minor');
```

Have your maintainer edit the existing definition before the stop-editing comment, without duplicates. This limits core automation to minor releases; it does not select plugin or theme policies.

### How to disable auto updates selectively

Use the individual plugin or theme toggle to disable its automatic updates. For major core automation, ask your maintainer to review the core setting above, host controls and any overrides. Record who will install deferred releases and when they will review them.

> **Manual does not mean postponed indefinitely:** Keep critical components on a supervised schedule and accelerate review for urgent security fixes. If a safe update is blocked, arrange a temporary protective measure or replacement and track the unresolved risk.

## Make update notifications reach the right person

WordPress normally sends emails after automatic core updates and after plugin or theme auto-update attempts. Plugin/theme reports can include successes and failures; their default recipient is the site's administration email, as shown in the [WordPress notification reference](https://developer.wordpress.org/reference/classes/wp_automatic_updater/send_plugin_theme_email/). For a standard single site, verify that address in Settings > General.

**Give every alert an owner**

- [ ] Check the administration mailbox.: Confirm it belongs to the current business or maintenance team. It can differ from your own login email; verify any pending address change.
- [ ] Confirm actual email delivery.: Check the inbox, spam and mail logs with a controlled test. If delivery is unreliable, follow our [WordPress email guide](https://fer.marketing/wordpress-not-sending-email).
- [ ] Inspect Site Health.: Tools > Site Health can flag background-update or scheduled-task problems. The official auto-update guide points here when scheduled updates fail to run.
- [ ] Name a backup contact.: Decide who acknowledges failures when the main maintainer is unavailable. Host dashboards and maintenance tools may send separate alerts or change default routing.

> **A success email is an installation receipt:** It cannot tell you whether a customer completed checkout or your receptionist received a quote request. Keep external monitoring and visitor tests alongside update reports.

## How to run WordPress updates safely

Staging is a private copy where you can test without interrupting customers. Use the same relevant hosting settings as production, and record a working baseline before changing anything. Our [maintenance checklist](https://fer.marketing/guides/wordpress-maintenance-checklist) places this process within weekly and monthly care.

*Diagram: Backup, staging, update, test, live and monitoring, with a rollback route prepared before deployment.*

1. **Review scope and urgency.** List installed and target versions, licenses and vendor requirements. Identify security fixes, dependencies and database migrations, then choose a maintenance window around the business's busiest customer activity.
2. **Back up and verify recovery.** Capture matching files and database, confirm the independent copy is accessible and identify the restore owner. Follow our [WordPress backup guide](https://fer.marketing/wordpress-backups) and account for orders or inquiries received after that backup.
3. **Prepare protected staging.** Clone a current copy, restrict access and block indexing. Disable live payments, customer emails, webhooks and scheduled integrations; route test mail to a controlled inbox and restrict copied customer data.
4. **Apply changes in the supported order.** Follow vendor dependencies, updating critical components individually and checking between changes. Keep PHP and major application changes separate where practical so a failure has a clearer cause.
5. **Test forms, checkout and key pages.** Compare against the baseline on desktop and a phone. Confirm inbox delivery, payment and order records where relevant, inspect errors and stop if a business-critical check fails.
6. **Deploy the tested changes.** Take a fresh live backup, then apply the tested versions or deploy selected code. Never overwrite new live orders or submissions with the staging database; plan database migrations and any pause in writes explicitly.
7. **Monitor and use the recovery plan if needed.** Clear relevant caches, repeat critical live tests and watch errors and background jobs. If a failure appears, stop further changes and choose repair or rollback while preserving new records, then document the result.

> **Want safe updates handled every week?** We review and update your site safely every week, with staging for critical changes, backups and checks of the journeys your customers use. Urgent security fixes receive prompt review. https://fer.marketing/services/wordpress-maintenance

## Test the actions that bring leads and sales

A page loading successfully does not prove the site works. Choose acceptance tests before the update, using specific pages, devices and expected results. For a bilingual site, include both language versions rather than assuming one passing test covers both.

**Keep evidence of these results**

- [ ] Contact and quote forms: Submit a labeled test, check required fields and attachments where used, confirm inbox delivery and verify the receiving customer system.
- [ ] Store or booking journey: Check options, availability, totals, payment, confirmation and saved records. Use sandbox payments on staging and coordinate any controlled live transaction.
- [ ] Layout and navigation: Inspect mobile menus, important landing pages, buttons and footer contact details. Compare with baseline captures, including templates built with a page builder.
- [ ] Background work and public pages: Review scheduled jobs, integration errors and important page responses. Confirm staging restrictions were not copied to production, then recheck monitoring and backups.

If a change affects products, cart behavior or payment, use the deeper checks in our [WooCommerce optimization guide](https://fer.marketing/woocommerce-optimization). Save the test result and the affected URL, so a later issue can be traced to evidence rather than memory.

## Update a WordPress theme without losing changes

Updating a parent theme can overwrite direct edits in its files. A [WordPress child theme](https://developer.wordpress.org/themes/advanced-topics/child-themes/) keeps supported custom overrides separate, but those overrides still need compatibility testing. Before updating, identify where the site's design and custom behavior actually live.

**Do**
- Inventory child-theme files, snippets and custom plugins.
- Back up templates and database-held settings.
- Compare key layouts and test custom functions on staging.
- Review outdated overrides when the parent changes.

**Don't**
- Edit the parent theme and assume updates preserve it.
- Assume a child theme prevents every conflict.
- Replace the live database to copy a layout change.
- Leave an unsupported theme untouched forever.

For sites built with Elementor, Divi or WPBakery, the builder, theme and add-ons can depend on each other. Our [page builder guide](https://fer.marketing/wordpress-page-builders) explains these choices. Record the tested combination instead of treating each component as an isolated update.

## WordPress update failures: recognize and recover

Failures can appear as a blank screen, a critical-error notice, a broken layout or an update that never finishes. A quieter failure is a form or payment request that stops working. Preserve the error, timestamp and recent version changes before trying unrelated fixes.

> **Recovery Mode helps with some fatal errors:** Since WordPress 5.2, certain fatal errors can trigger an administrator email with a private Recovery Mode login link. It can pause the faulty component for your session; it does not automatically repair the public site. Email delivery can fail, so retain hosting access and follow the [Recovery Mode documentation](https://wordpress.org/documentation/article/recovery-mode/).

- **Confirm, Identify what failed.** Check the public site, admin access, host status and logs. An interrupted update can involve file permissions, storage, downloads or incompatible code; the symptom alone does not identify the cause.
- **Contain, Stop adding changes.** Pause further deployments and preserve the current database. Have the maintainer isolate the suspect component or restore a compatible version, checking whether its data format changed before rolling back.
- **Recover, Verify the repair.** Repeat customer tests and confirm new records remain intact. If a full restore is needed, coordinate preservation and reconciliation of recent orders and inquiries before replacing data.

**Two checks your maintainer can show you**

```
wp plugin update --all --dry-run
wp core verify-checksums
```

Examples for an experienced maintainer using WP-CLI in the correct installation. The preview is not a compatibility test, and the checksum check is not a complete security audit.

The [plugin dry run](https://developer.wordpress.org/cli/commands/plugin/update/) previews available plugin updates without installing them. [Core checksum verification](https://developer.wordpress.org/cli/commands/core/verify-checksums/) compares core files with the official release; it does not verify your themes, plugins or business functions.

## What a WordPress update service should include

When you hire someone to update a WordPress website, ask how they will prove it still works and recover if it does not. Request a written scope covering critical plugins, hosting responsibilities, test journeys and unresolved compatibility issues.

**A useful update record**

```text
Component: [name, old version, new version]
Backup: [time, location, restore owner]
Staging: [tests and result]
Live: [deployment time and checks]
Deferred: [reason, owner, review date]
Recovery: [action taken, if any]
```

Fer Marketing's [WordPress maintenance plans](https://fer.marketing/services/wordpress-maintenance) start at $250 per month per site, with a fixed written quote before work. We review updates weekly, test critical changes, maintain backups and monitor the site. Fernando Marcano, our founder and an IT engineer, brings more than 20 years of hands-on IT experience.

Agencies can use staging on their domain and [white-label WordPress care](https://fer.marketing/white-label/wordpress), with NDA and non-solicitation available. Contact us through WhatsApp or fer@fer.marketing for a same-business-day reply, 9 AM to 9 PM ET; payment is by card through Stripe after scope is agreed.

## Want us to update your WordPress site safely?

We handle weekly updates with a tested recovery path and checks of your site's essential functions. Maintenance starts at $250 per month per site, with a fixed written quote before work.

- Core, plugin and theme update policies with an owner
- Scheduled independent backups and tested restores
- Protected staging for critical updates and compatibility checks
- Form, checkout or booking tests matched to your site
- Update alerts, monitoring and a record of deferred changes

https://fer.marketing/services/wordpress-maintenance

## FAQ

### Should I enable WordPress auto updates?

Usually keep minor core fixes automatic, with backups, monitoring and a named responder. Decide plugin and theme automation by business impact, and use supervised staging tests for major releases and components that control payments, layouts or essential integrations.

### How do I disable WordPress auto updates?

Disable individual plugin or theme automation through its toggle. Have your maintainer review the core update policy and host overrides separately, then document a manual review schedule and an owner for anything you disable.

### Can a WordPress plugin auto update break my site?

Yes. A new plugin version may conflict with a theme, another plugin, custom code or PHP. Test critical components on staging, maintain recovery copies and check the actual customer journey after deployment, even if the installation reports success.

### How often should WordPress updates be reviewed?

Review available updates at least weekly as a practical routine, then assess urgent security fixes when announced. Timing depends on exposure and business impact; a weekly appointment is not a reason to delay an urgent protective action.

### How can I update a WordPress theme without losing changes?

First locate custom code and settings, then back up files and database. Keep supported file customizations in a child theme or an appropriate custom plugin, and test layouts and overrides on staging before updating live.

### What should I do after a WordPress update failure?

Stop additional changes, record the error and ask the maintainer to inspect logs and recent versions. Use Recovery Mode if available or hosting access when needed, then repair or roll back while preserving new orders and submissions.

### Who receives WordPress update notification emails?

On a standard single site, automatic plugin and theme update reports normally go to the site's administration email, which can differ from your login email. Hosts, plugins or custom settings may change delivery, so verify the actual recipient and assign someone to act.

### Can I hire someone to update my WordPress website?

Yes. Fer Marketing offers ongoing maintenance from $250 per month per site and separately scoped one-time update work from $250. You receive a fixed written quote before work, covering the agreed changes, backup, testing and recovery approach; agency work is available white-label.

Send your site for a fixed written quote from $250, with a same-business-day reply and white-label support for agencies.