Update WordPress safely
Keeping WordPress up to date is one of the most important things you can do for your site's security, but an update can occasionally clash with a plugin or theme. This guide shows how to update with little risk and what to do if an update causes a problem. It is for anyone who manages a WordPress site.
What gets updated
A WordPress site has three kinds of software, and each one is updated separately:
| Part | What it is | Where to update |
|---|---|---|
| Core | WordPress itself | Dashboard > Updates |
| Plugins | Add-ons that provide features | Plugins, or Dashboard > Updates |
| Themes | The design of your site | Appearance > Themes, or Dashboard > Updates |
WordPress also has translation updates for languages other than English, which are low risk.
Core versions are numbered like 6.8 or 6.8.1. A major release (the first two numbers change) brings new features. A minor release (the last number changes) contains security and bug fixes only.
Before you update
Read the changelog of large plugin updates, especially for shops, page builders and membership plugins. Developers often mention changes that need attention.
Test on a staging site first
A staging site is a private copy of your site where you can try changes without affecting visitors. If your host offers staging, update the copy first, check it, and then update the live site. This matters most for major core releases and for plugins that the whole site depends on.
Update in a sensible order
Updating one part at a time makes it easy to see which update caused a problem.
- Take a backup.
- Update plugins, one at a time or in small groups. Start with the ones your site depends on most, so you notice problems early.
- Update themes. If you customised a theme by editing its files directly, those changes are lost on update; use a child theme for custom code instead.
- Update WordPress core.
- Check the site.
Check the site afterwards
After updating, open the site in a private browser window and check:
- The home page and a few typical pages and posts.
- Forms, search, sign-in and, for shops, the basket and checkout.
- The dashboard, including the editor.
- Tools > Site Health for new warnings.
Automatic updates
WordPress installs minor core releases automatically by default. You can also choose:
- Automatic major core updates, under Dashboard > Updates.
- Automatic plugin and theme updates, using the "Enable auto-updates" link next to each plugin under Plugins and each theme under Appearance > Themes.
Automatic updates keep you protected without waiting for you to log in. The trade-off is that an update can run when nobody is watching, so combine them with automatic backups and check the site regularly. For critical plugins, you may prefer to update by hand after testing.
If an update breaks something
Restore the backup
The quickest and most reliable fix is to restore the backup you took before updating. Restore both the files and the database, because some updates change the database too. Then update again one item at a time to find the cause.
Deactivate the plugin by renaming its folder
If a plugin update stops the dashboard from loading, you can switch the plugin off without signing in.
- Connect to your site with SFTP and open
wp-content/plugins. - Rename the folder of the plugin you just updated, for example from
example-plugintoexample-plugin-off. - Reload the site. WordPress cannot find the plugin and deactivates it.
- Install an earlier version or wait for a fixed release, then rename the folder back and activate the plugin again under Plugins.
If you cannot tell which plugin is at fault, see Fix the WordPress critical error.
DomainPilot WordPress hosting installs WordPress updates automatically and takes a backup before each automatic update. One-click staging and plugin and theme updates with rollback are included from the WP Grow plan. On DomainPilot web hosting, a staging environment is included from the Business plan. See WordPress hosting.