How to update WordPress, plugins and themes safely

We get it. You're busy, the site is working fine, and you'd rather not poke it.

But updates matter. Out-of-date software is one of the most common ways WordPress sites get hacked. The good news is that updating safely is mostly a matter of doing things in the right order.

Why updates matter

• Security. Many updates fix weaknesses that criminals actively exploit. Once a fix is released, the details become public, and attackers go looking for sites that haven't updated yet.
• Speed and stability. Updates often include performance improvements and bug fixes. (Old software is one of the causes in our guide to why your WordPress site might be slow.)
• Compatibility. Skip updates for months and you're more likely to hit problems when you finally do update, because everything has moved on without you.

Before you start: your safety net

1. Take a full backup. That means your files and your database, stored somewhere other than your website. If an update goes wrong, a backup turns a disaster into a bad afternoon. Our hosting includes daily backups kept for 30 days, but it's still worth taking a fresh one right before a big update, so you can roll back to the minute before you started.

2. Know how to restore it. A backup you've never tested is a hopeful guess. Knowing how to get it back is half its value. If you're with us and not sure how, ask our support team before you need it.

3. Pick a quiet time. If something does go wrong, you don't want it happening during your busiest hour. Early morning or a quiet afternoon is ideal.

4. Read the changelog for big updates. For major version updates, look at what's changed. If a plugin's update notes mention "breaking changes", take extra care.

The safe update order

Update in this order, and test as you go:

1. WordPress core, the main software
2. Plugins, one at a time or in small groups
3. Themes, including your active theme

Updating one thing at a time feels slow, but if something breaks, you'll know exactly what caused it.

After each update: quick checks

Open your site in a private or incognito window (so you see what visitors see) and check:

• The homepage loads and looks right
• Your main menu and key pages work
• Forms send, and you receive the emails
• If you sell online, add something to the cart and go through checkout
• The WordPress dashboard still loads

If your site has a staging copy (a private test version), do the updates there first and only repeat them on the live site once you're happy.

What to do if something breaks

Don't panic. Here's the order to try:

1. Switch off the plugin you just updated. Do this from the Plugins page, or, if you're locked out of the dashboard, by renaming the plugin's folder in your hosting control panel's file manager.
2. Check for a newer version. Developers often release a quick fix within a few days.
3. Restore your backup if you can't find the cause quickly.
4. Ask for help. If you host with us, contact our support team by phone, email or support ticket and we'll help you get back on your feet.

Things to watch for

• Abandoned plugins. If a plugin hasn't been updated in a year or two, it may no longer be safe. Look for an alternative.
• Plugins you don't use. Delete them, don't just deactivate them. Inactive plugins can still be a way in.
• Premium plugins and themes. These usually need a valid licence to receive updates. Check yours haven't expired, or the updates will quietly stop arriving.
• Your PHP version. New WordPress and plugin versions sometimes need a newer version of PHP. You can check and change this in your hosting control panel.

Automatic updates: yes or no?

WordPress can update itself, and for minor security releases that's usually a good idea. For plugins and themes, it's a trade-off:

• Automatic means you're protected sooner, but an update could break something while you're not looking.
• Manual gives you control, but only works if you actually do it.

A sensible middle ground is automatic updates for WordPress security releases and trusted plugins, with manual updates for anything critical to your business, such as your online shop or booking system.

How often should I update?

Check at least once a week, and put security updates on as soon as you reasonably can. The longer you leave it, the bigger the jump, and the more likely something won't play nicely.

Rather not do it yourself? We can do it for you

Updates are one of those jobs that's easy to put off. If you'd rather hand it over, our web development side, Slightly Different, offers an updating service.

We'll update WordPress and your plugins for you, monthly or quarterly, for $65 + GST per update. Slightly Different designs, builds and maintains websites, so your site is in the hands of people who work with WordPress every day.

It's also a good fit alongside our hosting, which already includes:

• Daily backups kept for 30 days
• 24/7 automated monitoring with a proactive response
• Firewalls, a web application firewall and malware scanning
• Free Let's Encrypt SSL certificates

And if your site has fallen well behind, start with a one-off WordPress health check and tune (typically $165 + GST). We update your plugins, move you to the newest PHP version your site can handle, check your PHP settings, set up a performance plugin such as WP Rocket, and give you recommendations. It's also included free when you move a WordPress site to us with a year's hosting.

Not confident about updating your site?

Get in touch and we'll talk you through it, or do it for you. You can also browse our NZ web hosting plans built for WordPress.