Update promptly, but never untested
Apply WordPress updates regularly and promptly, security updates within a few days. As a routine, updates rarely cause trouble. If you leave them sitting for months, you eventually end up with both: a vulnerable website and a big, risky update jump.
- 01
A current backup
Files and database, proven to restore.
- 02
A test on a copy
Errors show up before visitors see them.
- 03
A fixed order
Core, plugins, extensions, theme, translations.
Why postponing is the bigger risk
Most vulnerabilities are in plugins
The WordPress core itself is well maintained. The problem is almost always the extensions. Every additional plugin is one more piece of software that needs maintaining.
Attacks are automated
“My site is too small to be interesting” makes no difference. Programs scan the internet for websites running a specific vulnerable plugin version. By that measure, an update left sitting for three weeks is a very long time.
- 01Spam pages that damage your Google ranking
- 02Redirects to other people’s sites
- 03Stolen customer data
- 04A reporting duty under the GDPR
Prompt updates are therefore more than caution: the GDPR requires security in line with the state of the art. More on that in the guide Updates are mandatory.
Why updates break websites
The fear of updates is not unfounded. When something stops working afterwards, one of these causes is usually behind it.
Plugin conflicts
Plugins from different developers access the same functions and load their own scripts. An update to plugin A can trigger an error in plugin B, even though each works fine on its own.
The server’s PHP version
New plugin versions often require newer PHP, and older plugins sometimes no longer run on current PHP. A PHP switch at your host needs testing just like a plugin update.
Page builders
Elementor, Divi or WPBakery store layouts in their own structures. Bigger updates occasionally change them, and add-on packs do not always follow right away: shifted spacing, missing elements.
WooCommerce template overrides
Themes override WooCommerce templates with their own copies. When WooCommerce changes the original, the copy stays old, with results from display glitches to a broken cart. Check under “WooCommerce › Status › Templates”.
Big version jumps
The longer updates sit, the more often you end up with big jumps, and the more changes at once.
Automatic updates: what happens on its own?
WordPress 3.7
Minor core updates and translations are applied automatically.
WordPress 5.5
Automatic updates can be switched on for each plugin and theme individually. Off by default.
WordPress 5.6
New installations also receive major versions automatically. Older ones keep the old behavior.
WordPress 6.6
After an automatic plugin update, WordPress checks whether the homepage loads without a fatal PHP error, and restores the old version otherwise.
Whether your website receives major versions automatically is shown under “Dashboard › Updates”. For critical vulnerabilities, the WordPress security team can in individual cases push a plugin update automatically.
Vulnerabilities close quickly, without anyone having to remember.
For a simple website with few plugins, that is an acceptable solution.
- The update goes live untested, usually at night when nobody is watching.
- The rollback only detects fatal PHP errors. A shifted layout, silent forms or a stuck checkout go unnoticed.
- With several updates in one night, it is hard to tell which one caused the error.
For a store or a website that brings in inquiries, I recommend a controlled routine.
A practical update routine in seven steps
The first five steps happen before and on the copy. Only step six touches the live website.
- 1
Create and check a backup
Back up files and database before you update anything. A backup that has never been restored is a hope, not a safeguard.
- 2
Test on a copy
Apply updates to a staging environment first. Things are allowed to break there without visitors seeing it. The options are covered in the staging comparison.
- 3
Read the changelogs
Look at the release notes before big updates. Changed minimum requirements, removed features or a new major version mean more testing time.
- 4
Update in a fixed order
If you update plugins one by one and check briefly after the important ones, you know immediately which update is to blame when something breaks.
- 1WordPress core
- 2Plugins, big ones individually
- 3Dependent extensions
- 4Theme and child theme
- 5Translations
- 5
Then test what matters
Check the things that count for your business:
- Forms and email sending
- WooCommerce test order
- Layout on a smartphone
- Clear cache and CDN
- Site Health and WooCommerce status
- 6
Apply live
Only once everything works on the copy do the same updates go live. At a quiet time, then repeat the most important tests in short form.
- 7
Document
Note what was updated when. If something shows up a week later, this list is the fastest way to the cause.
When an update goes wrong anyway
Even with a good routine, an error may only show up live, for example because a different cache is active there or visitors take a path nobody tested. Then calm and a clear sequence help:
- 1
Narrow it down
What is not working, since when, and which updates came last? This is where the documentation pays off.
- 2
Roll back individually
If the error can be traced to one plugin, only that plugin is set back to its previous version.
- 3
Backup only if necessary
A full restore deletes everything since then, including new inquiries or orders. The last resort.
- 4
Fix the cause, apply again
A rolled-back security update only helps temporarily. With the older version, the vulnerability is open again.
How I handle this with the Doppelgänger
For my clients I take over this routine completely. Every WordPress website gets a Doppelgänger: an exact copy on a separate server in Germany. Every release is stored as a version of its own.
Always on the copy first
I update core, plugins and theme regularly on the Doppelgänger. With WooCommerce I test through to checkout, using the payment providers’ test modes.
Security updates in 24 to 48 hours
After testing, I usually apply security updates within 24 to 48 hours.
Publishing without downtime
Automated publishing brings exactly the tested version live in a few minutes. Going back to the previous state takes seconds.
Eight nightly security checks
On top of that, eight automated security checks examine the live website every night.
What this looks like in detail is on the page The Doppelgänger for WordPress.
Quick answers.
How often should I apply WordPress updates?
Security updates as quickly as possible, ideally within one to two days. For regular feature updates a fixed schedule is enough, such as weekly or every two weeks. Do not let updates pile up for months, or every step gets bigger and harder to test.
Should I turn on automatic updates for plugins?
For simple websites with a few well-maintained plugins it can make sense. For stores, websites with page builders or custom modifications it is risky, because an update goes live untested at night. A middle way is to apply only security updates quickly and to test bigger version jumps on a copy first.
What do I do if the site stays white after a WordPress update?
Usually a plugin or theme is not compatible with the new version and causes a PHP error. In that case WordPress often sends an email with a link to recovery mode, where you can deactivate the plugin in question. Without a backup or access via FTP or SSH it gets difficult, which is why the backup always comes before the update.
Do I need to update inactive plugins and themes too?
Yes, or better: delete them. Deactivated plugins and themes still sit on the server as files and, depending on the vulnerability, can be attacked. Whatever is deleted does not need maintaining either.
Do I really need a staging environment for updates?
For a small brochure website a good backup is often enough. As soon as the website brings in revenue, generates inquiries or uses WooCommerce, a test copy is the safer choice, because errors show up there before customers see them. I compare the different kinds of staging in a guide of its own.