Updates fix security holes and bugs, so skipping them is the bigger risk. Still, an update can occasionally clash with another plugin or your theme. A short routine makes updates boring, which is exactly what you want.
Before you start
- A fresh backup of files and database, or a JetBackup restore point from today.
- Ideally a staging copy of the site for large updates, such as a new major version of WooCommerce or a page builder.
- A quiet time for the site, such as early morning in your visitors' time zone.
Read before you click
Open Dashboard → Updates. For each plugin with an update, click View version details. Look for words like "breaking change", "requires PHP 8.x" or "database update". Those updates deserve a staging test first; minor bug fix releases usually do not.
Update in the right order
- Back up or confirm a backup exists.
- Plugins: update a few at a time, not all at once, so you know which one caused a problem.
- Themes: update the parent theme. Your changes are safe only if you use a child theme.
- WordPress core: click Update to version x.y. Minor releases install automatically by default.
- Translations: update last.
Some plugins, such as WooCommerce, ask to run a database update after the code update. Click the notice to run it, and only after your backup.
Check the site afterwards
- Load the home page, a post and a page in a private window.
- Submit a contact form and, for shops, add a product to the cart.
- Purge the LiteSpeed cache if layout looks wrong.
- Look at Tools → Site Health for new critical issues.
Roll back a bad update
- Plugin breaks the site: rename its folder in
wp-content/pluginsvia cPanel → File Manager to deactivate it, then install the previous version from the plugin's page on wordpress.org (Advanced View → Previous version). - Several things broke: restore files and database from the JetBackup restore point taken before the update.
- Critical error email: follow the recovery mode link WordPress emails to the admin address.
Keep PHP compatible
Plugins increasingly require newer PHP. If an update says it needs a higher version, switch it in cPanel → Software → Select PHP Version or MultiPHP Manager first, on staging if possible. Running an old PHP version also means missing security fixes.
Managing many sites
Resellers and agencies with many WordPress sites can use Softaculous's update notifications, WP-CLI (wp plugin update --all) or a management tool. Whatever you use, keep the same order: backup, update, test.
Frequently asked questions
How often should I update?
Check for updates at least once a week, and apply security releases the same day they appear. Plugins with known vulnerabilities are attacked by automated bots within days of the fix being published, so waiting a month is a real risk.
Will an update delete my content?
No. Core, plugin and theme updates replace code files, not your posts, pages or media. The exception is direct edits to a theme's files: they are overwritten when the theme updates. Move those changes into a child theme or a small custom plugin.
What about premium plugins?
Premium plugins only update when their licence key is entered and active. An expired licence often means months of missed security fixes, so renew it or replace the plugin with a maintained alternative.
The update failed halfway. What now?
If the site shows "Briefly unavailable for scheduled maintenance", delete the .maintenance file in the site root and run the update again. If a plugin folder is now missing files, delete the folder and reinstall the plugin fresh; its settings stay in the database.