How to safely update WordPress, plugins and themes
Back up the database and the files, check that the backup is usable, then apply one update at a time and look at the site after each. When something breaks you know which update did it, and you have a copy to go back to.
- By
- WP Ministry
- Updated
In short
- Take a backup of the database and the files before every round of updates, and check that it can be opened.
- Update one thing at a time and look at the site after each. Updating everything at once hides which update broke it.
- Read the changelog before a release that changes the first number of a version. Those are the ones that break things.
- Small WordPress releases install themselves. Plugins and themes update on their own only if you switch that on, one by one.
- Know how you would go back before you start.
An update replaces the files of WordPress, a plugin or a theme with a newer version. Most of the time nothing else changes. Now and then the new version of one thing does not get on with something else on the site, and a page, a form or the whole site stops working.
You cannot rule that out, and leaving updates undone is worse, because updates are how security holes get closed. What you can do is make sure a bad update costs you a few minutes and not a day. That takes a backup, a habit of doing one thing at a time, and a way back.
Before you update
Step 1: Back up the database and the files
WordPress's own instructions begin here: back up the database, back up all of the site's files, and then check that the backups are there and usable. Use your host's backup tool or a backup plugin, and keep the copy somewhere other than the site's own server.
Step 2: Check that the backup can be used
A backup you have never opened is a hope. Download it and look inside: there should be a database file of a believable size and the
wp-contentfolder with your uploads, plugins and themes in it.Step 3: See what is waiting
Go to Dashboard, then Updates. The screen lists what is available for WordPress itself, for plugins and for themes.
Step 4: Read the changelog of anything that jumps a whole version
A plugin going from 3.9 to 4.0, or WordPress going to a new major release, is where behavior changes on purpose. Under the plugin's name on the Plugins screen, follow the link that begins "View version" and read what its author says has changed. For a store, read WooCommerce's release notes before every WooCommerce update.
Step 5: Pick a quiet hour
Update when few people are on the site. While an update is being installed, visitors see a short maintenance notice.
With WP-CLI, one command exports the database to a file in your home folder. It goes there, and not into the site's folder, because a file in the site's folder can be downloaded by anyone who guesses its name. Download that file and remove it from the server afterwards, because it holds everything in your database.
wp db export ~/before-updates.sqlUpdate one thing at a time
When twelve updates are waiting it is tempting to select them all. If the site then breaks, any of the twelve could be the cause. One at a time, the cause is always the update you just made.
Step 1: Update one plugin
On the Plugins screen, select "update now" under a single plugin and wait for it to finish.
Step 2: Look at the site
Open the home page and one or two pages that matter. Then check the thing that plugin does: send the form, run the search, open the gallery. On a store, add a product to the cart and go through to the checkout.
Step 3: Carry on with the next
Do the remaining plugins the same way, then the theme, then WordPress itself. After a theme update, look at the pages for anything that has moved or changed its look.
The order matters less than doing one at a time. There is one exception. Before a major WordPress release, update your plugins and theme first, so that the versions written for the new release are already in place when it arrives.
With WP-CLI, list what is waiting, then update by name. The last command runs any changes the new WordPress needs to make to the database.
wp plugin list --update=available
wp plugin update plugin-folder-name
wp theme update theme-folder-name
wp core update
wp core update-dbwp plugin update --all --dry-run shows what updating everything would change without changing it.
If an update breaks the site
Stop updating. The cause is the last thing you updated.
Step 1: If you can still reach the dashboard
Deactivate the plugin you just updated and check whether the site is back. If the theme was the last update, switch to a default theme for a moment.
Step 2: If you cannot
The site shows a blank page or "There has been a critical error on this website." Follow how to fix the white screen of death, which switches the plugin off through the file manager. If the site says "Briefly unavailable for scheduled maintenance" and stays that way, the update was cut short: see how to clear it.
Step 3: Go back to the version that worked
For a plugin from WordPress.org, WP-CLI can install an earlier version over the new one. Use the version number you had before, which the changelog lists.
Step 4: Or restore the backup
Restoring puts back everything as it was when the backup was taken. Anything added since, such as orders, comments and form entries, is lost, so on a busy site prefer going back one plugin to restoring the whole site.
wp plugin install plugin-folder-name --version=1.2.3 --forceThen tell the plugin's author what happened, with the two version numbers and the error. Stay on the old version until a fixed one is released, and not longer: an old version does not get security fixes.
What WordPress updates on its own
WordPress installs some updates without being asked.
| What | By default |
|---|---|
| Small WordPress releases, which carry security and maintenance fixes | Installed automatically |
| Major WordPress releases | Installed automatically on sites first installed with WordPress 5.6 or later |
| Translation files | Installed automatically |
| Plugins and themes | Only where you have switched it on, one plugin or theme at a time |
To switch it on for a plugin, go to the Plugins screen and select "Enable auto-updates" in that plugin's row. For a theme, open its details on the Appearance screen. WordPress runs these updates twice a day and emails the site's administrator when they succeed or fail.
Leave the automatic small releases of WordPress on. They close security holes.
For plugins, it depends on what a broken page costs you. An automatic update does not take a backup first and nobody looks at the site afterwards. On a personal site that is a fair trade for never falling behind. On a store or a site that brings in work, switch it on only for plugins whose failure you would notice at once and could live with for a few hours, and keep a scheduled backup running.
How often to update
- Security releases: as soon as you can after taking a backup. Once a fix is published, so is the hole it closes.
- Everything else: once a week is a rhythm most site owners can keep, and it keeps each round small.
- A major release of WordPress or WooCommerce: after reading the release notes, and on a copy of the site first if you have one.
Skipping updates for months does not avoid the risk. It gathers many changes into one round, and that round is the hardest to untangle when it goes wrong.
If you would rather not do this every week, it is what our update service does on every care plan: updates applied weekly, the site looked at afterwards, and an update that went wrong undone.
Common questions
Do I need to deactivate my plugins before updating WordPress?
Only for a manual update, where you replace WordPress's files yourself over SFTP. WordPress's instructions for that method say to deactivate every plugin first. The update button in the dashboard needs no such step.
How do I update a plugin I paid for?
Paid plugins are updated through their author's own license system. Check that your license key is entered in the plugin's settings and has not expired. The update then appears on the Updates screen with the others. Without a current license the plugin stops receiving updates, security fixes included.
Can I test updates without touching the live site?
Yes, on a staging site: a private copy of the site where you apply the updates first. Many hosts provide one. It is worth the extra step for a store, a membership site, or any site with a lot of plugins.
The update finished but the site looks the same as before. Is that normal?
Usually, yes. Most updates fix faults and close security holes without changing anything you can see. If you expected a visible change, empty the site's cache and your browser's.