How do you update WordPress plugins safely? Take a backup, read the changelog, test the update on a staging copy if the plugin is important, update one plugin at a time in a sensible order, and check your key pages and forms afterwards. If something breaks, you roll back.
Owners often avoid updates because an update broke the site once. I understand, but skipping updates is the bigger risk. Outdated plugins are the most common way WordPress sites get hacked.
Here is the process I use on client sites.
Why updates break sites
Updates rarely break sites at random. The usual causes are:
- Two plugins that no longer get along after one changes.
- A theme or custom code that relies on something the plugin removed.
- A big version jump after months without updates.
- An old PHP version that the new release no longer supports.
The longer you wait, the bigger each jump and the higher the risk. Small, regular updates are safer than one big catch-up.
Before you update
1. Take a fresh backup
Files and database, stored somewhere other than the server. If you’re not sure how, see how to back up WordPress properly.
2. Read the changelog
Every plugin on WordPress.org has a changelog tab. Look for words like “breaking”, “requires”, “major” or “migration”. A jump from version 3.x to 4.0 deserves more care than 3.4.1 to 3.4.2.
3. Check compatibility
Note the minimum PHP and WordPress versions the new release needs. Your host’s dashboard shows which PHP version your site uses.
4. Use staging for important updates
A staging site is a private copy of your website. Update there first, check it, then repeat on the live site. Many hosts offer one-click staging. More on that in what a staging site is.
The safe update order
When several updates are waiting, I follow this order:
- Small plugin updates (bug fixes and security patches).
- Major plugin updates, one at a time.
- The theme, and check that any child theme still works.
- WordPress core.
Page builders, WooCommerce, membership and form plugins deserve extra care. They touch a lot of the site, so update them individually and test properly.
Avoid clicking “update all” on a business site. If something breaks, you won’t know which update caused it.
What to check after each update
Open the site in a private browser window and check:
- The homepage and a few key inner pages.
- Your contact form. Send a real test message and confirm it arrives.
- The menu on mobile.
- The checkout or booking flow, if you have one.
- Any page built with the plugin you just updated.
Also clear your cache, or you may be looking at an old copy of the page.
If an update breaks the site
Don’t panic, and don’t keep clicking. Work through this:
- If you can still log in, deactivate the plugin you just updated and check whether the site recovers.
- Roll back to the previous version. Some hosts and plugins offer rollbacks, or you can upload the old version manually.
- If you see “There has been a critical error”, WordPress usually emails the admin a recovery mode link. My critical error guide walks through it.
- Restore your backup if nothing else works.
- Report the bug to the plugin developer, then wait for a fix before trying again.
Should you turn on automatic updates?
WordPress can update plugins automatically. It’s a reasonable choice for:
- Small, simple plugins from reputable developers.
- Security releases of WordPress core, which are on by default.
I would avoid auto-updates for page builders, WooCommerce and anything your sales depend on, unless someone checks the site soon after each update. An unmonitored auto-update can break a checkout over a weekend without anyone noticing.
How often to update
For most business sites, a weekly check is right. Apply security updates as soon as they’re released, and batch the rest into your weekly or fortnightly routine. My maintenance checklist shows where updates fit.
If you’d rather not deal with any of it, safe, tested updates are the main part of my WordPress support and maintenance service.
Frequently asked questions
Is it safe to skip WordPress updates?
Not for long. Each skipped update leaves known security holes open and makes the next update bigger and riskier. Plugins with published vulnerabilities are a favourite target for automated attacks.
Why does my site look broken after an update but fine for others?
It is often cache. Clear your site cache, any CDN cache and your browser cache, then check again in a private window.
Should I update the theme if I have customised it?
If you edited the theme files directly, an update will overwrite your changes. Move the changes into a child theme first, then update.
What if a plugin hasn’t been updated in years?
Replace it. A plugin abandoned by its developer won’t receive security fixes, and it is likely to conflict with newer versions of WordPress and PHP.
About the author
Vincent Earl Panoncial is a WordPress developer and the founder of VEP Studio. He has built and maintained 100+ WordPress websites, most of them at digital marketing agencies, and now works directly with businesses on development, maintenance and webmaster services.
Need a hand with your WordPress site?
Tell me what your website needs and you’ll get a clear plan and an honest answer on cost before any work starts. Get a free consultation →
Featured photo by Herry Sucahya on Unsplash.
