Outdated plugins are the number one cause of hacked WordPress sites, and careless updates are a common cause of broken ones. The answer isn’t avoiding updates. It’s a routine that makes them routine: back up, test where it matters, update in the right order, and know how to roll back.

1. Know what needs updating

wp core check-update
wp plugin list --update=available
wp theme list --update=available

Or Dashboard → Updates. Check the changelogs of major plugin updates (WooCommerce, page builders, membership plugins) for breaking changes. See WP-CLI.

2. Back up first, always

wp db export ~/backups/db-$(date +%F-%H%M).sql
tar -czf ~/backups/wp-content-$(date +%F-%H%M).tar.gz -C /var/www/example.com wp-content

Better: an automatic, off-server backup that ran recently, plus a fresh one right before major updates. See WordPress backup and database backup automation.

3. Test on staging for anything significant

For business-critical sites (shops, membership sites), apply major updates on a staging copy first: WordPress major versions, WooCommerce, page builders, and the theme. Click through checkout, forms and key pages. See WordPress staging site.

Minor releases and security patches of small plugins can usually go straight to production, with a backup in place.

4. Update in a sensible order

  1. Plugins, especially those that require newer versions of other plugins.
  2. Theme (and the parent theme, if you use a child theme).
  3. WordPress core.
  4. Translations.
wp plugin update --all --dry-run          # see what would change
wp plugin update --all
wp theme update --all
wp core update
wp core update-db                          # database upgrades after core updates
wp language core update && wp language plugin update --all

Update plugins one at a time when troubleshooting, or for critical sites: wp plugin update woocommerce.

Then clear the caches: page cache, object cache and CDN.

wp cache flush

5. Check the site

  • Homepage, a post, the contact form, search, login.
  • WooCommerce: add to cart, checkout (test mode), My Account.
  • The PHP error log and WordPress debug log for new warnings. See WordPress white screen of death.

Automatic updates: what to enable

WordPress auto-installs minor core releases (security and maintenance) by default. That’s good, keep it. Options:

  • Plugins and themes: enable auto-updates (the Plugins screen → “Enable auto-updates”) for low-risk, well-maintained plugins, especially security-sensitive ones that are exposed to visitors. Leave complex ones (WooCommerce, builders) manual, but update them promptly.
  • Major core versions: define('WP_AUTO_UPDATE_CORE', true); updates everything automatically. That’s reasonable for simple blogs with good backups.

Get email notifications of updates (WordPress sends them), and check the site after auto-update emails.

Updating PHP

WordPress, plugins and security depend on a supported PHP version. Upgrading PHP (e.g. 8.1 → 8.3) is a bigger change than a plugin update:

  1. Check plugin and theme compatibility (PHP Compatibility Checker plugins, or test on staging).
  2. Install the new PHP version alongside the old one, with the same extensions. See PHP versions on Ubuntu and PHP extensions.
  3. Switch the site’s PHP-FPM socket in Nginx, then test.
  4. Keep the old version for a quick rollback, and remove it later.

Rolling back

One plugin broke the site:

wp plugin deactivate plugin-name                        # site works again?
wp plugin install plugin-name --version=1.2.3 --force   # reinstall the previous version

No WP-CLI access and the admin is broken? Rename the plugin’s folder in wp-content/plugins/ via SFTP. WordPress deactivates it.

Core update problems: wp core update --version=6.6.2 --force, then wp core update-db.

Worst case: restore the database and wp-content from the backup taken in step 2.

A monthly routine for a managed VPS

  1. Check backups ran (and restore-test occasionally).
  2. Update plugins, themes and core (staging first for big ones).
  3. Update the server: apt upgrade, and reboot if needed. See patch management.
  4. Remove unused plugins and themes.
  5. Check Site Health, error logs and uptime monitoring.

Quick reference

Task Command
Check updates wp plugin list --update=available
Back up DB wp db export file.sql
Update plugins wp plugin update --all
Update core wp core update && wp core update-db
Roll back a plugin wp plugin install NAME --version=X --force
Clear cache wp cache flush

Related: WordPress hardening and WordPress Git deployment.

  • WordPress
  • Maintenance
  • Security