How to Update WordPress Safely (Core, Plugins, Themes)

Updating WordPress safely comes down to one habit: never let the live site be the first place an update runs. Take a backup, apply the update to a staging copy, check what matters, then do the same on the live site. Everything else in this guide is detail around that routine.

Updates matter because they are how security holes get closed. They are risky because each plugin is written by a different developer, and two of them can disagree after an update. Both things are true, which is why the process matters more than the decision to update.

What kinds of WordPress update are there?

Since version 3.7, WordPress has installed minor core releases and translations automatically by default. Since 5.5, each plugin and theme has an auto-update toggle on the dashboard. And new installations from 5.6 onwards also auto-update major core versions by default. The official WordPress upgrade documentation covers the settings if you want to change them.

Why staging matters

A staging site is a private copy of your live site where you can test changes without visitors seeing them. Most managed WordPress hosts provide one-click staging; others need a plugin or a manual copy on a subdomain.

Without staging, an update that conflicts with another plugin is discovered by your customers. With staging, it is discovered by you, and the live site never sees it.

If you genuinely have no staging option, the fallback is: fresh backup, update one plugin at a time on the live site, check the site after each, and do it at a quiet time of day. It works; it is just more stressful.

The safe update routine

This is the routine I follow for a maintained WordPress site:

1. Check what is pending. Note which updates are major versions and skim their changelogs for anything about breaking changes or new requirements.
2. Check the plugin support forums for anything with a big version jump. If there is a wave of "this update broke my site" posts from the last few days, wait.
3. Take a full backup of files and database, and confirm it completed.
4. Refresh staging from live, so you are testing against current content and settings.
5. Apply updates on staging. Core first, then plugins, then theme.
6. Test the things that matter: the homepage, a few key pages, the contact form, the booking widget, a test order on a shop, the admin area, and the browser console for new JavaScript errors.
7. Apply the same updates to live, in the same order, after another fresh backup.
8. Test live again, logged out, on a phone as well as a desktop. Clear any caches first.
9. Write down what changed. Version numbers and the date. When something odd appears a week later, this list is the first place to look.

What to test after an update

"The homepage loads" is not a test. Check the things that earn money or would embarrass you if broken:

Keep the list written down so it is the same every time. Ten minutes of consistent checks catches far more than half an hour of random clicking.

Which order should updates go in?

Core, then plugins, then theme is the usual order, because plugins and themes declare which versions of WordPress they support. Within plugins, update the foundation first — WooCommerce before its extensions, a page builder before its add-ons.

WooCommerce sometimes asks to run a database update after a major version. Do it on staging first, and take the backup before you click.

PHP upgrades: the update people forget

WordPress runs on PHP, and PHP versions have a fixed support life. At the time of writing (October 2026), PHP 8.2 receives only security fixes and reaches end of life on 31 December 2026, according to php.net's supported versions page. WordPress itself recommends PHP 8.3 or newer on its requirements page.

Hosts eventually retire old PHP versions, sometimes with little notice. An older theme or plugin that has not been updated may fail on a newer PHP version — usually as a white screen or a critical error.

To upgrade safely:

1. Check Site Health for the current PHP version.
2. Switch staging to the newer PHP version (most hosts allow this per site).
3. Test the whole site, and turn on debug logging to catch warnings.
4. Replace or update anything that fails.
5. Switch live, and keep an eye on the error log for a few days.

How to roll back a bad update

Know this before you need it.

• Whole site: restore the backup taken immediately before the update. This is the cleanest option and why that backup matters.
• One plugin: reinstall the previous version. The WordPress.org plugin page lists previous versions under its advanced view, and some plugins (and rollback plugins) make this one click.
• Locked out of the dashboard: connect over SFTP and rename the problem plugin's folder in wp-content/plugins. WordPress deactivates it, and the site usually comes back.
• Critical error email: WordPress sends a recovery mode link to the admin email when a plugin causes a fatal error. Use it to log in and deactivate the culprit.

Common WordPress problems and fixes covers the white screen and "briefly unavailable for scheduled maintenance" errors that sometimes follow an interrupted update.

Premium plugins and expired licences

Paid plugins and themes usually only receive updates while the licence is active. When a licence lapses, the dashboard may stop offering updates at all, so the plugin quietly falls behind — security fixes included. Keep a list of premium licences and their renewal dates, and never install a "nulled" copy from an unofficial source; they are a known way of distributing malware.

Child themes and custom code

If anyone has edited your theme's files directly, the next theme update will overwrite those edits. Custom code belongs in a child theme or a small site-specific plugin. Check this before the first update on any site you have inherited.

Where updates fit in the bigger picture

Updates are one part of website maintenance, and they lean on two others: a backup strategy you have tested, and the wider hardening in the WordPress security guide. If you would like the routine above run for you, staged updates and pre-update backups are part of the website maintenance service; if the site breaks every time it updates, the WordPress development service is the better starting point.