How to Safely Update WordPress Core, Plugins and Themes
A safe routine for WordPress updates: back up, test on staging, update in the right order, use auto-updates sensibly, and roll back quickly when an update breaks something.
Table of Contents
To update WordPress safely: take a backup, test updates on a staging copy, update in a sensible order (plugins and themes, then core), check the important pages, and know how you will roll back if something breaks. Updates are the most important security task on a WordPress site, so the goal is to make them routine, not to avoid them.
Why updates matter
Most WordPress compromises exploit known vulnerabilities in outdated plugins and themes. Updates also bring compatibility with newer PHP versions and performance improvements. Delaying them for months turns a five-minute task into a risky jump across many versions.
Types of updates
| Update | Example | Risk |
|---|---|---|
| WordPress minor (security/maintenance) | 6.x.1 → 6.x.2 | Low; installed automatically by default |
| WordPress major | 6.x → 6.y | Moderate; new features, possible plugin conflicts |
| Plugin and theme updates | Varies | Varies; complex plugins carry more risk |
| PHP version | 8.2 → 8.3 | Moderate; old code may break |
| Translations | Language files | Low |
A routine that works
1. Read before you update
Check the changelog of major plugin and theme updates, especially e-commerce, page builders and membership plugins. Look for notes about required PHP or WordPress versions or database migrations.
2. Back up
Take a fresh backup of files and database, or confirm last night's backup completed. See WordPress backups: what to back up and how to restore.
3. Test on staging
A staging site is a private copy of your live site. Many hosts offer one-click staging; otherwise copy the site to a subdomain (and block search engines from it). Apply the updates there first and test:
- the home page and a few key pages;
- forms, logins and search;
- for shops, add to cart and a test checkout;
- the admin areas you use daily.
4. Update the live site in a quiet period
Apply the same updates in the same order, during low traffic. A sensible order is: plugins, then themes, then WordPress core, though follow any order a major plugin recommends.
5. Check again and clear caches
Purge the page cache and CDN, then repeat the quick checks. Watch the error log for a day.
Using automatic updates wisely
Since WordPress 5.5 you can enable auto-updates per plugin and theme.
- Good candidates: small, well-maintained plugins with a strong update record; WordPress minor releases (already automatic).
- Better handled manually: WooCommerce and its extensions, page builders, membership plugins, and anything heavily customised.
- Make sure you receive the update emails and have recent backups, so you notice and can recover quickly if an auto-update causes a problem.
How to roll back
- A single plugin: reinstall the previous version (many plugins keep older versions available on their directory page under "Advanced View"), or restore the plugin folder from a backup.
- A theme: restore the theme folder from a backup.
- WordPress core or a database migration: restore files and database from the pre-update backup. Remember that restoring the database loses changes made after the backup, such as new orders, so note them first.
If the site shows a white screen after an update, see how to fix the WordPress white screen of death.
Example: a monthly update session
A small business site with 14 plugins and a block theme. The owner's developer runs this sequence on the first Tuesday of each month:
- Check the list: Dashboard → Updates shows WordPress 6.x.y, eight plugin updates and one theme update.
- Read changelogs for the two big ones (the form plugin and the SEO plugin). Nothing alarming.
- Clone to staging with the host's staging tool.
- Update on staging in one go, then test: home page, a blog post, the contact form (a real test submission), the admin dashboard, and the site on a phone.
- One problem found: a gallery block looks different after the theme update. The developer checks the theme's changelog, adjusts a block setting, and notes it.
- Back up live, then apply the same updates there, make the same block adjustment, and repeat the quick tests.
- Purge caches and record the session in the maintenance log.
Total time: about 40 minutes, most of it testing.
Using WP-CLI for updates
With SSH access, WP-CLI makes updates quick and scriptable:
wp core check-update
wp plugin list --update=available
wp db export before-updates.sql
wp plugin update --all
wp theme update --all
wp core update
Run the same tests afterwards. Scripted updates are convenient, but the backup and testing steps still matter.
Updating custom themes
If you edited a theme's files directly, an update overwrites your changes. Move customisations into a child theme first; see how to choose a WordPress theme.
How often should you update?
Check at least weekly. Apply security updates promptly, ideally within days. Set a monthly slot for larger updates that need testing. The WordPress maintenance checklist puts this into a schedule.
Frequently Asked Questions
Can an update delete my content?
Normal updates do not delete posts or pages, which are stored in the database. Problems are usually broken layouts or features, which a backup or rollback fixes.
Should I update plugins before WordPress core?
Often yes, so plugins gain compatibility with the new core version first, but follow guidance from major plugins you rely on.
What if a plugin has no updates for years?
Treat it as abandoned. Find a maintained alternative, because unpatched vulnerabilities in abandoned plugins are a common attack route.
Related reading
Updates are the first item in the WordPress security checklist. For the WordPress overview, see WordPress hosting: what it is and how to choose, and compare ServerNeed WordPress hosting.
Sources
Last updated 7 October 2026
