If you’re running a WordPress website for your business, you’ve probably noticed those update notifications that pop up in your dashboard. Maybe you’ve wondered if they’re really necessary, or if you can put them off until next month when things aren’t so busy.
Keeping your WordPress site updated is one of the most important things you can do to protect your business online. Think of your WordPress site like your office building. You wouldn’t leave the back door unlocked overnight, right? Updates are like changing the locks when someone loses a key, or fixing a window that doesn’t latch properly. When you skip them, you’re leaving points of entry open for anyone who happens to walk by.
WordPress security updates
WordPress is open-source software, which means its code is public. This openness is a good thing. It means smart people are constantly checking for problems and suggesting improvements. Because testing and updates are frequent, and so many people are working to address issues, you can argue that open source is more secure than proprietary software, not less.
When security researchers find a weakness, they report it so it can be fixed. WordPress releases an update to patch that hole. Once that fix becomes public, the weakness also becomes public. Bad actors may start looking for websites that haven’t updated yet to exploit the known security flaw.
This is why you’ll sometimes see an update come through that WordPress marks as a security release. These updates should be made when released and most hosting companies make them automatically. If you site doesn’t update right away, check the automatic Wordpress update settings allowed on your web hosting account (where these can be found may vary by hosting provider). There is usually an option to allow minor security releases to auto-update. You can also choose to skip the major core version updates and do those manually.
“But my site works fine, why risk breaking it?”
This is probably the most common pushback I hear about updates. It makes sense on the surface. If your site is working, why mess with it?
“Working” and “secure” aren’t the same thing. Your site can look and function just fine while having security holes that won’t be obvious until someone exploits them. By the time you know there’s a problem, the damage is done.
Your smoke detector batteries might be dead, but you won’t know until there’s a fire. Updates are like testing those batteries monthly. Yes, climbing up on the ladder is a minor hassle. But it’s a lot easier than dealing with a fire.
The risk of breaking something with an update exists, but it’s unusual unless your working with a lot of customization or plugin updates that may have “breaking changes”. Maintaining backups, and testing those backups, should be part of your update process. The risk of getting hacked because you didn’t update is real and the consequences are much worse and harder to fix.
Updating WordPress manually: understanding what needs to stay current
Your WordPress site has several parts that need regular updates:
- WordPress core is the application. This is the basic software that makes everything run. The WordPress team releases updates regularly, including small maintenance releases and larger feature updates. The security team is particularly active, pay attention to those update notifications in your WordPress dashboard.
- Your theme controls how your site looks and often adds features specific to your design. If you’re using a theme from a reputable commercial developer, they’ll release updates when WordPress changes in ways that affect themes, or when they find bugs and security issues. Watch out for WordPress themes from outside of the WordPress theme repository – these commercial themes often have plugins bundled within that theme that may also require licenses and updates and can impact the security of your website – Revolution Slider and WP Bakery are common bundled plugins that have had some issues in the past.
- Plugins add extra functionality. Contact forms, galleries, SEO tools, backup systems, you name it. Support and quality varies widely here. We’ll talk about how to decide what plugins to add to your site in the next section.
- PHP is the programming language that WordPress runs on. Your web host controls which version of PHP your site uses. This is often overlooked but critically important. Older PHP versions stop receiving security updates, just like old versions of WordPress. WordPress and many plugins will not be backwards compatible with older versions of WordPress – the minimum recommended version is 7.4 but you should try to get the most current, stable version if you can – 8.2 or 8.3 (as of the writing of this post).
These parts all work together. Sometimes a WordPress core update changes something that affects how themes or plugins work. A responsible theme or plugin developer will test their product with new WordPress versions and release an update if needed. This is why you might see a theme update right after a major WordPress release, the developer is making sure everything stays compatible.
How to tell if a plugin is still safe to use
Not all plugins are maintained equally. Some developers abandon their plugins, stop responding to support requests, or just don’t have the bandwidth to maintain an open source plugin. Using an abandoned plugin is like installing a smoke detector with no way to change the batteries.
- Last updated more than a year ago. Check the plugin’s page in your WordPress dashboard or on WordPress.org. If the last update was over a year ago, be cautious.
- Not tested with recent WordPress versions. You’ll see a notice like “This plugin hasn’t been tested with the latest 3 major releases of WordPress.” This doesn’t automatically mean it’s broken, but it means the developer might not be actively maintaining it.
- Lots of unresolved support questions. Look at the plugin’s support forum. If people are reporting problems and getting no response from the developer, that’s a red flag.
If you’re using a plugin with these warning signs, start looking for a replacement. Don’t wait until it breaks or creates a security problem. Finding and testing a replacement while things are working is much less stressful than doing it in an emergency.
What could break when you update (and why)
Updates don’t usually break things, but when they do, it’s helpful to understand what went wrong:
- Plugin conflicts happen when two plugins try to do something that conflicts with each other, or when a plugin update changes how it interacts with other plugins. This is more common on sites with lots of plugins.
- Theme incompatibility occurs when WordPress adds new features or changes how things work, and your theme hasn’t been updated to match. This is why theme updates often follow WordPress core updates.
- Custom code problems are tricky. If someone added custom code to your site (maybe in your theme’s functions file or a custom plugin), that code might rely on WordPress features that changed or were removed. This is the most frustrating type of break because it requires a developer to fix the custom code.
- The white screen of death is what people call it when your site stops loading entirely and just shows a blank white screen. This usually happens when there’s a fatal PHP error. It sounds scary, but it’s fixable with access to your site’s files.
- Memory limit issues can show up after updates if the new version of WordPress or a plugin needs more server memory than you have available. Your host can usually increase this.
Most of these problems can be caught and fixed before they affect your live site if you’re testing updates properly.
Automatic updates: when they help and when they don’t
WordPress can update itself automatically. By default, it handles minor updates (like going from version 6.9 to 6.9.1) on its own. You can also enable automatic updates for major versions, themes, and plugins.
When automatic updates make sense:
- WordPress minor/security updates (usually safe to automate)
- Simple sites with well-maintained, popular plugins
- Sites where you have good backups and monitoring in place
When to avoid automatic updates:
- Sites with custom code or themes
- Sites using plugins that often have compatibility issues
- Sites where a few hours of downtime would cause serious problems
- Major WordPress version updates (worth testing first)
If you enable automatic updates, you still need monitoring. Set up alerts so you know when updates happen, and check your site afterward to make sure everything works.
Test major core updates and plugin that warn of breaking changes on a staging site first.
What does it mean to test an update? (staging sites explained)
When I say “test updates on a staging site,” I mean creating a copy of your site where you can try things out without affecting your live site. This copy is called a staging site or development environment.
You wouldn’t remodel your store while customers are shopping. You’d close for renovations, or at least work on a section at a time. A staging site is like having a complete copy of your store in a back room where you can test changes before customers see them.
Many web hosts now include staging environments as part of their hosting plans. You click a button, they create a copy of your site, and you can update and test on that copy. If everything works, you push those changes to your live site. If something breaks, your live site wasn’t affected.
Staging sites cost different amounts depending on your host. Some hosts include them free, others charge $5-20 extra per month. If your host doesn’t offer staging, a developer can set one up for you, though this may involve additional costs.
For small business sites, staging is worth it if:
- You have a complex site with business-critical plugins like WooCommerce
- You have custom code or an older theme
- Your site is critical to your business (you can’t afford downtime)
- You’re several versions behind on updates and need to catch up
For very simple sites with just a few well-maintained plugins, you might be okay with good backups and manual testing on your live site during off-hours.
How to make a backup
Before any update, you need a current backup.
- Check if your host does automatic backups. Log into your hosting control panel and look for backup settings. Many hosts backup your site daily, but check:
- How often they run
- How long they keep them (30 days is good)
- How to restore them if needed
- If your host doesn’t backup, use a plugin. Free options like UpdraftPlus or BackWPup can create backups and save them to cloud storage like Google Drive or Dropbox. Install one, configure it to backup both your files and database, and set it to run at least weekly.
- Test your backups occasionally. A backup you can’t restore is useless. Every few months, try restoring a backup to make sure the process works. Many people find out their backups are broken when they desperately need them.
- Before updating, create a fresh backup manually. Don’t rely only on automatic backups. Create a new one right before you update, so you have a restore point from minutes ago, not days ago.
If this all sounds complicated, it’s one of the main things a good maintenance plan handles for you.
What to do when you can’t make an update
Sometimes you’re stuck. Maybe a plugin update won’t work with your hosts PHP version or you have a custom coded site that might not be compatible with a major core release.
- Make a plan to fix it. If you can’t update now, when can you? Put money in the budget for next quarter to rebuild that custom feature properly, or to migrate to a modern theme. Don’t let “I can’t update right now” turn into “I haven’t updated in three years.”
- Consider a rebuild. Sometimes starting fresh costs less than trying to update a very old site. If your site is 5+ years old with an outdated theme and abandoned plugins, rebuilding with modern tools might be smarter than patching holes forever.
Make sure you have some other security measures in place:
- Use a web application firewall. Services like Cloudflare or Sucuri can block many attacks before they reach your site. This isn’t a substitute for updating, but it adds a layer of protection.
- Lock down your login page. Use a security plugin to limit login attempts, require strong passwords, and enable two-factor authentication. Most attacks start by trying to guess your password. While we’re here, please use a password manager and don’t reuse your passwords.
- Monitor activity. Use a service that watches for changes to your files or signs of compromise. The faster you catch a problem, the less damage it does.
What to look for in a maintenance plan
If you’re hiring someone to handle updates, a good maintenance plan should include:
- Regular update schedule, not just when something breaks. Most professionals update sites weekly or bi-weekly for plugins and themes, and within 24-48 hours for WordPress security releases.
- Testing before updates go live. Your maintenance provider should have a staging copy of your site where they can make sure the update doesn’t break anything. A good provider won’t just click “update all” and hope for the best.
- Backups before changes. If an update does cause a problem, you want to be able to roll back to exactly how things were before.
- Monitoring after updates. Sometimes problems don’t show up immediately. Your maintenance provider should check that your forms still work, your pages still load, and nothing looks broken.
- Clear communication. You should get reports on what was updated and whether any issues came up. Radio silence isn’t good customer service.
Ask potential providers these questions:
- What happens if an update breaks something?
- How quickly will you respond if my site goes down?
- Do you test updates in staging first?
- What’s included in your monitoring?
- How do you handle PHP version updates?
Warning signs: If someone offers maintenance for $10 a month, they’re probably just running automatic updates without testing or monitoring. If they can’t explain their process clearly, or if they say updates aren’t that important, find someone else.
When updates are urgent (and when you have time)
Not every update needs to happen immediately. A plugin that adds a new feature or fixes a minor display issue can usually wait a few days while you make sure the update won’t cause problems with your specific setup.
Immediate updates recommended for:
- WordPress security releases
- Plugin updates marked as fixing security issues
- Updates that patch actively exploited vulnerabilities (WordFence and PatchStack maintain a WordPress vulnerability database you can subscribe to.)
Update within a week or two for:
- WordPress major version releases
- Theme updates (unless your theme is highly customized)
- Plugin updates from reputable developers
Can probably wait a bit, but don’t forget:
- Feature additions
- Minor bug fixes
- Performance improvements
The danger in waiting is that updates pile up. If you skip a few rounds, you might find yourself several versions behind. At that point, updating becomes riskier because you’re making bigger changes all at once. It’s easier to update from version 1.2 to 1.3 than to jump from 1.2 to 2.0.
Taking action with less stress
If you’re managing your own site, start small. Set aside 30 minutes once a week to log into your WordPress dashboard and check for updates. If you see a security update, make it happen that day. For other updates, you can take a bit more time to research if other users are reporting problems, but don’t let things pile up.
Before you update anything, make sure you have a current backup. Check that your host’s backups are running, or set up a backup plugin if they’re not.
If this sounds like too much extra work, hire a professional. Your time is valuable, and maintaining a website isn’t your main job. Finding a reliable professional to handle updates is usually less expensive than you’d think, often $50-100 per month depending on your site’s complexity, and far less expensive than recovering from a hack.
Your website is often the first thing potential clients see when they look for your business. People judge your credibility partly on whether your site works well and looks professional. A hacked or broken site sends exactly the wrong message. Keeping WordPress updated is the simplest way to protect that investment.
Resources:
- Updating WordPress
- Updating WordPress Plugins
- Automatic Updates
- The Ultimate WordPress Debugging Guide
- Scanfully – WordPress site health and performance monitoring
- WordFence – WordPress vulnerability database
- PatchStack – Vulnerability database
- Security is Really Everyone’s Responsibility – (video) Tim Nash, WordPress Security Consultant
