Updating WordPress safely

WordPress, plugins, and themes get updates regularly — security patches, bug fixes, new features. Most are safe; some break sites. Here's how to update without breaking things.

The safe pattern

In order:

1. Back up first. The portal's Backups tile or your UpdraftPlus plugin.
2. Update plugins and themes — they're more likely to break than core.
3. Test the site — load homepage, check key pages, verify checkout/login if applicable.
4. Update WordPress core — usually safest, especially minor releases.
5. Test again — full walkthrough.

Where to update from

From the portal

The portal's WordPress tab shows update availability per site:

1. Go to Services → click hosting → WordPress tab.
2. Cards with available updates show a badge.
3. Click the card → use the update controls in the per-site detail page.

Updates run via wp-cli from the portal. Faster and more reliable than wp-admin's update flow, especially for plugin updates that involve database migrations.

From WordPress admin

The classic path:

1. wp-admin → Dashboard → Updates shows available updates.
2. Click Update Plugins / Update Themes / Update Now for core.
3. WordPress runs the updates in your browser.

This works fine for most cases. The portal path is faster for batch updates and more graceful when individual updates fail.

Auto-updates

WordPress can auto-update itself:

• Minor releases (5.6.1 → 5.6.2 etc.) are auto-updated by default. These are bug fix and security patches, low risk.
• Major releases (5.6 → 5.7) require explicit opt-in. Configure in wp-admin → Updates or in wp-config.php with define('WP_AUTO_UPDATE_CORE', 'major');.
• Plugins and themes can auto-update on a per-item basis from wp-admin → Plugins (toggle "Enable auto-updates" next to each plugin).

For most sites, enable auto-updates for minor core releases (the default) and manually approve major releases and plugin updates. Balanced safety and convenience.

When updates break things

Symptoms after an update:

• White screen of death — see Fixing the WordPress white screen of death.
• Plugin compatibility error — usually displayed clearly in admin.
• Theme crashes — site loads but looks broken.
• Database upgrade incomplete — rare, usually fixes itself with wp-admin → Update.

To roll back:

1. Restore from backup — easiest if you backed up before the update.
2. Manually revert a plugin — download the previous version from WordPress.org plugin directory's "Advanced View," then upload via FTP to replace the broken version.
3. Re-disable auto-updates for the offending plugin while you investigate.

Compatibility checks before major core updates

Before upgrading core (e.g., WordPress 6.x → 7.x):

• Check plugin compatibility — most plugins list "Tested up to" on their WordPress.org page. If you're going to a version newer than what plugins are tested with, expect potential issues.
• Check theme compatibility — same for themes.
• PHP version — WordPress requires specific PHP versions per release. We support 7.4–8.3; current WordPress runs best on 8.3.

For most sites, plugins and themes are updated to support new WordPress within days or weeks. Wait a week or two after a major release before upgrading non-critical sites.

Smart Update (our portal feature)

The portal includes a "Smart Update" path that:

• Takes a snapshot before the update.
• Runs the update.
• Checks the site loads correctly.
• Rolls back automatically if something visibly breaks.

(This feature is in active development; check the WordPress site detail page in the portal for current capabilities.)

Plugin update strategies

Auto-update everything

Set every plugin to auto-update. New versions install as soon as available.

• ✅ Always patched.
• ⚠️ Risk of breaking changes installing without warning.

Manual approval, weekly batch

Disable auto-updates. Once a week, log in, review available updates, approve.

• ✅ Control over what gets updated when.
• ⚠️ Slower to apply security fixes.

Mixed approach (recommended)

• Auto-update for security/bug-fix updates of well-maintained plugins.
• Manual for major version updates and less-trusted plugins.

WordPress.org is moving toward "trusted vs untrusted" updates with this distinction in mind.

Database migrations during updates

Some updates include database schema changes (Database update required after install). To run:

1. Visit wp-admin → Dashboard → Updates.
2. Click Update Database if prompted.

For most updates this completes in seconds. For major updates on large databases (millions of rows), it can take minutes — let it finish.

If the database update fails partway through:

• Don't refresh — wait it out, the script may still be running.
• Run via wp-cli if it's truly stuck: wp core update-db.
• Restore from backup if the database is in a broken state.

Power-user note

For staging environments to test updates safely:

• WordPress staging plugin (WP Stagecoach, WP Staging) — clones your site to a staging URL.
• Manual staging site — set up a subdomain (staging.yourdomain.com) with a copy of the database and files.
• Cloning — your hosting service may have a clone-to-staging button (we're building this; check the WordPress tab in your portal).

Run all updates on staging first; promote to production once verified safe.