How to Update WordPress Plugins and Themes Safely

WordPress updates exist for a reason: they fix security vulnerabilities, patch bugs and add features. The current WordPress release as of this review is 7.1.3 (6 October 2026), and security releases arrive regularly — three in three weeks on one recent branch. Running outdated core, plugins or themes is one of the most common ways WordPress sites get compromised.

At the same time, updates are the most common cause of self-inflicted downtime. A plugin that conflicts with a new core version, a theme that breaks after a PHP upgrade, a database migration that fails halfway — all of these are avoidable with a routine. This guide gives you one.

The Routine in Brief

1. Back up the site.
2. Test the updates on staging.
3. Update in the right order: core, then themes, then plugins — or plugins first if a plugin update is required for core compatibility.
4. Verify the live site.
5. Keep a record.

The whole process takes under an hour for most sites. A broken live site costs far more.

Step 1: Back Up Before You Touch Anything

Before any update, take a fresh backup — files plus database — even if a scheduled backup ran an hour ago. The backup you need is the one taken immediately before the change that broke things. Store it off-site and confirm the backup actually completed. See how to back up and restore WordPress for the full procedure, including how to test a restore.

If your host takes automatic backups, check the retention period before you rely on them for this. A backup that is overwritten daily is no help if you discover the problem a week later.

Step 2: Read the Changelogs

Before updating, spend five minutes reading what is changing:

• Core updates: the release post on wordpress.org lists security fixes and major changes. A security release should be applied promptly; a major release deserves more caution and a full staging test.
• Plugin and theme changelogs: available on the plugin’s WordPress.org page or in the update screen. Look for phrases such as “requires WordPress X”, “requires PHP Y”, “breaking change”, “database upgrade” or “template changes”. A plugin that now requires PHP 8.3 will fail on a server running PHP 7.4 — and PHP 7.4 has been end of life since 2022. As of October 2026, the supported PHP branches are 8.2 through 8.5, with 8.2 losing security support on 31 December 2026.
• Compatibility notes: check whether the plugin author has confirmed compatibility with your WordPress version. If the plugin has not been updated in over a year, treat it as a risk: it may work, but it is not being maintained.

If a changelog mentions a major version jump (for example, 2.x to 3.0), expect breaking changes and read the author’s upgrade notes carefully before proceeding.

Step 3: Test on Staging

Never run an untested update on a live site if you can avoid it. Refresh your staging copy from live, then run the updates there first. See how to build a safe WordPress staging workflow for the setup.

On staging, work through this checklist after updating:

• The homepage and key pages load without errors.
• You can log in to the admin and save a post.
• Forms, search, checkout and other interactive features work.
• The browser console shows no new JavaScript errors.
• With WP_DEBUG enabled on staging, the debug log shows no new PHP warnings or fatal errors.
• Page load times have not noticeably worsened — see how to diagnose a slow WordPress site.

If something breaks on staging, you have a controlled environment to investigate: deactivate the updated plugin, check the debug log, or contact the plugin author with a precise error message. That is far better than debugging on a live site while visitors see errors.

Step 4: Update in the Right Order

On the live site, update in this order:

1. Plugins first if a plugin update is required for the new core version. Some plugin authors release a compatibility update ahead of a major WordPress release. Apply those first.
2. WordPress core. Update core before themes and plugins in most cases, so that everything after it runs against the new version.
3. Themes. Update the active theme and any parent theme it depends on. If you use a child theme, the parent theme update is the one that matters — your child theme’s customisations are preserved, but verify them after the update.
4. Plugins, one at a time. Update plugins individually rather than in bulk, and check the site after each one — or at least after each group of related plugins. Bulk updates are faster, but when something breaks you will not know which plugin caused it.

Do updates during a low-traffic period, and avoid updating during a promotion, a product launch or any other time when downtime would be costly.

Step 5: Verify the Live Site Immediately

After the updates, do not assume success. Check:

• The homepage, a post, the contact page, and — for shops — the cart and checkout.
• The admin area: log in, open the dashboard, confirm there are no error notices.
• The Site Health screen (Tools → Site Health → Status) for new warnings.
• The error log, if your host provides access to it.

If anything is wrong, you have two options: fix forward (deactivate the offending plugin and contact its author) or roll back to the pre-update backup. Rolling back is not a failure — it is what the backup was for. Fix the problem on staging and try again.

Auto-Updates: Useful, but Managed

WordPress can update plugins, themes and minor core releases automatically. Minor core releases (security and maintenance) are auto-applied by default, and that is a sensible default — security fixes should not wait for a convenient afternoon.

For major core releases and plugins, auto-updates are a trade-off. They close the window in which a known vulnerability is exploitable, but they also remove the staging test. A reasonable middle ground:

• Enable auto-updates for minor core releases (the default) and for small, well-maintained plugins you trust.
• Keep major core updates and complex plugins (page builders, e-commerce, membership, security) manual, so they go through staging.
• Enable email notifications for updates so you know what changed and when. If something breaks overnight, the notification tells you exactly where to look.

Whatever you choose, review your auto-update settings regularly. A plugin you trusted a year ago may have changed hands or stopped being maintained.

Cleaning Up After Updates

Updates are also a good moment to tidy up:

• Delete inactive plugins and themes. Inactive code is still code on your server. A deactivated plugin with a known vulnerability can still be exploited in some configurations. If you are not using it, remove it — you can always reinstall it later.
• Keep one default theme installed (such as Twenty Twenty-Five) as a fallback for troubleshooting, but delete other unused themes.
• Check for abandoned plugins. A plugin with no updates in a long time and no compatibility statement for recent WordPress versions should be replaced. Search the WordPress.org directory for maintained alternatives before it becomes an emergency.

A Simple Update Calendar

For most sites, a monthly update round is enough, with security releases applied as soon as they appear. Put it in your calendar: first Tuesday of the month, back up, refresh staging, test, update, verify, record. The record matters — a one-line note of the date, what was updated, and any problems saves hours the next time something breaks and you need to know what changed.

Sources

• WordPress: Updating WordPress: https://wordpress.org/documentation/article/updating-wordpress/
• WordPress news and release announcements: https://wordpress.org/news/
• PHP supported versions: https://www.php.net/supported-versions.php
• WordPress: Backing up your database: https://developer.wordpress.org/advanced-administration/security/backup/database/

Sources

• {‘title’: ‘WordPress: Updating WordPress (official documentation)’, ‘url’: ‘https://wordpress.org/documentation/article/updating-wordpress/’}
• {‘title’: ‘WordPress news and release announcements’, ‘url’: ‘https://wordpress.org/news/’}
• {‘title’: ‘PHP supported versions and end-of-life dates’, ‘url’: ‘https://www.php.net/supported-versions.php’}
• {‘title’: ‘WordPress: Backing up your database (Advanced Administration Handbook)’, ‘url’: ‘https://developer.wordpress.org/advanced-administration/security/backup/database/’}

← All guides · Knowledge Base