Two kinds of WordPress site end up on our desk with problems. The ones nobody updated for two years, which get hacked. And the ones where someone clicked “update all” on 23 plugins on a Friday afternoon, which break. The fix for both is the same: a regular, boring routine with a backup at the start and a check at the end.
Why updates aren’t optional
Updates do three jobs. They patch security holes, which matters most, because once a fix is published the hole it fixes is public knowledge too. They keep the site compatible with newer versions of PHP, the language WordPress runs on, which your host will eventually upgrade whether you’re ready or not (more on that in PHP versions and why your developer keeps mentioning them). And they fix bugs and add features.
The longer you leave it, the riskier each update becomes. Updating a plugin that’s one version behind is usually trivial. Jumping a plugin, a theme and WordPress itself across two years of changes at once is where things fall over.
Auto-updates: where we use them and where we don’t
WordPress can update itself. By default it applies minor core releases (the security and maintenance ones, like going from 7.1.1 to 7.1.2) automatically. You can also switch on auto-updates for individual plugins and themes from the Plugins and Themes screens, which the WordPress plugin and theme auto-updates guide explains.
Our view, after looking after a lot of sites:
Leave minor core auto-updates on. These are small, well tested, and often security fixes. Turning them off creates more risk than it removes.
Auto-update small, stable plugins if nobody’s checking the site regularly. A simple, well-maintained plugin that does one job is unlikely to break anything, and an unpatched one is a bigger risk than an occasional glitch.
Don’t auto-update the big moving parts. Elementor and Elementor Pro, WooCommerce, your theme, and anything that changes how pages are built or how payments work. These get major releases that occasionally change things in ways you need to check. They should be updated by a person, with a backup, at a time when someone can fix a problem.
Be careful with major core releases. A new major version of WordPress (7.1 to 7.2, say) is usually fine, but we tend to wait a week or two for the first maintenance release and for big plugins to confirm compatibility.
The downside of auto-updates is simple: when something breaks, it breaks at 3am with nobody watching, and you hear about it from a customer.
Use staging when it matters
A staging site is a private copy of your website where you can test updates before they touch the live site. For a small brochure site, testing every routine plugin update on staging is overkill. For these, it’s worth doing:
- Major Elementor or Elementor Pro releases
- WooCommerce updates on a working shop
- Major WordPress versions
- PHP version upgrades
- A site that hasn’t been updated in months
Many decent hosts offer one-click staging. If yours doesn’t, WordPress staging sites explained covers the options.
The routine, in order
This is what we do on client sites. On a typical small business site it takes 15 to 30 minutes.
1. Take a fresh backup
Not last night’s. A new one, right now, of the files and database, stored offsite. If you’re not confident in your backups, sort that first with what a good WordPress backup looks like.
2. Read what’s waiting
Go to Dashboard > Updates and look at the list before clicking anything. Note any big version jumps (a change in the first or second number, like 3.x to 4.0), and skim the changelog for those. Developers usually flag breaking changes and required steps.
3. Update plugins, a few at a time
Plugins first, because plugin developers release compatibility fixes ahead of new WordPress versions. Do them in small groups rather than all at once, so if something breaks you know which one did it.
Do the heavy plugins individually: Elementor, then Elementor Pro straight after (they’re designed to stay in step, and mismatched versions cause errors), WooCommerce, and any booking or membership plugin. Our notes on that are in updating Elementor safely.
4. Update the theme
On an Elementor site the theme does very little, because the design lives in Elementor’s templates, so theme updates are usually uneventful. If you’ve edited the main theme’s files directly (please don’t), those edits will be overwritten.
5. Update WordPress core
If a core update is waiting, apply it last, once your plugins are current. That gives them the best chance of already supporting it.
6. Check the site
Open the site in a private browser window, logged out, on a phone and a computer. Check:
- The homepage and two or three key pages look right
- Menus open on mobile
- The contact form actually sends (submit a test and check it arrives)
- Shop, cart and checkout work, if you have them
- Nothing odd under Tools > Site Health
7. Clear caches and write it down
Clear your caching plugin, your host’s cache and any CDN, then check again. Then note the date and what was updated. When something odd shows up a week later, that log is gold.
When an update breaks something
Don’t keep clicking. If the site is visibly broken, restore the backup you took in step 1, or roll back the single plugin that caused it if your tools allow that. Then work out the cause on staging rather than on the live site. Most problems are a conflict between two plugins, or a plugin that needs a newer PHP version than your server runs.
If you see the “There has been a critical error on this website” message, WordPress normally emails the site’s admin address with details and a recovery mode link. That email is worth looking for before you start guessing.
How often?
For most small business sites, every one to two weeks is about right, with security releases for anything widely used applied as soon as they come out. Monthly is the absolute longest we’d go. Put it in the calendar on a quiet morning early in the week, never late on Friday.
Prefer to hand the routine to someone else? Our care plans cover updates, backups and the checks afterwards, from $79 a month + GST. And every site built through our web design service is handed over with training, so you know what you’re looking at when the update count appears.