Keeping WordPress, plugins, and themes updated

Outdated WordPress installations, plugins, and themes are the leading cause of hacked websites. Security vulnerabilities are publicly disclosed when patches are released-any site running the old version becomes a target. Keeping everything updated is the single most effective security measure you can take.

Why updates matter

• Security patches-most updates include fixes for known vulnerabilities
• Bug fixes-stability improvements that prevent errors
• Performance improvements-newer versions often run faster
• Compatibility-staying current avoids PHP compatibility issues as servers upgrade

Before you update

1. Create a full backup (files + database) via cPanel Backup or Backuply
2. Check plugin changelogs for major version updates-some may have breaking changes
3. If you have a staging site, test updates there first

How to update

From the WordPress dashboard:

1. Log in to WordPress admin
2. Go to Dashboard → Updates
3. Click Update Now for WordPress core if available
4. Select all plugins → click Update Plugins
5. Update themes (if any need updates)

Via WP-CLI (VPS only):

wp core update
wp plugin update --all
wp theme update --all

Automatic updates

WordPress can update itself automatically. Configure in wp-config.php:

// Auto-update minor releases (e.g., 6.5.1 → 6.5.2)
define('WP_AUTO_UPDATE_CORE', 'minor');

// Auto-update all core releases including major versions
define('WP_AUTO_UPDATE_CORE', true);

// Disable all auto-updates
define('WP_AUTO_UPDATE_CORE', false);

For plugins, use the Enable Auto-updates toggle in Plugins → Installed Plugins per plugin, or use the Automatic Updates checkbox. For most sites, auto-updating minor security releases is safe; review major plugin updates manually.

If an update breaks the site

1. Restore your backup from before the update (fastest fix)
2. Or: identify the problematic plugin by deactivating plugins one by one via FTP (rename the plugin folder in wp-content/plugins/)
3. Check the PHP error log in cPanel → Errors for specific error messages
4. If WordPress admin is inaccessible, use the white screen fix guide

Related articles