Keep WordPress, themes and plugins current. A safe routine combines a usable backup with a short check of the site's important functions. Security updates can require prompt action; do not delay them indefinitely for cosmetic testing.
Before updating
Take a complete files-and-database backup and confirm the restore process. Keep hosting access available in case admin stops working. For a shop or membership site, plan how to preserve orders or other data added after the backup.
Read the update notes for major changes and check compatibility requirements. Use staging for significant theme, plugin or core changes. A staging copy must not send real customer messages or process live payments.
Record your current versions and the public pages or flows to verify. Useful checks include the homepage, one post, login, search, contact form and checkout when applicable.
Apply the updates
- Open Dashboard → Updates and review the available core, plugin and theme updates.
- Apply a controlled set of changes. For important plugins, updating one at a time makes an unexpected change easier to trace.
- Wait for each operation to finish. Do not repeatedly trigger the same update in several tabs.
- For a core update, use Update Now when available. Follow any database-update prompt shown by WordPress.
- Confirm the installed versions and resolve failed-update messages before continuing.
There is no universal plugin-before-theme order that guarantees compatibility. Follow documented dependencies when one component requires another version, and use the tested staging sequence for complex sites.
Check the public site
Open critical pages while logged out and clear the relevant caches when they show old content. Submit a test form and confirm receipt. Use a test payment mode on staging rather than making an accidental live purchase.
Check mobile navigation, images and the editor. An update can appear successful in admin while a public script or template fails. Record the change time so the host can match it to server logs.
Automatic updates reduce routine work but still need monitoring. Confirm that the site has current backups and that update notifications reach the responsible person. Do not assume every host or component uses the same automatic-update settings.
If something breaks
Stop further updates and capture the exact symptom. Follow the plugin-conflict process if the issue appeared after a plugin change. Use the maintenance-mode guide if the site remains unavailable after an update.
A rollback or restore can remove data created since the backup. Use a host-supported recovery process and preserve new content where needed. Installing an old version as a temporary recovery step also reintroduces any vulnerabilities fixed by the update, so arrange a supported resolution.
After recovery, repeat the critical checks and review why the update failed. A backup job marked successful is insufficient unless restoration is possible.
Sources & verification
Sources checked September 24, 2026. Documented behavior is distinct from hands-on testing.