Updating WordPress: Keeping Core, Plugins, and Themes Secure and Up to Date

Regular updates are among the most important tasks in managing a WordPress website. It's not just about new features. Updates fix bugs, improve compatibility and, above all, close known security vulnerabilities in WordPress, plugins and themes.

WordPress does not only consist of the actual WordPress system, the so-called WordPress Core. A typical website also uses a theme and several plugins. All of these components can be updated independently of each other and should be checked regularly.

In this guide, we show you how to safely update WordPress, plugins, and themes, when automatic updates make sense, why a backup before major updates is important, and what you can do if problems occur after an update.

Briefly explained: You can find available updates in the WordPress dashboard under Dashboard → Updates. Before major updates, you should have a recent backup. Regularly update WordPress, plugins, and themes, and then check whether your website continues to function correctly.

Why are WordPress updates so important? #

A WordPress website consists of various software components that are continuously being developed. Updates can include various improvements:

• Closing known security vulnerabilities
• Debugging
• Performance and stability improvements
• Adaptations to current PHP versions and web standards
• Compatibility improvements between WordPress, plugins, and themes
• new or revised features

Security updates in particular should not be postponed unnecessarily long. As soon as a vulnerability is publicly known, outdated installations can be targeted for attacks.

A permanently neglected WordPress installation is therefore an avoidable security risk.

What actually needs to be updated in WordPress? #

In everyday language, people often just talk about a „WordPress update.“ In fact, however, several different components can be affected.

Typically, this includes:

• WordPress Core: the actual content management system
• Plugins: Extensions for additional functions
• Themes: Design and partially additional functions of the website
• Translations: Language files for WordPress, plugins, and themes

All of these components can receive their own updates.

Where do I see available WordPress updates? #

First, log in to the WordPress admin area.

This is usually accessible during a normal installation at:

https://deine-domain.ch/wp-admin

Then open:

Dashboard → Updates

On this page, WordPress displays available updates for the WordPress core, plugins, themes, and translations, if applicable.

Additionally, available plugin updates appear under Plugins → Installed Plugins and theme updates under Design → Themes.

Create a backup before an update #

In most cases, WordPress updates work without any issues. Nevertheless, an update alters files, program code, or potentially database structures of your website.

That is why, especially before major updates, you should ensure that a current and recoverable backup is available.

A complete backup of a WordPress website basically includes at least:

• the files of the WordPress installation
• the WordPress database

The database is particularly important because, among other things, posts, pages, users, settings, and numerous plugin data are stored there. The files, on the other hand, contain WordPress itself, plugins, themes, and uploads, for example.

Important: A backup is only truly helpful if it can also be restored in an emergency. Do not rely on a backup for important websites if you do not know whether and how it can be restored.

Update WordPress Core via the dashboard #

If a new WordPress version is available, it is normally displayed in the dashboard.

Update WordPress Core #

1. Log in to the WordPress admin area.
2. Open Dashboard → Updates.
3. Check which WordPress version is being offered.
4. Make sure there is a current backup.
5. Start the offered WordPress update.
6. Wait until WordPress has completely finished the process.
7. Then open the website and the admin area.
8. Check important functions for errors.

You should not unnecessarily close the browser window or interrupt the process during the update.

What happens during a WordPress core update? #

During a normal update, WordPress replaces the required core files with the files of the new version. Custom content such as posts, pages, and media files is not simply deleted in the process.

With certain version changes, an update of the WordPress database may also be required. WordPress will usually notify you and guide you through the necessary process.

Making changes directly to WordPress core files is problematic because they can be overwritten during updates. Therefore, WordPress core should fundamentally not be modified directly.

Update plugins in WordPress #

Plugins extend WordPress with additional features and are developed independently of the WordPress core. That is why plugin developers release their own updates.

You can find available plugin updates, for example, under:

Plugins → Installed Plugins

or collected at:

Dashboard → Updates

Update WordPress plugin #

1. Open Plugins → Installed Plugins.
2. Check for which plugins updates are available.
3. Check the information on the new version for important updates if necessary.
4. Make sure a current backup is available.
5. Start the update of the requested plugin.
6. Wait until WordPress reports successful completion.
7. Next, check the features of your website that depend on this plugin.

We explain how plugins generally work and how to install them in our guide Installing WordPress plugins: What is a plugin and how does the installation work?.

Update all plugins at once or individually? #

WordPress makes it possible to update multiple plugins in a single operation. On a small, simple website, this can work without any problems.

However, for business-critical or more complex websites, it is often more sensible to perform updates in a controlled manner. For example, if you update ten plugins simultaneously and an error occurs afterward, it is not immediately obvious which update caused it.

For particularly important plugins, you can therefore proceed step-by-step:

1. Update plugin
2. Check website
3. test important function
4. update next plugin

That takes a little longer, but makes troubleshooting considerably easier.

Which plugins should you update with special care? #

The more a plugin interferes with the core functions of your website, the more carefully you should control an update.

Special attention is deserved, for example, by:

• WooCommerce and Shop Extensions
• Page Builder
• Form plugins
• Membership and user management systems
• Multilingual plugins
• SEO plugins
• Caching and performance plugins
• Security plugins
• Backup plugins

For a productive online shop, you should particularly check the order process, shopping cart, checkout, and payment functions for relevant updates.

Update WordPress themes #

Themes also receive updates. These can include bug fixes, security improvements, new features, or adjustments to current WordPress versions.

Available theme updates can be found at:

Design → Themes

or:

Dashboard → Updates

Before a theme update, however, an important question must be answered: Were changes made directly to the theme?

Caution with directly modified theme files #

If you have edited PHP, CSS, or other files of a theme directly, these changes can be overwritten during a theme update.

Customizations therefore do not belong directly in the files of an updateable parent theme. For more extensive code customizations, a Child Theme used.

We explain what a child theme is and when you need one in our guide Creating a WordPress Child Theme: Implementing Custom Modifications Safely Against Updates.

Attention: Do not blindly update a theme with unknown direct code modifications. First, clarify whether changes were made to the parent theme that could be lost due to the update.

What is the difference between minor and major WordPress versions? #

WordPress publishes different types of updates. A frequent distinction is made between Maintenance or security releases and new major versions are distinguished.

A version number can look like this, for example:

6.x.x

Smaller maintenance and security versions typically focus on bug fixes and security improvements. Major new versions, on the other hand, may introduce more extensive features and technical changes.

Regardless of the version number, you should check before an update whether your important plugins and themes are maintained and compatible with the new WordPress version.

Have WordPress update automatically #

WordPress has mechanisms for automatic updates. Certain core updates can be applied automatically, and automatic updates can also be activated for plugins and themes.

For plugins, you will usually find corresponding options under:

Plugins → Installed Plugins

There, automatic updates can be enabled or disabled for individual plugins.

Depending on the WordPress version and configuration, corresponding options are also available for themes.

Do automatic WordPress updates make sense? #

There is no blanket answer to that. Automatic updates have clear advantages, but also disadvantages.

Pros:

• Security updates are installed faster.
• Updates are less easily forgotten.
• Smaller websites require less manual maintenance.
• known vulnerabilities do not remain unpatched for an unnecessarily long time.

Possible disadvantages:

• An incompatible update can be installed without prior inspection
• Problems may not be noticed until later
• on complex websites, dependencies can exist between multiple components
• Mission-critical functions should be tested after updates.

The correct strategy therefore depends heavily on the website.

Automatic updates for small websites #

For a simple corporate website or a small blog with few established plugins, automatic updates for many components can make sense.

Nevertheless, a prerequisite is that regular backups are available and the website is monitored or occasionally checked.

„Automatically updated“ does not mean „never needs to be checked again“.

Updates for WooCommerce and business-critical websites #

For a live WooCommerce store, a membership platform, or a website with mission-critical functions, you should handle updates in a more controlled manner.

An error on a simple subpage is unpleasant. A non-functioning checkout, on the other hand, can directly prevent orders and revenue.

For websites like this, a structured approach is useful:

• Check backup
• Read update notes or changelogs for relevant components
• Consider compatibility of important extensions
• Install updates in a controlled manner
• test core functions immediately afterward

For extensive or particularly critical websites, an additional Staging environment make sense to test larger updates on first.

What is a staging website? #

A staging website is a separate test copy of your live website. Changes can be tested there without visitors or customers being directly affected.

This is particularly practical for:

• major WordPress updates
• extensive plugin updates
• WooCommerce updates
• PHP version change
• Theme change
• major design or code changes

After a successful test, the planned changes can be implemented in a controlled manner on the production website.

Update plugins before the WordPress core or after? #

There is no universally correct order for every combination of WordPress, theme, and plugin. The respective release notes and dependencies are what matter.

During a normal maintenance procedure, the following approach is often useful:

Practical update order #

1. Ensure current backup.
2. Check for available updates and notices.
3. Check important plugins and their compatibility.
4. Perform updates in a controlled manner.
5. Update WordPress core, if necessary.
6. Update theme and remaining components.
7. Clear cache.
8. Test website and core features.

If a developer explicitly recommends a different order for a specific plugin or theme, you should follow these product-specific instructions.

What should be tested after a WordPress update? #

Just because WordPress reports „Update successful“ doesn't mean all of your website's features have been checked.

Therefore, open at least the most important areas after updates.

Check, for example:

• Home
• important subpages
• Navigation and menus
• Display on desktop and smartphone
• Contact forms
• Login areas
• Search function
• Links and buttons
• multilingual content, if available

Also in WooCommerce:

• Product pages
• Cart
• Checkout
• Shipping options
• Tax calculation
• Payment methods
• Order confirmation emails

Clear the cache after the update #

If your website uses a caching system, older CSS, JavaScript, or HTML versions may still be delivered after an update.

This can make it appear as though an update has caused a display error, even though only outdated cache data is being displayed.

Therefore, check for relevant updates if necessary:

• the WordPress or plugin cache
• an existing server cache
• a CDN cache, if used
• if necessary, the browser cache

Afterwards, you should test the affected page again.

What does „maintenance mode“ mean during an update? #

During certain updates, WordPress briefly puts the website into maintenance mode. Visitors may temporarily see a notice that the website is briefly unavailable due to maintenance work.

Normally, this state lasts only a short time and ends automatically once the update is complete.

WordPress is stuck in maintenance mode after an update #

If an update is interrupted, it can happen that WordPress does not properly exit maintenance mode.

Typically, a file with the following name then remains in the root directory of the WordPress installation:

.Maintenance

back.

If it is certain that no update is running and WordPress still permanently displays the maintenance message, this file can be removed via the cPanel File Manager or FTP.

Attention: Delete .Maintenance not during an actual ongoing update. First, check whether the update process has really been aborted or completed.

What to do if the website stops working after an update? #

If an error occurs immediately after an update, you should not indiscriminately change other components.

First, try to narrow down which update might have caused the error.

Check:

• What was updated immediately before the error?
• Is only a specific function affected?
• Is the WordPress dashboard still accessible?
• Is a specific error message displayed?
• Does the error occur on all pages or only in a specific area?

If you updated plugins individually and tested after each update, the cause is much easier to identify.

Plugin causes an error after the update #

If a specific plugin causes issues immediately after being updated, there may be an incompatibility with WordPress, the theme, PHP, or another plugin.

If the dashboard is still accessible, you should first check the affected feature and the available information about the plugin.

In the event of severe problems, it may be necessary to temporarily deactivate the plugin. How this works is explained in our guide Deactivate or delete WordPress plugins.

On a production website, you should ensure that a recovery option is available before making any further changes.

Can I restore an older plugin version? #

Technically, a so-called Rollback be possible to an older version. However, this should not be done without careful consideration.

An older version may contain known security vulnerabilities or no longer match the current database structure. Furthermore, some updates modify stored data, so simply replacing the plugin files does not necessarily restore the previous state completely.

In critical problems, a complete backup created before the update is often the cleaner recovery option.

Update WordPress manually #

WordPress can generally also be updated manually. In the process, current WordPress files are downloaded and certain files or directories of the existing installation are replaced in a controlled manner.

However, for normal operation, updating via the WordPress dashboard is much more convenient and less prone to errors.

A manual update may be necessary, for example, if:

• the automatic update keeps failing
• the dashboard cannot be used for the update
• a damaged WordPress core installation needs to be repaired
• a special technical situation requires manual intervention

For beginners: If the normal update via the WordPress dashboard works, there is usually no reason to update WordPress manually via FTP.

Manually update WordPress: Basic principle #

During a manual update, the current WordPress version is obtained from the official WordPress website and the existing installation is updated with the latest core files.

In the process, individual content and the existing configuration must not simply be overwritten or deleted.

Of particular importance are, among others:

wp-content

and

wp-config.php

In the directory wp-content include, among other things, plugins, themes, and uploads. The file wp-config.php contains central settings of your WordPress installation.

Since errors during a manual update can render the website unusable, we recommend this method only if you know exactly which files may be replaced.

Never download WordPress from an unknown source #

If you need WordPress for a manual installation or update, use exclusively a trusted official source.

Do not download supposedly „optimized,“ modified, or otherwise offered WordPress packages from unknown download websites.

The same applies to plugins and themes. In particular, so-called „nulled“ premium plugins or themes from unofficial sources can contain tampered code and pose a significant security risk.

PHP Version and WordPress Updates #

WordPress, themes, and plugins have specific requirements regarding the server's PHP version. Therefore, with a very old PHP version, it can happen that a current software version is no longer supported.

Conversely, very old plugins or themes can cause problems with a newer PHP version.

If WordPress warns you about an unsupported PHP version before an update, you should take this message seriously and first check the compatibility of your website.

Do not blindly change the PHP version of a live website at the same time as numerous WordPress, plugin, and theme updates. Otherwise, troubleshooting becomes unnecessarily difficult if a problem occurs afterward.

Outdated plugins without updates are a problem #

An installed plugin that has not been maintained for a long time should be critically reviewed.

That does not automatically mean that every older plugin is insecure. However, if updates are missing for a long time and the extension is no longer tested with current WordPress or PHP versions, the risk of future compatibility and security issues increases.

Therefore, regularly check whether your installed plugins:

• still under active development
• are actually needed for the website
• are compatible with your WordPress version
• should be replaced by a well-maintained alternative

You should not simply leave unused plugins installed for years.

Do not collect updates for months #

It is not a good maintenance strategy to ignore a WordPress website for months and then update WordPress, 25 plugins, multiple themes, and PHP all at the same time.

The larger the version jump and the more components are changed simultaneously, the more difficult troubleshooting becomes.

Regular, controlled maintenance is much easier than rare major operations.

How often should I check for WordPress updates? #

For an actively maintained website, you should check for updates regularly. Security-relevant updates should be installed promptly.

How often a manual check is necessary depends on which automatic updates and monitoring mechanisms you use and how critical your website is.

For an online shop or a mission-critical website, a structured maintenance process makes more sense than occasional updates „whenever you happen to think of it.“.

Why a green update icon doesn't replace all maintenance #

A website is not automatically secure and technically sound just because WordPress no longer shows any available updates.

For reasonable WordPress maintenance, additional tasks include, for example:

• working backups
• current PHP version
• Review of no longer needed plugins and themes
• secure user accounts and passwords
• Monitoring of important website functions
• Monitoring for technical errors

Updates are therefore a central part of maintenance, but not the only one.

Common mistakes during WordPress updates #

• Ignoring updates for months
• not having a backup before major updates
• update many critical components simultaneously and not test them
• after an update, only check the dashboard, but not the website
• Update WooCommerce without testing checkout and payment flow
• Updating the theme despite direct changes to the parent theme
• Change PHP, WordPress, theme, and all plugins simultaneously
• Cancel updates during the process
• leave outdated and unneeded plugins installed
• Downloading WordPress, plugins, or themes from unknown sources

Note: Updates are not a risk that should be avoided for that reason. Not updating is the greater risk in the long run. The decisive factor is to perform updates regularly, with an existing backup and subsequent functional check.

Summary #

WordPress, plugins, and themes should be updated regularly. Updates close security vulnerabilities, fix bugs, improve compatibility, and introduce new or redesigned features.

You can find available updates centrally at Dashboard → Updates. Before making major changes, you should ensure that a current and recoverable backup of your website exists. For complex websites and online stores, it is recommended to perform critical updates in a controlled manner and, if necessary, test them in a staging environment first.

After each relevant update, you should check the most important areas of your website. In WooCommerce, these particularly include product pages, the shopping cart, checkout, shipping, taxes, and payment methods.

If a plugin causes issues after an update, our guide on Deactivating and deleting WordPress plugins. You should make your own theme customizations with a WordPress Child-Theme implement in an update-safe manner.