Updating WordPress is the simplest way to avoid most site problems — and at the same time an operation that can cause those problems when done hastily. Vulnerabilities in unupdated plugins are a standard attack vector, and old PHP versions reduce performance and security. On the other hand, "click Update All" on production without a backup and tests is the classic road to a white screen and restoring from backup. This guide shows the safe WordPress update process — from backup, through staging, to an update strategy for companies and stores.
Najważniejsze: A safe WordPress update is a sequence: backup → staging (site copy) → core update → plugins in batches (one by one, with tests) → theme → tests (front, panel, forms, store) → production release → monitoring. PHP should be 8.3+ (WordPress's recommendation), and security fixes are installed immediately. Updating "on production without a backup" risks losing the site — and the cost of repairing a failed update is often higher than planned care.
Why update WordPress?
- Security — most WordPress infections (malware removal) come from outdated plugins and themes.
- Performance — newer WordPress and PHP versions (8.3+ recommended) speed up the site.
- Compatibility — hosting and plugins increasingly require current versions; delaying increases "cascading" problems.
- Features and bug fixes — updates fix known bugs, not just add novelties.
Neglected updates are technical debt: after a year of delay, the "big update" becomes a migration project, not a click.
Automatic or manual updates?
WordPress automatically updates minor core versions (security fixes) by default. What about the rest?
| Element | Recommendation |
|---|---|
| Core (minor versions) | Automatic — these are security fixes |
| Core (major versions, e.g. 6.x → 7.x) | Manual, on staging, after tests |
| Plugins | Manual or semi-automatic, in batches |
| Theme | Manual, after tests (preferably with a child theme) |
| PHP | Planned, after compatibility checks |
Enable automatics selectively (for trusted, frequently updated plugins), always with backups and monitoring. "Everything automatic, as long as it works" is asking for surprises at the worst moment.
Safe update step by step
- Backup — a full copy (files + database) with fast restore capability. Do not start without it.
- Staging — a site copy at a separate address (subdomain, hosting environment). Perform updates and tests there.
- Check compatibility — plugin changelogs, PHP requirements, known conflicts; for bigger jumps — a "what blocks the update" list.
- Update core — WordPress first, then the rest.
- Update plugins in batches — 2–5 at a time, checking the site after each batch; isolate problematic plugins immediately.
- Update the theme — check appearance and features after the theme update (best to have a child theme the update does not erase).
- Tests — front and panel: forms, login, payments (if a store), SEO (titles, redirects), speed.
- Release and monitoring — move to production (or repeat the process on production after tests), watch logs and forms for a few days.
For a company site the whole process is 1–3 hours of work; for a WooCommerce store — longer, because tests include the purchase path.
What most often breaks after an update?
- Page builders and themes — changes in Elementor/themes can break layouts; copies and child themes are the remedy.
- Abandoned plugins — extensions with no updates for years; candidates for replacement, not "updating".
- PHP mismatch — a plugin runs on PHP 7.4 while hosting moved to 8.3; an update or replacement is needed.
- Cache — after an update, stale cache can show "ghosts"; clear plugin, server and browser cache.
- Plugin conflicts — they surface when one of a pair updates; isolate one by one.
Staging solves most of these problems — which is why updating "on production because it's faster" is false economy.
Update strategy for companies and stores
-
- Company site: monthly updates (core + plugins + theme), security fixes immediately, quarterly review (plugins to replace, performance).
-
- WooCommerce store: as above, plus purchase path tests after any update touching payments, shipping or the cart.
-
Critical plugins (payments, shipping, invoicing): update after reading the changelog, ideally in a low-traffic window.
-
- Plan B: always know how you will return to the previous version (backup + rollback procedure).
If you do not want to handle this yourself, it is a standard part of WordPress administration and website care.
Frequently asked questions
How often should WordPress be updated?
Core and plugins at least monthly; security fixes immediately (minor core versions can update automatically). Major updates and PHP changes — on a plan, on staging, with tests.
Can a WordPress update break the site?
Yes — most often through plugin conflicts, theme or page builder changes, and PHP mismatches. That is why the process includes a backup, staging and batched tests. The cost of repairing a failed update is often higher than planned care.
Should I enable automatic updates?
Minor core versions (security) — worth leaving automatic. Plugins and themes — better updated consciously, in batches, with a backup. Automatics without backups and monitoring are a risk.
Which PHP version should WordPress run on?
WordPress recommends PHP 8.3 or newer — newer PHP means faster operation and security support. Before changing the PHP version, check plugin and theme compatibility; migrate on staging.
What should I do when the site breaks after an update?
Do not panic and do not "fix" it on production: restore the backup (rollback), then diagnose on staging — PHP logs, plugin isolation, debug mode. Emergency procedures are described in WordPress malware removal and WordPress administration.
Who should do the updates — me or the vendor?
A simple site you can update yourself (with backups and care). A company site with traffic or a store — better delegated in an administration package: someone who knows the configuration, tests, and fixes it when something goes wrong.
Sources and tools
- WordPress.org — downloads and releases
- WordPress — Update PHP (recommendations)
- WordPress News — security
- OWASP — application security
- Google Search Central — site maintenance
👉 Rather have someone update the site for you? See WordPress development & care in my offer — tested updates, backups, monitoring and repairs. Get in touch via the contact form or at kontakt@informatix.com.pl.
👉 Tidying up site maintenance? Check WordPress administration, WordPress website care and WordPress malware removal.
📖 See also: WordPress website development, WordPress developer and e-commerce store development. Service: technical care with SLA.