TL;DR
- Once a month. Webmaster For Hire recommends updating WordPress, your plugins, and your theme once a month, right after a fresh backup.
- Never on release day. Waiting gives plugin developers time to fix the bugs that show up after a new version comes out.
- Security can’t wait. If a serious security hole affects your site, we patch it within 24 hours of being notified, whether the alert comes from our security monitoring or from you.
- Back up first, every time. A backup is your way back if an update breaks something.
What Needs Updating on a WordPress Site
Your website is built from several pieces of software. Each one gets updates from the people who make it:
- WordPress core: the main software that runs your site.
- Plugins: add-ons that give your site features like forms, online stores, and security.
- Your theme: the software that controls your site’s design and layout.
- PHP: the programming language WordPress runs on. It lives on your hosting server, so it gets updated at the hosting level.
Premium plugins (the paid ones) only get updates while their license is active. See Do Premium WordPress Plugins Need to Be Renewed Every Year?
Updates fix bugs, add features, and close security holes. A WordPress site needs monthly updates and backups to lower its risk of getting hacked. Skip them long enough and your site becomes an easy target.
What Webmaster For Hire Recommends
- Update once a month. Pick a day later in the month and stick to it. That’s how we run updates for our clients.
- Don’t update on release day. New versions sometimes ship with bugs nobody caught. Give the developer time to fix them.
- Back up first. We trust nothing, so a fresh backup comes before every update.
- Leave late arrivals for next month. New updates will pop up after your monthly run. That’s normal. They go in the following month.
- Do major WordPress releases by hand. A major release (a big new version of WordPress with new features) can change how your site looks and works. We update those manually and check the site afterward.
Thinking about running updates yourself? See Should I Run WordPress Updates Myself or Hire a Webmaster?
Why We Wait for the Monthly Update
New plugin versions sometimes have bugs that only show up once people start using them. The sites that install an update on day one are the ones that find those bugs.
By the time our monthly update comes around, the developer has typically released a fix. Your site gets the fixed version and skips the broken one. We’ve watched this happen: a plugin released a buggy update, and because we waited, our client’s site never installed it.
When Security Can’t Wait
Security fixes are the exception to the monthly rule. When a security alert comes in, this is what we do:
- Check whether your site is affected. An alert only matters if your site runs the plugin and version it’s about.
- Back up. Same rule as always.
- Patch it within 24 hours. If your site is affected, the fix goes in within 24 hours of being notified, whether the alert comes from our security monitoring or from you. No waiting for the monthly run.
WordPress also installs its own small security releases automatically by default (WordPress upgrade documentation). Plugins and themes only update on their own if someone turned on auto-updates for them.
What About PHP Updates?
PHP lives on your hosting server, so it gets updated at the hosting level. On sites we manage, we handle the PHP upgrade for you. Older PHP versions become deprecated (no longer supported or patched), and you’ll need to move to a newer one. Keep your site on the latest PHP version WordPress recommends. You’ll find it on WordPress’s requirements page.
- The risk: older themes and plugins may not work with newer PHP, and your site can break.
- Our approach: we test your site on the new PHP version first, fix what breaks, and then upgrade.
- The worst case: if your theme’s developer abandoned it, the theme may not survive the upgrade, and the site may need a rebuild.
:: Common Questions ::
Why Do I Get Emails Saying My Plugins Were Updated?
That’s an automatic email from WordPress. It’s telling you which plugins updated on their own. You don’t need to reply or do anything with it. If something looks off on your site after one of those emails, let your webmaster know.
Should I Turn On Auto-Updates?
Auto-updates (WordPress installing new versions without anyone clicking Update) get fixes onto your site faster. The catch is that they install new versions soon after release, before early bugs are found, and nobody checks your site afterward. That’s why we run updates once a month, with a backup first.
What Happens If I Stop Updating?
Your site keeps running, but the security holes pile up. Abandoned plugins and themes (ones their developers stopped updating) are a common way in, because those holes never get fixed. Catching up later is harder too, since months of changes land at once. For the backup side of this, see How Should I Back Up My WordPress Website?
Want Someone Else Keeping Up With Your Updates?
Our WordPress Support Services plans include hosting, daily backups, monthly updates, security monitoring, and 24-hour repair and restore if your site is ever hacked. To talk through your site first, request a consultation.
