How to Update WordPress Safely (Core, Plugins and Themes)

Keeping WordPress updated is the single simplest thing you can do to keep a business website secure. Updates fix security holes, bugs and compatibility problems, and WordPress's own guidance is blunt: you should always update to the latest version. The update itself is usually one click. The care goes into what you do before and after.

Before you update: back up

WordPress recommends backing up your site before you start, so if anything goes wrong you can restore it. A full backup has two parts: your database, which holds your posts, pages and settings, and your files, which hold your theme, plugins and images. You need both. Many hosts take daily backups for you, but take a fresh one right before a major update anyway.

How to update WordPress, step by step

1. Log in to your WordPress admin area.
2. Look for the update message at the top, or go to Dashboard, then Updates.
3. Click Update Now (sometimes shown as Update to version and a number).
4. Wait while WordPress downloads and installs the update. Don't close the tab.
5. When it's done, you'll see a welcome screen for the new version.
6. Back on the Updates screen, update your plugins and themes too.

What updates automatically and what doesn't

Update type	Happens automatically?	What you do
Minor and security releases	Yes, on most sites	Nothing, but check your site now and then
Major feature releases	No	Click Update Now
Plugins	Only if you've turned on auto-updates for them	Update from Dashboard, Updates or the Plugins screen
Themes	Only if you've turned on auto-updates for them	Update from the Updates screen

WordPress has applied minor and security updates in the background for years on most sites, so those quietly look after themselves. Major versions still need you to press the button.

The catch: changes made directly to WordPress files are wiped

WordPress's documentation warns that updating replaces all the core WordPress files, and if anyone has modified those files, those changes will be lost. That usually only matters if a developer edited WordPress itself rather than making changes through a theme or plugin. If someone built your site with custom tweaks and you're not sure where they put them, ask them before a major update, or take a backup you can roll back to.

The same principle applies to themes: if your developer edited your theme's files directly instead of using a child theme, a theme update can overwrite their work.

If the one-click update doesn't work

• It asks for FTP details: WordPress says one-click problems are usually down to file permissions on your server. Ask your host to fix them.
• You're several versions behind: WordPress has extended instructions for jumping multiple versions. Your host can often do it for you.
• The site is stuck in maintenance mode: wait a few minutes. If it doesn't clear, your host can remove the maintenance file.
• Something breaks afterwards: deactivate plugins one at a time to find the culprit, or restore your backup.

After you update: a five-minute check

1. Open your homepage and two or three key pages, like your contact page.
2. Submit your contact form to make sure enquiries still arrive.
3. If you sell online, add something to the basket and go to checkout.
4. Check your admin area loads normally.
5. Clear any caching plugin's cache so visitors see the updated site.

Your contact form is the page that hurts most if it breaks quietly. If you're thinking about switching form plugins, see my comparison of WPForms alternatives.

How often should you update?

Update WordPress core whenever a new version appears, and check plugins weekly. Wait a few days after a big new release if you prefer, so any early bugs are fixed, but don't leave it for months. Out-of-date plugins are one of the most common ways small business sites get hacked.

Turning on automatic updates for plugins

On the Plugins screen, each plugin has an option to enable auto-updates. It's worth switching on for well-maintained plugins you rely on but don't customise, like security and backup plugins, so security fixes arrive without you remembering. Leave it off for anything that runs a critical part of your business, such as your shop or booking plugin, and update those by hand after a backup, so you can check them straight away.

Whatever you choose, look at the Updates screen once a week. Plugins that haven't been updated by their developers for a long time are worth replacing, because nobody is fixing their security problems.

My verdict

Updating WordPress is mostly one click on Dashboard, Updates, then Update Now. Back up first, update plugins and themes straight after, and spend five minutes checking your key pages and contact form. If the button asks for server details or your site has been heavily customised, bring in your host or developer. For more on keeping a business site safe, read my guide to stopping hackers getting into your website.

Frequently asked questions

Should I turn on automatic plugin updates?

For trusted plugins you don't customise, yes. Update critical plugins, like your shop or booking plugin, by hand after a backup.

Is it safe to update WordPress?

Yes, and WordPress recommends always running the latest version. Back up first in case something goes wrong.

Does WordPress update itself?

Minor and security updates install automatically on most sites. Major versions need you to click Update Now.

Will updating WordPress break my site?

Usually not. Problems tend to come from outdated plugins or edits made directly to WordPress files.

Should I update plugins before or after WordPress?

Back up, update WordPress, then update plugins and themes from the same Updates screen, and check your site.

Why is WordPress asking for FTP details?

It's usually a file permission issue on your server. Your host can fix it.