Do you keep my WordPress site and plugins updated?

The short version

• E-3 clients: tested updates are part of website care. You don’t need to click anything on the Updates screen.
• Updates matter because they close security holes. A site that “works fine” can still be open to known attacks.
• Doing it yourself: take a backup, update one plugin at a time, and check your home page, forms and checkout after each.
• Update the theme last, and never if someone edited its files directly without asking them first.
• If an update breaks something, roll back to the backup.

How does E-3 handle updates?

On sites we look after, updates are tested on a staging copy first. Uptime monitoring and security alerts tell us if something goes wrong later. Sites in website care are also backed up daily.

Updates won’t clear a “Not secure” warning. Outdated software and a missing security certificate are separate fixes. See why does my site say Not secure?

Some updates need more than a click, such as a newer PHP version on the server or a paid plugin whose license has lapsed. If you see an update warning and want to know what it means, call 814-399-4655 or email support@e3help.me.

How do I update safely myself?

You need an Administrator login, a current backup of both files and database, and half an hour when few customers are on the site. WordPress’s Updating WordPress guide says to back up first so you can restore if anything goes wrong.

1. Confirm today’s backup exists. See is my website backed up?
2. Go to Dashboard, then Updates. The Dashboard Updates screen guide explains each section: WordPress, plugins, themes and translations.
3. Read before you click. Open each plugin’s version details. A big jump in version number or words like “major” deserve extra care.
4. Update one plugin at a time. Tick it and select Update Plugins.
   • Expected result: a success message. The site shows a short maintenance message for a few seconds, then comes back.
5. Check the site after each one in a private window: home page, contact form, and add-to-cart if you sell online.
6. Update the theme last. WordPress warns that changes made directly to theme files are lost. If someone edited them, stop and ask.
7. Update WordPress itself when offered by selecting Update Now. Minor and security releases usually install on their own.
8. Clear any cache so visitors see the updated site.

“Select all” is faster, but if something breaks you won’t know which update caused it.

Should I turn on auto-updates?

WordPress lets you turn on auto-updates per plugin and per theme. The auto-updates guide shows the links on the Plugins screen and under Appearance, then Themes. WordPress emails the site admin after auto-updates run, including failures.

They suit small, well-kept plugins on a simple site. Be careful with plugins that run your shop, payments, bookings or page layouts: an update can break a page while nobody is watching. If you don’t see the links, your host or a plugin may manage updates already.

Why does this matter?

When a plugin maker fixes a security hole, the fix only protects you once it’s installed. Plugins, themes and WordPress also change together, so one left behind for years can stop working with the rest. An outdated plugin or theme is one of the usual ways into a hacked site, along with a stolen password. See I think my site was hacked.

What are the common mistakes and edge cases?

• Paid plugins need an active license to update. If an update isn’t offered, check the license.
• Unused plugins still need updates. Deactivate and delete what you don’t use. See how many plugins is too many.
• Abandoned plugins with no updates for a long time won’t get security fixes. Plan to replace them.
• “An automated WordPress update has failed to complete”: WordPress says this usually means a leftover maintenance file. Leave it to whoever manages the hosting.
• A request for FTP details during an update: don’t type in details you’re unsure of. Ask your host.

What if this didn’t work?

1. Note what you updated last. That’s the likely cause.
2. If the site shows a critical error, check your email for WordPress’s recovery link. See critical error or white screen.
3. Roll back the one plugin or theme that broke things, to its previous version, rather than the whole site. A full restore of the backup from step 1 also erases any orders, form entries or edits made since, so on a shop or busy site, save those first or ask your host to help.
4. Tell the plugin maker. Their support forum may already know about the bug.

If you’re not sure you can do this safely, that’s a fair call on a business site. Our website care checklist shows what regular upkeep covers.

Related questions

• Is my website backed up, and can you restore it?
• What is a staging site?
• Should I update WordPress plugins?