WordPress updates are necessary. They patch security holes, fix bugs, and add new features over time. They also occasionally break things in the process. The bloggers who never run into update problems aren’t lucky; they simply update in the right order and take the right precautions along the way.
The three types of WordPress updates
1. WordPress core
This is the WordPress software itself, and it comes in two kinds.
- Minor releases (5.5.1 to 5.5.2, for example). Usually security and bug fixes. These auto-install by default and carry low risk.
- Major releases (5.5 to 5.6, or 6.x to 7.x). These bring new features and carry a higher risk of compatibility issues.
2. Plugins
Each plugin updates on its own independent schedule. Some update daily, some quarterly. Frequency varies enormously by plugin.
3. Themes
Themes update less often than plugins do. When they update, they can affect your site’s design and structure directly.
The update order
If several things need updating at once, there’s a right order to follow.
- Plugins first. Most plugins lag behind new WordPress versions, so updating them first ensures they’re compatible with whatever core version you’re about to install.
- WordPress core next.
- Themes last. Themes often depend on both plugins and core, so update them once those two are already current.
This order minimizes compatibility problems overall.
Before any update
1. Take a backup
Always do this, even for minor updates. If something breaks, you’ll have a clear recovery path waiting.
UpdraftPlus, your host’s built-in backup tool, or BlogVault all work fine. Just make sure you take one before you start.
2. Check your update notes
WordPress’s “What’s New” notes and individual plugin changelogs often call out breaking changes explicitly. It’s worth a quick skim before you update anything major.
3. Use staging if you can
Test the update on staging before pushing it to live. This catches most issues well before they ever reach real visitors. Our guide to setting up a WordPress staging site covers exactly how to build this workflow if you don’t have one yet.
Most managed WordPress hosts already include staging, among them Kinsta, WP Engine, SiteGround, and Cloudways.
Updating plugins
One at a time
WordPress lets you update every plugin at once with a single click. Don’t do that.
Update one plugin, then visit your homepage and a single post to verify everything still works correctly. Only then move on to the next plugin.
If eight plugins update simultaneously and the site breaks, you won’t know which one caused it. Updating sequentially keeps troubleshooting simple.
For minor plugin updates
Same plugin, minor version bump (1.2.3 to 1.2.4, say). This is usually safe, and you can update without extensive testing afterward.
For major plugin updates
A jump from 1.x to 2.x carries higher risk. Check the changelog carefully for breaking changes, and test on staging first if you can.
If you can’t update one plugin
Sometimes a plugin update turns out incompatible with your specific setup. Your options here include waiting for the developer to release a fix, finding an alternative plugin entirely, or manually pinning to the current version, which is a more advanced move.
Don’t just ignore it for months, though. Outdated plugins are a genuine security risk the longer they sit unpatched.
Updating WordPress core
WordPress core updates show up right in your dashboard when they’re available. The official WordPress documentation on updating WordPress covers the mechanics in detail.
Minor releases
These auto-install by default, a behavior that’s been standard since WordPress 3.7. They carry low risk and are mostly security patches.
If you’ve disabled auto-updates for some reason, turn them back on for minor releases at least. The security benefit clearly outweighs the small residual risk.
Major releases
WordPress won’t auto-install major releases unless you’ve explicitly opted in to that behavior.
The recommended workflow looks like this:
- Wait one to two weeks after release. This gives the wider community time to find and fix common issues first.
- Update your plugins to versions that are compatible with the new core.
- Test the update on staging.
- Update core on your live site.
- Verify the site works as expected afterward.
Updating themes
Themes update less frequently than plugins do. When they do, what happens next depends on your setup.
If you use a child theme
The parent theme update is completely safe. Your customizations live in the child theme and survive the update untouched. See our child theme setup guide if you haven’t built one yet. This is worth setting up even for a theme like Aurora, where most day-to-day changes already live safely in the Customizer, since anyone who’s also editing actual template files still needs that separation before the next update lands.
If you don’t use a child theme but customized the parent theme anyway
Updating will overwrite your customizations directly. Your options are to not update at all, to update and then manually re-apply your customizations (which gets tedious fast), or to migrate to a child theme first and then update safely.
If you ever touch theme files directly, set up a child theme before doing anything else.
Auto-updates
WordPress 5.5 and later supports per-plugin auto-updates, which you can enable individually right from the Plugins screen.
Turn auto-update on for
- WordPress core minor releases, which is the default behavior anyway.
- Reliable, well-maintained plugins with a strong track record.
- Security-focused plugins where prompt updates genuinely matter.
Leave auto-update off for
- WordPress core major releases, which you should test first.
- Theme updates, which you should also test first.
- Plugins central to your site’s operation, like caching, page builders, or e-commerce.
- Less-maintained plugins where past updates have already broken things.
The “broken site after update” recovery
If something breaks right after an update, here’s how to work through it.
If you can still access the admin
- Deactivate the plugin that was just updated.
- If the problem persists, check the recently updated theme next.
- If it’s still broken after that, restore from your backup.
If you can’t access the admin at all
- Connect via SFTP or your host’s file manager.
- Navigate to
/wp-content/plugins/. - Rename the problem plugin’s folder by adding “-disabled” to the end. This automatically deactivates it.
- Try logging in again.
- If it’s still broken, restore from your backup.
White screen of death
This is a specific failure where every page on the site goes completely blank.
- Enable WP_DEBUG in wp-config.php to actually see the underlying error.
- It’s often a PHP fatal error caused by a plugin conflict.
- Deactivate the most recently updated plugin via SFTP to confirm.
The “I updated and nothing works” major-update issue
Major WordPress core updates occasionally run into compatibility issues with older themes or plugins that haven’t kept pace.
If a major core update breaks something, restore from backup first, which puts you back on the older core version. From there, identify what actually broke, which is often an outdated plugin, update or replace that specific plugin, and then retry the core update once it’s resolved.
How often to check for updates
Checking weekly is enough for most blogs. Log into the admin once a week, check the Updates page, apply whatever’s available in the right order, and verify the site still works afterward.
That’s five to ten minutes a week, and it compounds into a site that stays reliably current over time.
The “I never update” risk
Sites that haven’t been updated in six or more months are sitting on known security vulnerabilities the whole time. Automated attackers actively scan for exactly these sites, and eventually one of those attempts succeeds.
Updates genuinely aren’t optional here. They’re maintenance. Build the weekly habit and stick with it.
For sites with custom code
If you have custom plugin code, custom theme code, or custom integrations running:
- Test more aggressively than you otherwise would. Custom code can break in subtle, hard-to-spot ways across updates.
- Always use staging for major updates without exception.
- Read the update notes carefully for anything resembling a breaking change.
- Keep your custom code under version control.
PHP version updates
This isn’t WordPress itself, but it’s closely related: your host’s PHP version matters too. WordPress currently recommends PHP 8.3 or higher for the best combination of performance and security. You can check the exact recommendation on the official WordPress requirements page.
If your host is still running an older PHP version, especially anything before 8.0, performance suffers noticeably, some plugins simply won’t work, and security patches for that PHP version eventually stop arriving altogether.
Most managed hosts let you update your PHP version right from their control panel. Do it, and test on staging first if that option is available to you.
Themes built for smoother updates
Part of what makes core and plugin updates less stressful is choosing a theme that doesn’t require constant hacking to keep working. Aurora handles most customization through the Customizer rather than through direct file edits, which means fewer of your changes are ever at risk when the theme itself updates.
The quick reference version
Update WordPress, plugins, and themes regularly, weekly check is enough. Always back up first. Update plugins one at a time, then core, then themes. Test on staging for major updates. Auto-update minor releases; manually approve major ones. Use a child theme if you customize the parent. Recovery path: deactivate via SFTP if admin is locked, restore from backup if all else fails. The “I don’t have time to update” attitude is how WordPress sites get hacked.
