Updating is the single most important thing you do for your site’s security, and it is also the thing most people put off for fear of breaking something. The fear is reasonable: an update can break a site. The cure is not delay, it is order.
|
Putting it off is not the safe option, it is the opposite. When a security fix ships, the problem it fixes becomes public knowledge. People who scan for unpatched sites scan for exactly those. A site left alone for months is an advertised target.
|
The order that works
| 2 |
Pick a quiet hour. If something breaks, you would rather it broke in front of three visitors than three hundred.
|
|
| 3 |
Update one at a time, starting with the ones carrying security fixes.
|
|
| 4 |
Open the site between each one. Front page, plus a page that depends on that plugin. If it is a shop, put a product in the basket.
|
|
| 5 |
Stop the moment something changes for the worse. You know exactly which one did it, because you only moved one.
|
|
| 6 |
At the end, clear the caches, plugin and browser, before deciding there is a problem at all.
|
|
|
Read the release notes on the plugins that matter. For the ones holding up the site, such as the shop or the page builder, those notes usually say what changed and what stopped working.
|
Automatic updates: when yes, when no
| Case |
Recommendation |
| A simple site, no shop, no builder |
Turn automatic updates on for nearly everything. The risk of an update is smaller than the risk of going unpatched. |
| A shop, bookings, or payments |
Not automatic. Update by hand and run a test purchase afterwards. |
| Plugins that hold up the site design |
By hand, with a backup in place. They do the most damage when they go wrong. |
| Small, stable plugins |
Automatic, without hesitation. |
Each plugin has its own automatic update switch in the plugin list, in the right hand column. Themes carry the same option on their details page.
Doing this across several sites
The WordPress tool in cPanel, in the Domains section, shows every WordPress on the account on one page, with what is pending on each. If you look after three or four sites, that is where you save the afternoon.
When a plugin stops being maintained
If the author has vanished and the plugin has not moved in years, no update will save it. Find a maintained alternative, switch while the site is healthy, and only then delete the old one. Leaving an abandoned plugin in place is leaving a door nobody watches: how to tell if your site has been compromised.
|
Updated and the site broke? Tell us the time and what you updated, and we will get you back.
Open a support ticket
|
RECOMMENDED PRODUCT Web hosting with cPanel Domain and SSL included, daily backups and the panel you already know. from $10.00/mo See plans |
Angola
Brasil
Kenya
Moçambique
Nigeria
Portugal
South Africa
United Kingdom
United States
International
