Overview

Keeping WordPress updated is essential for website security, stability, compatibility, and performance. An outdated WordPress core, plugin, or theme may contain known vulnerabilities that attackers can exploit.

This guide explains how to:

• Update WordPress from the WordPress Dashboard.
• Update WordPress using WP Toolkit in cPanel.
• Update WordPress using WP Toolkit in Plesk.
• Configure automatic updates.
• Ensure WordPress security updates are allowed.
• Reduce the risk of compatibility issues or website downtime.

Important: An update is not a replacement for website security or backups. Always maintain a recent, restorable backup of your website.

What Should Be Updated?

A complete WordPress update process should cover:

• WordPress core: The main WordPress software.
• Plugins: Extensions that add functionality to WordPress.
• Themes: The active theme and any other installed themes.
• PHP version: The server-side programming language used by WordPress.
• Premium components: Commercial plugins and themes that may require an active licence to receive updates.

WordPress officially supports only the latest major release. Older releases might receive certain critical security fixes, but this is not guaranteed. Therefore, you should not leave a website on an old major version indefinitely. Learn more about supported WordPress versions.

Before Updating WordPress

Complete the following checks before installing updates.

1. Create a Backup

Create a complete backup that includes:

• Website files.
• WordPress database.
• The wp-config.php file.
• Uploaded media.
• Themes and plugins.

Make sure that the backup is recent and can be restored. A backup stored in the same hosting account may become unavailable if the account experiences an issue, so an off-site backup is recommended for important websites.

2. Review Available Updates

Check what will be updated and review the changelog when possible.

Pay particular attention to:

• Major WordPress releases.
• WooCommerce and other e-commerce plugins.
• Page builders.
• Membership or learning-management plugins.
• Security, caching, and firewall plugins.
• Custom or heavily modified themes.
• Plugins integrated with external payment or business systems.

3. Check Compatibility

Confirm that your themes and plugins support:

• The new WordPress version.
• Your current PHP version.
• Other important plugins used by the website.

If the website uses an outdated plugin or theme that is no longer maintained, updating WordPress may expose compatibility problems. However, leaving everything outdated is not a safe long-term solution. The unsupported component should be replaced or updated.

4. Use a Staging Website When Possible

For business-critical, e-commerce, or heavily customized websites, test updates on a staging copy before applying them to the live website.

A staging environment helps you check:

• Page layout.
• Login and registration.
• Contact forms.
• Checkout and payment processing.
• Search and navigation.
• Website integrations.
• Scheduled tasks and email notifications.

5. Choose a Suitable Time

Apply major updates during a low-traffic period and ensure that someone is available to test the website afterward.

Method 1: Update from the WordPress Dashboard

This method is suitable when you have administrator access to WordPress.

Access the Updates Page

1. Log in to your WordPress administration dashboard:https://example.com/wp-admin
2. Navigate to: Dashboard → Updates
3. WordPress will display available updates for:
   • WordPress core.
   • Plugins.
   • Themes.
   • Translations.

The WordPress Updates screen can manage both WordPress core and installed plugin or theme updates. Learn more about the WordPress Updates screen.

Update WordPress Core

1. Create or verify your backup.
2. Go to Dashboard → Updates.
3. If a new WordPress version is available, click Update to version… or Update Now.
4. Wait for the update to finish.
5. Do not close or refresh the page while the update is running.
6. If prompted, complete the database upgrade.
7. Log in again and test the website.

Update Plugins

1. Go to Dashboard → Updates, or navigate to Plugins → Installed Plugins.
2. Review the available plugin updates.
3. Select the plugins you want to update.
4. Click Update Plugins or Update Now.
5. Wait for each update to complete.

For important websites, consider updating plugins individually or in small groups. This makes it easier to identify the cause if a problem occurs.

Update Themes

1. Go to Dashboard → Updates, or navigate to Appearance → Themes.
2. Review the available theme updates.
3. Select the themes you want to update.
4. Click Update Themes or Update Now.

Warning: Updating a parent theme may overwrite changes made directly to its files. Theme customizations should normally be stored in a child theme.

Update Translations

If translation updates are available:

1. Go to Dashboard → Updates.
2. Locate the translations section.
3. Click Update Translations.

Method 2: Update WordPress Using WP Toolkit in cPanel

WP Toolkit provides a central interface for managing WordPress installations from cPanel. Its availability and included features depend on the hosting plan and WP Toolkit edition.

Access WP Toolkit

1. Log in to your cPanel account.
2. Locate the Domains or Applications section.
3. Click WP Toolkit.
4. Find the required WordPress installation.

If the installation does not appear, use the available Scan option to detect existing WordPress installations.

Check for Updates

1. Open the WordPress installation card.
2. Click Check updates if the latest status is not displayed.
3. Review the available updates for:
   • WordPress core.
   • Plugins.
   • Themes.

Install Updates

1. Click the message indicating that updates are available.
2. Select the required WordPress core, plugin, or theme updates.
3. If WP Toolkit offers a Restore Point option, keep it enabled.
4. Click Update.
5. Wait until WP Toolkit confirms that the operation has completed.
6. Open and test the website.

WP Toolkit allows cPanel users to manage WordPress installations from their hosting control panel. Some advanced features, including certain automatic-update and Smart Update capabilities, may require WP Toolkit Deluxe. See the cPanel WP Toolkit documentation.

Method 3: Update WordPress Using WP Toolkit in Plesk

Access WP Toolkit

1. Log in to Plesk.
2. Go to Websites & Domains.
3. Click WordPress, or open the WordPress section for the required subscription.
4. Locate the required WordPress installation.

Check and Install Updates

1. Review the Status section of the installation card.
2. Click Check updates if necessary.
3. Click the notification for the available WordPress, plugin, or theme updates.
4. Select the updates you want to install.
5. Keep Restore Point enabled when it is offered for a WordPress core update.
6. Click Update.
7. Wait for the operation to complete.
8. Test the website.

WP Toolkit can manage core, plugin, and theme updates and allows these automatic-update settings to be configured separately. See the Plesk WP Toolkit documentation.

Recommended Automatic Update Configuration

Automatic updates reduce the time during which a website remains exposed to a known vulnerability. However, an update may occasionally cause a compatibility problem.

The appropriate configuration depends on the website.

Recommended Configuration for Most Production Websites

Component	Recommended setting
WordPress minor and security releases	Enable automatic updates
WordPress major releases	Test first, then update promptly
Trusted, actively maintained plugins	Enable auto-updates if reliable backups and monitoring are available
Critical or complex plugins	Test on staging or update manually as soon as possible
Themes	Enable for standard themes; test customized or complex themes first
Unused plugins and themes	Remove them
Premium plugins and themes	Maintain an active update license

At a minimum, WordPress minor and security updates should remain enabled.

WordPress normally applies minor maintenance and security releases automatically in the background. Major feature releases may require manual approval depending on the website’s configuration. See the official WordPress update guidance.

Critical Websites

For e-commerce, banking, government, news, or heavily customized websites:

• Keep automatic minor and security core updates enabled.
• Use a staging environment for major updates.
• Use tested or monitored plugin and theme updates.
• Maintain frequent off-site backups.
• Configure uptime and error monitoring.
• Test forms, login, search, checkout, and integrations after updates.
• Apply confirmed security fixes urgently rather than waiting for the normal maintenance window.

Simple Websites

For a simple informational website using widely supported plugins and themes, enabling automatic updates for WordPress core, plugins, and themes is generally reasonable when:

• Reliable backups are available.
• The website is monitored.
• The website owner checks update notifications.
• There are no unsupported or heavily customized components.

How to Ensure WordPress Security Updates Are Enabled

From the WordPress Dashboard

WordPress normally enables automatic minor and security core updates by default.

To verify that background updates can run:

1. Log in to WordPress.
2. Navigate to Tools → Site Health.
3. Open the Status tab.
4. Review any warning related to:
   • Background updates.
   • Communication with WordPress.org.
   • Filesystem permissions.
   • Automatic updates.
   • Scheduled events.

Background updates require WordPress to communicate with WordPress.org and to have permission to modify its files. See the WordPress Site Health documentation.

Also check Dashboard → Updates for information about the current core automatic-update setting.

Do not select Enable automatic updates for all new versions of WordPress unless you also want major WordPress releases installed automatically. Minor and security updates can remain enabled without automatically installing every major release.

Using WP Toolkit in cPanel or Plesk

1. Open WP Toolkit.
2. Select the required WordPress installation.
3. Click Autoupdate settings.
4. Configure WordPress core updates as follows:Yes, but only minor (security) updates
5. Configure plugin and theme automatic updates according to the website’s risk and compatibility requirements.
6. Save the settings.

For staging websites, you may use:

Yes, all (minor and major) updates

This allows major releases to be tested away from the production website.

Selecting No for automatic WordPress core updates is not recommended because it may prevent minor security fixes from being installed.

Check the wp-config.php File

Advanced users can check the WordPress configuration file for the following constant:

define('WP_AUTO_UPDATE_CORE', false);

If this line exists, automatic WordPress core updates are disabled. Remove it or change it to:

define('WP_AUTO_UPDATE_CORE', 'minor');

This permits automatic minor and security core updates.

To allow all core updates, including major releases, the value can be set to:

define('WP_AUTO_UPDATE_CORE', true);

For most production websites, the recommended value is:

define('WP_AUTO_UPDATE_CORE', 'minor');

Before changing wp-config.php, create a backup and make sure that another plugin, hosting policy, or custom code is not controlling the update process.

Enable Automatic Plugin and Theme Updates

WordPress allows auto-updates to be configured separately for individual plugins and themes.

Plugins

1. Log in to WordPress.
2. Navigate to Plugins → Installed Plugins.
3. Locate the required plugin.
4. Click Enable auto-updates.

Themes

1. Navigate to Appearance → Themes.
2. Select the required theme.
3. Click Enable auto-updates, if available.

Plugin and theme auto-updates apply to all new releases provided by their update source; they are not limited only to security releases. Therefore, consider the plugin’s reliability and the website’s complexity before enabling them. See the WordPress plugin and theme auto-update guide.

Recommended Update Order

When performing updates manually, use the following general order:

1. Create a complete backup.
2. Review compatibility and release information.
3. Update plugins.
4. Update themes.
5. Update WordPress core.
6. Update translations.
7. Clear all caches.
8. Test the website.

In some cases, a plugin or theme developer may require WordPress core to be updated first. Always follow any specific update instructions supplied by the developer.

Tests to Perform After Updating

Check the following after every significant update:

• Homepage and important internal pages.
• WordPress administrator login.
• Contact and registration forms.
• Website navigation and search.
• Images, CSS, and JavaScript.
• Mobile layout.
• User login and password reset.
• Shopping cart, checkout, and payment gateway.
• WooCommerce orders and emails.
• Scheduled tasks and integrations.
• Error logs and browser console.
• Caching and security functions.

Also clear:

• WordPress cache.
• Plugin cache.
• Server-side cache.
• CDN or Cloudflare cache, when necessary.
• Browser cache.

Avoid clearing the entire CDN cache unnecessarily; purge only the affected URLs when possible.

If the Website Stops Working After an Update

Restore the Backup or Restore Point

If WP Toolkit created a restore point, use it to roll back the core update. Otherwise, restore the most recent working backup.

Disable the Problematic Plugin

If the WordPress Dashboard remains accessible:

1. Go to Plugins → Installed Plugins.
2. Deactivate the plugin updated immediately before the problem occurred.

If the Dashboard is inaccessible, use File Manager or FTP to rename the plugin directory:

wp-content/plugins/plugin-name

For example:

wp-content/plugins/plugin-name-disabled

Check the Error Log

Review:

• WordPress debug log, if safely enabled.
• cPanel Errors interface.
• Plesk logs.
• PHP error logs.
• Web server error logs.

Remove a Stuck Maintenance File

If the website remains on “Briefly unavailable for scheduled maintenance,” check the WordPress document root for:

.maintenance

Delete only this file after confirming that no update process is still running.

Contact Support

Contact support if:

• The update cannot be completed.
• The website returns a server error.
• You cannot access the WordPress Dashboard.
• WP Toolkit cannot detect or update the installation.
• File permissions prevent updates.
• The website remains in maintenance mode.
• You need help restoring a hosting backup.

When contacting support, provide:

• Domain name.
• Approximate time of the update.
• Component and version are being updated.
• Error message or screenshot.
• Actions already attempted.
• Whether a backup or restore point is available.

Frequently Asked Questions

Should I enable all automatic updates?

Not necessarily. For most production websites, automatically installing WordPress minor and security updates is strongly recommended. Major core updates and updates to critical plugins or customized themes may be tested first.

Are WordPress security updates enabled by default?

Minor maintenance and security core updates are normally enabled by default, but they can be disabled by configuration constants, plugins, file permissions, or hosting policies.

Does enabling plugin auto-updates install only security fixes?

No. WordPress plugin auto-updates install new releases provided by the plugin developer, whether they contain security fixes, bug fixes, or new features.

Can WP Toolkit update WordPress core, plugins, and themes?

Yes. WP Toolkit can check for and install updates for WordPress core, plugins, and themes. Available automatic-update and Smart Update features may depend on the WP Toolkit edition supplied with the hosting service.

Does Smart Update replace backups?

No. Smart Update can test updates on a cloned copy and identify potential problems, but regular restorable backups are still required.

Can I ignore updates if my website is working?

No. A website can appear to work normally while still containing publicly known vulnerabilities. Updates should be reviewed and installed regularly.

Should unused plugins and themes be updated?

Unused components can still create a security risk if their files remain installed. Remove plugins and themes you do not need. Keep any required inactive component updated.