Updating WordPress: The Complete Method to Break Nothing

To update WordPress successfully without breaking anything, follow a precise order: full backup, then translations, plugins, themes, WordPress core and finally PHP, testing the site between each step.

According to Patchstack's State of WordPress Security report (2025), more than 9 out of 10 vulnerabilities recorded in the WordPress ecosystem affect plugins.

NEXUS SYNERGY, a WordPress agency with 150+ sites delivered and maintained, walks you through its complete method, from the pre-update backup to conflict resolution.

A WordPress update actually covers four distinct jobs: the CMS core, the plugins, the themes and the server's PHP version. To break nothing, order matters as much as the action itself: backup first, plugins and themes next, then the core, then PHP, with a site check between each family.

At NEXUS SYNERGY, a WordPress development and maintenance agency, we run this procedure every week on dozens of client sites. This guide reproduces our internal method as is: the precautions to take, the exact order of operations, what to do when an update goes wrong, and what is reasonable to automate.

Why do WordPress updates matter so much?

WordPress runs 43.5% of all websites according to W3Techs (2026). That dominance has a downside: every flaw discovered in a popular plugin hands attackers millions of targets, findable by bots that scan the web around the clock. A site that never gets updated becomes vulnerable, not through bad luck, but through simple statistical exposure.

The industry numbers leave no room for doubt. More than 9 out of 10 vulnerabilities documented by Patchstack affect plugins, and according to Sucuri's reports, roughly one hacked WordPress site in two was running an outdated component at the time of infection. In other words, most hacks exploit a flaw that was already fixed, which the owner simply never installed.

Beyond security, every update brings you:

• Bug fixes: a form that stops sending, a cart that empties itself, these glitches often vanish with the next version
• Performance gains: recent versions of the core and of PHP run the same site faster, without touching the code
• Compatibility: plugins, themes and core evolve together, and a frozen component always ends up conflicting with the rest
• New features: improved block editor, native performance tools, richer APIs

Our agency's stance is blunt: postponed updates are the number one cause of the emergency site rescues we see. About half of our projects are redesigns or takeovers, and a good share of them arrive with two years of version backlog.

What needs updating on a WordPress site?

A WordPress site rests on four software layers, and each moves at its own pace. The Updates screen in the dashboard only shows three of them. The fourth, PHP, is managed on the hosting side and is the one most often forgotten, even though everything else depends on it.

• The WordPress core: major versions (6.8, 6.9) bring features, minor versions (6.8.1, 6.8.2) fix bugs and security flaws
• Plugins: the most sensitive layer, because that is where the vast majority of vulnerabilities and conflicts concentrate
• Themes: including inactive ones, which remain exploitable by an attacker as long as they sit on the server
• Translations: simple language files, with zero risk of breakage
• PHP: the language that runs WordPress on your server, upgraded from your host's control panel

PHP deserves special attention. Each branch is only maintained for a few years: the official calendar of supported PHP versions tells you when yours stops receiving security fixes. Moving from an obsolete version to a recent PHP 8 branch also delivers a real speed gain, measurable from the server response time onward. It is one of the first levers we pull in our web performance engagements.

What precautions should you take before a WordPress update?

A restorable backup is the only universal safety net: it turns a botched update into a ten-minute incident instead of a sleepless night. Before any intervention, make sure you have a full copy of the files and the database, and above all that you know how to restore it. A backup that has never been tested is just a hypothesis.

For major core updates, a WooCommerce site or a high-traffic site, add a staging environment, meaning a private copy of the site where you replay the update before touching production. Most managed hosts offer one in a single click. Ten minutes of staging tests save hours of live troubleshooting.

Our checklist before every intervention:

• Full, recent backup: files and database, with a restore already tested at least once
• Quiet window: work when traffic is low, never on a Friday night or during a campaign
• Changelog read: check the release notes of your critical plugins, any mention of a major overhaul calls for caution
• Compatibility shown: the "Tested up to" column of each plugin must cover your core version
• Staging ready: for major core versions, structural plugins and PHP

Backups deserve a guide of their own, between frequency, off-site storage and retention periods. Here, remember the rule that trumps all others: no recent backup, no update.

In what order should you run your WordPress updates?

The safest order for a WordPress update: translations, plugins, themes, core, then PHP, checking the site between each family. The logic is simple. Plugin developers ship their compatibility fixes before and right after every major core release. By upgrading your plugins first, they are ready to welcome the new core instead of suffering it. PHP goes last, because it requires the whole ecosystem above it to be up to date already.

The following table sums up the recommended order, the frequency and the risk level of each update type:

Two lessons stand out from this table. First, the risk almost never comes from minor core updates, which have installed themselves since WordPress 3.7: it concentrates on plugins, major versions and PHP. Second, the weekly cadence on plugins is not a luxury, because a security fix published on a Monday gets massively exploited by Wednesday. On major core versions, however, we deliberately wait two to four weeks before deploying: the first patch release irons out the early bugs found by the most eager adopters.

How do you update WordPress in practice, step by step?

The standard method goes through the "Dashboard > Updates" screen, which centralizes core, plugins, themes and translations. Simple on the surface. The classic trap is to tick everything and click once: if the site breaks, there is no way to know which component caused it.

• Run the backup: files and database, right before you start, not the day before
• Update plugins one by one: or in small batches of minor components, reloading the key pages between each
• Move on to the themes: your customizations must live in a child theme, otherwise they will be overwritten
• Finish with the core: then clear every cache (caching plugin, server, CDN) before judging the result
• Test the critical flows: homepage, contact form, checkout funnel if you sell online

Two alternatives round out the toolkit. WP-CLI, WordPress's command-line tool, does the same job in seconds (wp plugin update --all) and lends itself well to scripting: it is what we use on the sites we manage. As for manual updates over FTP, with a client like FileZilla, they are only justified in one case: an admin area that has become unreachable. After the operation, the Site Health tool, under the Tools menu, flags any lingering version or plugin issues.

What should you do when a WordPress update breaks the site?

Do not panic: in almost every case, the site can be fixed in under an hour. Three symptoms come up again and again. The "Briefly unavailable for scheduled maintenance" message means an update was interrupted. A white screen or the "This site is experiencing technical difficulties" message signals a fatal PHP error. Finally, WordPress often sends you a recovery mode email with a special login link.

The troubleshooting sequence, in order:

• Delete the .maintenance file: at the site root via FTP, it unblocks a site stuck in maintenance mode
• Use the recovery mode link: received by email, it lets you deactivate the faulty component identified by WordPress
• Deactivate all plugins: rename the wp-content/plugins folder via FTP, then reactivate them in halves to isolate the culprit
• Switch to a default theme: if the problem persists, a Twenty Twenty-Five theme rules out the theme as the cause
• Restore the backup: as a last resort, go back to the previous state, then replay the update in staging to understand what happened

This process of elimination identifies the faulty plugin in a few minutes, even on a site running forty of them. A word on rolling back for good: deliberately staying on an old version "because it works" means keeping a publicly documented flaw. And when a site has accumulated so much backlog that no update goes through without breaking everything, it has reached end of life: a clean WordPress rebuild then often costs less than repeated patch jobs.

Should you automate WordPress updates?

Yes for minor core updates, with discernment for everything else. Minor releases install themselves by default, and that is a good thing: they only contain fixes. Since WordPress 5.5, released in August 2020, you can also enable automatic updates plugin by plugin and theme by theme, straight from the dashboard.

Our doctrine, applied across the sites we maintain:

• Minor core releases: automatic, always and everywhere
• Simple plugins on a brochure website: safe to automate, as long as a daily backup runs alongside
• WooCommerce, page builders, structural plugins: human supervision, because a conflict there costs revenue
• Major core releases and PHP: never automatic, staging required

Automation does not replace supervision: an automatic update can break a site at 3 a.m. without warning anyone. That is exactly what our WordPress maintenance service covers, from $150 per month: weekly updates, daily backups, continuous monitoring and security patches, with a human checking the site after every intervention. At NEXUS SYNERGY, we find that a site followed this way almost never suffers a blocking incident, while a site left to itself takes one or two per year.

Frequently asked questions about updating WordPress

How often should you update WordPress?

Once a week for plugins and themes, that is the pace we apply on every site we maintain. Minor core updates install automatically, so they require nothing. For major core versions, wait two to four weeks after release, long enough for the first patch release to stabilize the whole. PHP, finally, gets upgraded about once a year, following the official calendar of supported versions. This weekly rhythm may feel demanding, but it shrinks the window of exposure to known flaws, which get exploited just days after publication.

Should you update the WordPress core or the plugins first?

Plugins first, core second. Plugin developers ship their compatibility fixes before and right after every major WordPress release: by upgrading the plugins first, they are ready to work with the new core the moment it lands. The full order we recommend: translations, plugins, themes, core, then PHP last. Between each family, reload the site's critical pages so you spot a problem immediately, while you still know which component just changed. That simple reflex turns a painful diagnosis into an obvious observation.

Can you run a WordPress update without a backup?

No, never, not even for a small, harmless-looking plugin. The backup is the only mechanism that guarantees a return to the previous state whatever goes wrong: plugin conflict, fatal PHP error, corrupted database or white screen. Without it, you depend on your host's ability to restore a recent copy, which is far from guaranteed. Also check that your backup covers both the files and the database, and test the restore at least once: a backup that has never been restored is a promise, not a protection.

How do you roll back after a failed WordPress update?

Restoring your backup remains the safest route: it brings files and database back to their pre-incident state in a few minutes. For a problem limited to a single plugin, you can also reinstall its previous version, available in the Advanced section of its page on the official WordPress.org repository. Fair warning though: rolling back is a troubleshooting tool, not a durable fix, because the old version keeps the flaws the new one corrected. Once the site is back up, replay the update in staging to identify the real cause of the conflict before pushing it to production again.

Are WordPress automatic updates reliable?

Yes for minor core updates, which have installed themselves since WordPress 3.7 with an excellent reliability record. For plugins and themes, the automation introduced by WordPress 5.5 works well on simple sites, provided a daily backup runs alongside. We advise against it, however, on e-commerce sites and sites built with a page builder: an incompatibility there can halt sales for hours before anyone notices. Automation handles the technical gesture, not the verification. A critical site needs a human check after every change.

Why do you need to update PHP on top of WordPress?

Because WordPress does not run in a vacuum: every page is generated by PHP, the language installed on your server. A PHP branch at end of life no longer receives any security fixes, which exposes the entire site, even with a perfectly up-to-date WordPress. The upgrade also brings a measurable speed gain, since recent PHP 8 branches run the same code noticeably faster. Before switching versions in your host's control panel, check your plugins' compatibility in staging: it is the most profitable update, but also the one that forgives improvisation the least.

Would you rather never think about this again? Hand your updates, backups and monitoring to a team that does this every week on dozens of sites: contact NEXUS SYNERGY for a free initial audit covering technical health, SEO and AI visibility, with a firm quote within 24 hours and a maintenance plan tailored to your site.