Installing WordPress updates as soon as possible is one of the best things you can do to keep your site safe.

According to WordPress security statistics, 96% of security vulnerabilities Wordfence discloses originate from third-party plugins.

Although Wordfence says 35% of the vulnerabilities they disclose go unresolved, most developers and even the developers behind WordPress itself update WordPress core, themes and plugins regularly with security patches to protect against potential security flaws and fix present vulnerabilities.

If you fail to install these updates, you run the risk of leaving your site vulnerable to attacks, including malware that impacts your visitors and complete site takeovers.

In this post, I explain four different ways to manage WordPress updates.

How to Manage WordPress Updates: Overview

There are four primary methods I recommend using to manage WordPress updates:

1. Staging – With this method, you move a copy of your site onto a secondary server, called a “staging server.” This allows you to test updates safely before pushing them to the live production version of your site.
2. Maintenance mode – A little riskier. It involves putting your site in maintenance mode to install and test updates.
3. Automatic updates – Very risky. By having WordPress, themes and plugins update themselves as soon as new versions are available, you increase your odds of breaking your site.
4. Maintenance service – Another safe way to install WordPress updates. You essentially hand over the responsibility of keeping your site up to date safely to a third party.

I highly recommend using the staging or maintenance mode methods if you’re going to be handling updates on your own.

Hire a WordPress maintenance service if you’d prefer to have a professional handle updates on your behalf.

Tips for Managing WordPress Updates Safely

Follow these guidelines to protect your site from bad WordPress updates:

• Create a schedule – Create a schedule for performing WordPress updates, and stick to it. Weekly is best, but biweekly and monthly also work.
• Create a backup before installing updates – Create a backup before you perform WordPress updates. If an update breaks your site, use this backup to restore it.
• Install WordPress updates when your site is less active – Use an analytics tool to see what time of day your site is less active. Perform updates during these hours to mitigate performance issues for users.
• Do not enable automatic updates for third-party themes and plugins – Site breaks are most likely to come from third-party themes and plugins, so it’s best to update them manually.
• Test updates with a staging site – Create a copy of your site on a staging server to ensure new updates are compatible with your theme and other plugins.
• Install updates one by one – Instead of installing updates in bulk, update them one by one, and refresh your site each time. This makes it easier to pinpoint which theme or plugin breaks your site, if any do.
• Test functionality before going live – Before you push new updates to the live production version of your site, test if your ecommerce, form and other site functions are working properly.
• Document updates – Keep logs that keep track of when you perform updates. Include dates and times, version numbers, and issues that occur.
• Restore a backup to fix issues – If an update breaks your site, restore a backup to fix the issue.
• Test if your theme broke your site – Activate another theme to test if your theme is causing an issue. The default Twenty Twenty-Five theme is a good choice for tests.
• Test which plugin broke your site – Deactivate all of your plugins. Then, reactivate them one by one to see which one breaks your site.
• Rollback your theme and plugins to previous versions to fix issues – If you know exactly which theme or plugin broke your site, consider using WP Rollback to restore a previous version of it.

Fixing Broken WordPress Themes and Plugins

After you restore your site to a backup or rollback the broken theme or plugin to a previous version, you still need to fix the issue. Leaving it in an unupdated state is a security risk.

Start by looking at the theme or plugin’s WordPress.org support forums, the developer’s own forums, the developer’s blog, an email they may have sent to customers, a status page on their website, or even their Twitter (X) account.

While you may not find an immediate solution, you might find evidence of other site owners who are experiencing the same issue as well as confirmation that the developers are aware of it.

If you can’t find anything, create your own support thread or get in touch with the developer through their support channels.

If all else fails, consider if you can replace the theme or plugin or delete it altogether.

1. Perform Updates with a Staging Site

The process for creating a staging site is dependent on your host. These days, most hosts have a feature called “one-click staging,” allowing you to create a staging environment in a few simple steps.

Look through your host’s help docs to see what process it uses for creating a staging site.

In Cloudways, create a staging site by clicking the “www” button for your server, selecting your application (your WordPress site), opening the Staging Management section, and clicking Launch Staging Application.

You’ll need to choose between one of two options:

• Option 1: Same Server – Launch a staging environment on the same server your site is hosted on. This saves costs but might interfere with performance, though this shouldn’t be an issue if you perform updates when your site is less active.
• Option 2: Different Server – You’ll need to pay separate hosting fees, but it’s better for performance.

With Cloudways, your staging environment is password protected. Look in the Access Details in Cloudways for the username and password.

Use your regular login information to log into WordPress on your staging site. Note that if you’ve moved your site’s login page by renaming its URL, you’ll need to use this new URL with your staging environment as well.

Once you’ve logged in, perform updates using the tips I listed earlier.

Once you’re sure the updates have not caused any issues, go back to the Staging Management section of your staging site in Cloudways. Then, click the Push button to push the updates you installed on your staging site to the live version of your site.

I use the following settings when I push WordPress updates from a staging environment to my live site:

• Web Application Files
  • Incremental
• Yes, please take backup

Please read through Cloudway’s documentation on its staging feature for more information.

If you experience issues afterward (sometimes my site reverts to a broken HTML state after pushing updates to it), try purging the cache for the live version of your site in Cloudways as well as your caching plugin in WordPress.

Otherwise, restore your site from the backup Cloudways created to correct any issues that show up.

Test the live version of your site to ensure the updates transferred correctly.

2. Perform WordPress Updates in Maintenance Mode

If you’re going to perform WordPress updates on the live version of your site, do it in maintenance mode, and do it when your site is less active.

Use a maintenance mode plugin like SeedProd or CMP. These plugins allow you to enable maintenance mode and display a simple “under maintenance” page instead.

Enable it whenever you need to perform updates on your website.

Add an email opt-in form and social media links to your maintenance page. These elements give visitors other ways to interact with your business while your website is down.

3. Enable Automatic Updates in WordPress

I don’t recommend enabling automatic updates for third-party themes and plugins in WordPress. All it does is put your site at a greater risk of breaking, leading to downtime you’re not prepared to deal with.

However, it is a legitimate way to manage WordPress updates, so let’s go over how to do it.

Follow these steps to enable automatic updates for WordPress core:

1. Go to Dashboard → Updates.
2. Click “Enable automatic updates for all new versions of WordPress.”

WordPress installs security updates automatically regardless of your settings. If all automatic updates are already enabled for WordPress core, you’ll see “Switch to automatic updates for maintenance and security releases only” instead.

In this case, automatic updates for all WordPress updates are already enabled, so you don’t need to do anything.

Follow these steps to enable automatic updates for WordPress plugins:

1. Go to Plugins → Installed Plugins.
2. Click “Enable auto-updates” for every plugin you want to enable automatic updates for.
   1. Tips: Use bulk options to enable automatic updates for all plugins.

Follow these steps to enable automatic updates for WordPress themes:

1. Go to Appearance → Themes.
2. Hover over the theme you want to enable automatic updates for.
3. Click Theme Details.
4. Click “Enable auto-updates.”

4. Hire a Maintenance Service to Manage WordPress Updates

Hire a WordPress maintenance service if you’re too busy to manage WordPress updates on your own or if you feel it’s too much of a hassle.

WordPress maintenance services perform and test WordPress updates on your behalf. They may even offer additional maintenance services, such as cleaning an infected site and fixing bugs.