WordPress security: no more fear of updates

Measure first

Look before you guess. Three screens in your dashboard tell you most of the story:

• Dashboard › Updates: pending WordPress, plugin, theme and translation updates. It also says which WordPress versions your site installs on its own.
• Tools › Site Health: your PHP version, whether automatic background updates are working, and WordPress’s recommendations, such as removing inactive plugins.
• Plugins: which plugins are inactive, and which have updates waiting.

Then ask one question: when was your last backup, and have you ever restored one?

1. Updates are the core of WordPress security

When a security hole is closed, the fix ships in a new version, and the hole becomes public knowledge. That’s why WordPress’s hardening guide says older versions aren’t maintained with security updates and are easier to attack. Only the latest version is officially supported; fixes carried over to older versions are a courtesy, not a promise. Plugins and themes are no different: WordPress.org advises updating them to the latest version to keep your site secure.

This isn’t abstract. WordPress 7.1.4, released on October 28, 2026, was a security release fixing multiple issues; WordPress.org recommended updating immediately.

2. Know what you’re updating

Not every update carries the same weight:

• Minor releases (e.g. 7.1.3 → 7.1.4): bug and security fixes. Since WordPress 3.7, most sites install them automatically.
• Major releases (e.g. 7.0 → 7.1): new features. Sites first installed with WordPress 5.6 or later get these automatically by default too; on older sites, you usually start them yourself.
• Plugins and themes: each is written by a different developer and updated on its own schedule. Your site depends on all of them working together.
• PHP: the programming language your site runs on. You update it in your hosting panel or through your host; WordPress currently recommends PHP 8.3 or later. A current version also helps speed; see Why is your site slow?

3. Backups: your way back

A backup is your insurance before every update. WordPress’s documentation says a full restore needs two parts: the database (posts, pages, settings) and the files (WordPress itself, plugins, themes, uploaded images).

• Back up regularly, and always before an update. WordPress’s documentation suggests weekly for small sites and daily for busy ones.
• Keep at least 3–5 recent backups in different places, with one off your server, for example in cloud storage.
• Test a restore at least once. Don’t trust a backup you’ve never restored.
• Your host’s backups are a good start, but as WordPress’s documentation notes, getting a copy from your host can take time. Learn to back up and restore on your own before you need to.

4. Staging: try it on a copy first

A staging site is a private copy of your site that visitors can’t see. You run major WordPress releases, updates to the plugins your site relies on, and PHP upgrades there first, then repeat them on the live site once all is well. Your host may offer one-click staging; a plugin or a local copy of the site works too.

If something breaks there, the live site is untouched; hold that update until it’s fixed. If it’s a security update, don’t wait long: ask the developer or your host for help.

On the copy, check:

• your homepage and most visited pages,
• your contact form: does the message actually arrive?
• the cart and checkout, if you run a store,
• the admin area and content editing.

5. Turn on auto-updates, selectively

• Minor WordPress releases: keep them automatic; security fixes arrive this way.
• Plugins and themes: since WordPress 5.5, you can turn auto-updates on one by one (“Enable auto-updates” on the Plugins screen). Use it for simple, well-maintained plugins. Update the ones your site relies on, like store, membership or page builder plugins, on staging first.
• A seatbelt: since WordPress 6.6, if a plugin’s auto-update causes a fatal PHP error (one that stops the page from loading) on your site, WordPress rolls the plugin back to its previous version and emails the admin. It won’t catch problems that throw no error, such as a broken layout.
• Read the emails: WordPress sends them after auto-updates. Auto-updates rely on scheduled tasks; if those stop, Site Health warns you.

And if an update takes the site down completely, don’t panic: WordPress emails the admin a recovery mode link that pauses the faulty plugin or theme for your session, so you can fix it.

6. Make it a routine

A calendar is what makes updates boring. Here’s the routine we suggest:

• Security releases: the same day.
• Plugin and theme updates: weekly, after a backup, in small batches.
• Major WordPress releases: on staging first, then live.
• After every update: check the homepage, forms and checkout. If something’s wrong, restore the backup.
• Monthly: delete the plugins and themes you don’t use instead of just deactivating them; WordPress’s hardening guide recommends it too. Look for alternatives to plugins whose WordPress.org page shows no recent updates.

Weekly may sound frequent. But the OWASP Top 10, the standard list of web security risks, names monthly or quarterly patch cycles as a typical reason updates don’t happen in time. This upkeep comes with running WordPress; if you’re still choosing a platform, weigh it too: WordPress or Shopify?

Where to start

Start with the backup: take a full one today and try restoring it once. Then clear pending updates in small batches, checking the site after each, and leave major releases for staging. To see where your site stands today, there’s our free 48-point inspection: platform and plugin versions, known vulnerabilities and your backup routine are among its checks, and the report tells you what to update first.