The short answer: check for updates every week, and install security fixes as soon as they come out. The longer answer is about how you update, because that’s what decides whether updates are safe or a gamble.
Why updates matter
Most of the security holes found in WordPress sites each year are in plugins, not in WordPress itself. When a plugin developer fixes one, the fix goes out as an update. Once that update is public, so is the problem it fixed, and automated bots go looking for sites that haven’t installed it yet.
That’s why an out-of-date plugin is the most common way small business sites get hacked. Nobody targets your site in particular. Bots simply try the known hole on every site they find.
Why waiting makes updates riskier
It feels safer to leave updates alone while the site works. The trouble is that updates pile up:
- Big jumps break more. Going from version 3.1 to 3.2 is a small change. Going from 3.1 to 5.4 after a year skips everything in between, and that’s where things stop working together.
- It’s harder to find the cause. If fifteen updates run at once and something breaks, you have fifteen suspects.
- Hosts move on. Hosts upgrade PHP over time. Plugins that haven’t been updated in a long while can stop working when that happens, even if you didn’t touch anything.
A safe weekly routine
- Take a backup first, and keep it somewhere other than the server your site runs on.
- Update one plugin at a time, not with “update all”. If something breaks, you know exactly which update did it.
- Check the pages that matter after each update: the home page, your contact or booking form, and checkout if you run a shop.
- Read the notes on big updates. A jump to a new major version (4.x to 5.0, for example) is where developers tend to change how things work.
- If something breaks, roll back to the previous version or restore the backup, then look into it calmly instead of on a live, broken site.
What about automatic updates?
WordPress installs its own minor releases (the security and bug-fix ones) automatically by default, and you can switch on automatic updates for individual plugins. That’s better than nothing for small, well-maintained plugins. The catch is that automatic updates don’t check your pages afterwards. If one breaks your contact form at 3am, you won’t know until someone tells you.
WordPress core and your theme
The same routine applies to WordPress itself and your theme. Theme updates have one extra trap: if someone edited the theme’s files directly instead of using a child theme, updating it can wipe those changes. Check before you update a theme you didn’t build.
Rather not do this every week?
This routine is exactly what our maintenance plans do. Every week we update WordPress, plugins and your theme, check your main pages, and roll back anything that breaks. You get daily off-site backups and a plain report each month. Plans start at $59 a month, with no contract.