How to Update WordPress Plugins Safely

Why should you keep plugins updated?

Plugin updates fix bugs, add features and, most importantly, close security holes. WordPress's own hardening guide puts it simply: make sure your plugins are always updated. Out-of-date plugins are one of the most common ways websites get broken into.

What should you do before updating?

1. Take a backup of your files and database. See how to back up WordPress.
2. Read the changelog on the plugin's page ("View version x details") for big changes.
3. Check compatibility. The plugin's details show which WordPress version it has been tested up to.
4. Use a staging copy for shops and busy sites if your host offers one.

How do you update a plugin?

1. Go to Plugins › Installed Plugins. Plugins with an update show a notice underneath.
2. Click update now in that notice. To update several, tick them and choose Update from the Bulk actions menu.
3. Alternatively, go to Dashboard › Updates, tick the plugins and click Update Plugins.
4. Check your site in a private browser window: the home page, a contact form and, for shops, the basket and checkout.

Should you turn on plugin auto-updates?

WordPress.org's documentation explains that since version 5.5, administrators can opt in to automatic updates plugin by plugin, using the Automatic updates column on the Plugins screen. By default WordPress runs auto-updates twice a day and sends the site owner an email listing what was updated.

A sensible approach:

• Turn on auto-updates for small, well-maintained plugins, and for security plugins.
• Update by hand after a backup for plugins your site depends on, such as shop, booking or membership plugins, so you can check them straight away.

What happens if an update fails or breaks your site?

WordPress has two safety nets:

• Rollback (WordPress 6.3 and later): if a manual plugin or theme update fails while installing, WordPress automatically restores the version you had, so the site stays up.
• Recovery mode (WordPress 5.2 and later): if a plugin causes a fatal error, visitors see a message that the site is having technical difficulties, and WordPress emails the admin address a secret link to recovery mode. Use it to log in and deactivate the faulty plugin.

No email? Rename the plugin's folder in /wp-content/plugins/ using FTP or your host's File Manager (for example, add -off to the end). WordPress then deactivates it. Restore your backup or wait for a fixed version. More in how to fix common WordPress errors.

Where to go next

Read how to update a theme, and print our safe update checklist.