How to Update WordPress: Step-by-Step Guide

Introduction

This guide covers the standard way to update a WordPress website from the built-in Dashboard: creating a backup first, the order to update in, how to test the website afterwards, and what to do if something breaks. For a typical website the whole process takes 15–20 minutes.

If you want the reasoning behind each of these steps, see How to Update WordPress and Plugins and Why It Matters.

Before You Update: Always Create a Backup

Before installing any updates, create a complete backup of your website. A backup allows you to quickly recover if an update causes unexpected problems.

A complete backup must include:

• Website files
• WordPress database

A files-only backup is not enough. Your database contains essential information such as:

• Pages
• Posts
• User accounts
• Website settings
• Orders and customer information

⚠️ Best practice

Perform updates during quieter periods and avoid major updates during busy sales periods or important business events. For business-critical websites, test the updates on a staging copy before applying them to the live website.

Step 1. Check Available Updates

Log in to your WordPress admin and go to Dashboard → Updates. One screen shows everything that requires updating:

• WordPress core
• Plugins
• Themes

The Dashboard → Updates page lists core, plugin and theme updates in one place.

Step 2. Update WordPress Core

Why update WordPress core first?

WordPress core updates often contain important security improvements, so they are applied before plugins and themes.

Steps

1. Go to Dashboard → Updates and click Update to version X.X.X.
2. Wait until the update completes. Your website may briefly show maintenance mode. Usually the process takes less than one minute.

A WordPress core update is usually completed with one click.

⚠️ Do not interrupt an update

Do not close your browser while an update is running. Interrupting an update can cause problems.

Step 3. Update Your Plugins

Why plugins need extra attention

Plugins are one of the most common attack points. Keeping them updated significantly reduces security risks.

Recommended method

Do not update all plugins at once. Update two or three plugins at a time — this makes it easier to identify the cause if something goes wrong. Start with the plugins your business depends on, such as the shop, booking or payment plugins.

1. Go to Plugins → Installed Plugins, select two or three plugins, then choose Bulk actions → Update and click Apply.
2. Test your website.
3. Continue with the remaining plugins.

Updating plugins in smaller groups makes troubleshooting easier.

Step 4. Update Themes and Remove Unused Themes

Unused themes are still stored on your server. Even inactive themes can contain outdated code that attackers may try to exploit.

Steps

1. Go to Appearance → Themes.
2. Update your active theme.
3. Remove themes you no longer use.
4. Keep one default WordPress theme as a backup.

Unused themes are unnecessary security risks — remove them.

⚠️ Custom theme warning

If your theme was specially modified by a developer, check with them before updating. Direct changes made inside theme files may be overwritten.

Step 5. Test Your Website After Updates

After the updates are completed, check that everything works correctly. Open your website in a private/incognito browser window and confirm that:

• the homepage loads correctly;
• images and design appear normal;
• important pages open;
• contact forms work;
• customer login works;
• the shopping cart works;
• checkout works.

Clear the cache before troubleshooting

If your website uses caching plugins or a CDN, clear the cache before assuming something is broken. Many update issues are simply old cached content.

What If Something Breaks?

Do not panic. This is why backups are important.

If you can access the WordPress admin

1. Go to Plugins → Installed Plugins.
2. Deactivate the last plugin you updated. If your website works again, that plugin is likely causing the issue.
3. Contact the plugin developer or look for an alternative.

If you cannot access WordPress

If you see a white screen, a critical error message or a broken website, restore your backup. A reliable backup allows you to return your website to its previous working condition quickly.

⚠️ A restore fixes a failed update, not an infection

If the website was already compromised before you updated, restoring an older backup can bring the malicious code back with it. When you suspect a compromise rather than a failed update, scan the website for malware as well — see How to Update WordPress and Plugins and Why It Matters.

Enable Automatic Updates

The best maintenance is the maintenance you do not have to remember. WordPress installs automatic security updates for the core by default — keep this enabled.

For plugins, go to Plugins → Installed Plugins and use Enable auto-updates for the plugins you trust.

Enable automatic updates to reduce manual maintenance.

⚠️ Important limitation

Automatic updates install new versions, but they do not guarantee that your website still works perfectly afterwards. For important business websites, regular checks are still recommended.

Recommended Maintenance Schedule

Frequency	Action
Immediately	Install security updates
Monthly	Create a backup, update WordPress, plugins and themes, then test the website
Quarterly	Remove unused plugins and themes, review your PHP version and licenses
Always	Keep working backups and security updates in place

Monthly Maintenance Checklist

• Create and verify a backup
• Check Dashboard → Updates
• Update WordPress core
• Update plugins in small groups, starting with the ones your business depends on
• Update the active theme
• Remove unused plugins and themes
• Test website functionality
• Clear the cache if required
• Confirm that automatic updates are still enabled
• Check that your PHP version is still supported by your plugins and theme

Summary

Website security does not always require complicated solutions. The most effective protection starts with basic maintenance: keep software updated, maintain reliable backups, remove unnecessary components and monitor your website regularly.

A few minutes of preventive maintenance every month can save hours of recovery work and protect your business reputation.

Keep your WordPress website updated. Keep your business online.

Useful links

• Updating WordPress — WordPress.org documentation — alternative update methods, including manual updates.
• Upgrading WordPress — WordPress Advanced Administration — detailed upgrade procedures and additional considerations.
• Backing up your WordPress site — WordPress documentation — what a complete backup includes and how to create one.
• How to Update WordPress and Plugins and Why It Matters — why each of these steps matters.

Next Step

→ How to Prevent Website Reinfection After Malware Cleanup?

What to check after a website has been cleaned, so the same weak point is not exploited again.