Every WordPress site accumulates updates. Log in after a few days away and there’s usually a stack of them waiting – a WordPress core update, several plugin updates, maybe a theme update. The instinct to click “Update All” and be done with it is understandable, but it’s also how sites break.
Updates are essential. They fix security vulnerabilities, patch bugs, and keep your site compatible with the latest version of PHP and WordPress itself. But running them without a process – no backup, no order, no testing – is how you end up with a broken site at an inconvenient time. In most WordPress sites I manage, the same structured approach every time means updates are routine rather than risky.
This guide walks through how to update WordPress core, themes, and plugins safely, in the right order, every time.
Quick Answer
Back up your site before doing anything. Then update plugins first, themes second, and WordPress core last. After each update, check your site visually and test key functionality. If something breaks, restore the backup immediately. Never update everything at once on a live site without a backup in place.
Why the Order Matters
WordPress core, themes, and plugins are interdependent. A plugin may rely on a specific WordPress core feature. A theme may depend on certain plugin functionality. When you update core first, you change the foundation everything else runs on – and if a plugin isn’t yet compatible with the new version, it can cause errors immediately.
Updating plugins first gives plugin developers time to release compatibility updates before you update core. It also means any plugin conflicts surface against the current core version, where the fix is usually simpler. The official WordPress documentation on updating WordPress follows the same order for this reason.
Step-by-Step Instructions
Step 1: Back Up Your Site First
This is non-negotiable. Before any update, take a complete backup – files and database. If something breaks during the update process, the backup is the only way to get back to a working state quickly.
Most managed WordPress hosts run daily backups automatically, but don’t rely on the host backup alone for a pre-update snapshot – take a manual one immediately before you start. A plugin like UpdraftPlus or Duplicator can do this in a few minutes. The full process for setting up a reliable backup system is covered in the guide on how to back up a WordPress website.
Step 2: Check What Needs Updating
In your WordPress dashboard, go to Dashboard ? Updates. This shows everything with available updates: WordPress core, plugins, and themes, each listed separately with version numbers.
Before updating, check the changelog for any major plugin or theme updates. Most plugins link to their changelog from the updates page. A major version bump (e.g. 3.x to 4.0) is worth reading through – major updates can introduce breaking changes. Minor and patch updates (3.1 to 3.2, or 3.1.0 to 3.1.1) are usually safe to apply without much scrutiny.
Step 3: Update Plugins First
Go to Plugins ? Installed Plugins and select all plugins with available updates. Click Update. Watch the progress – each plugin shows a success or failure message as it updates.
After all plugins have updated, visit your site’s frontend and check the key pages: homepage, a blog post, any forms or checkout pages, anything that relies on plugins. Look for visual errors, broken layouts, or console errors. If something is wrong, identify which plugin caused it – you can deactivate plugins one by one to isolate the issue.
Step 4: Update Themes
Go to Appearance ? Themes and update any themes with available updates, including inactive ones. Inactive themes with known vulnerabilities can still be exploited, so keeping them updated (or deleting themes you don’t use) is good practice.
If you’ve made direct edits to your active theme’s files, a theme update will overwrite those changes. This is why customisations should always be made through a child theme rather than the parent theme directly. After the theme updates, check your site visually – theme updates occasionally change layout or styling.
Step 5: Update WordPress Core Last
Return to Dashboard ? Updates and run the WordPress core update. The update process takes the site briefly offline – WordPress shows a maintenance message to visitors during this time, which usually lasts under a minute.
After the core update completes, WordPress redirects you to the welcome screen for the new version. Check your site immediately – front end, back end, and any critical functionality. Core updates occasionally affect how certain plugins behave, so even if plugins were fine after step 3, test again after updating core.
Step 6: Test and Verify
After all updates are complete, run through a quick checklist:
- Homepage loads correctly
- Navigation works on desktop and mobile
- Contact form submits successfully
- Any ecommerce pages (cart, checkout) function normally
- Images and media load
- WordPress admin is accessible and responsive
If everything looks good, the update process is complete. If something is broken, restore your backup immediately and investigate before trying again.
Practical Tips
Update on a staging site first for high-traffic or business-critical sites. A staging environment is a clone of your live site where you can run updates, test the result, and only push to live once everything is confirmed working. The guide on how to create a WordPress staging site covers how to set one up.
Don’t let updates accumulate for months. Sites that haven’t been updated in a long time are significantly more vulnerable to attack, and running many updates at once makes it harder to identify what caused a problem if something breaks. A monthly update schedule is a reasonable minimum for most sites.
Enable automatic updates selectively. WordPress can automatically apply minor core updates (security and maintenance releases) without manual intervention – this is enabled by default and worth leaving on. Auto-updates for major core versions and plugins are riskier and are better managed manually unless you have a solid backup and recovery process in place.
Watch for major WordPress version releases. These happen two or three times a year and are worth researching before applying. The release notes on WordPress.org describe what changed and flag any known compatibility issues. A major release on a busy ecommerce site warrants extra caution – test on staging first.
Common Mistakes
Updating without a backup. The backup is the safety net for the entire process. Without it, a broken update means hours of troubleshooting rather than a five-minute restore.
Updating core before plugins. A WordPress core update can break plugins that haven’t yet released a compatibility update. Always update plugins first and give plugin developers the time they need to catch up with core.
Ignoring theme customisation overwrite risk. If you’ve edited theme files directly and update the theme, those edits are gone. Use a child theme for all customisations before running any theme updates.
Not testing after updates. Updates occasionally break things in ways that aren’t immediately obvious – a checkout flow that stops working, a form that silently fails to send, a layout that shifts on mobile. A quick visual check after each update catches these before a real visitor encounters them.
When to Use Automatic vs Manual Updates
Automatic minor core updates (security patches) are safe to leave enabled – they close known vulnerabilities quickly without requiring manual action. For everything else, manual updates with a backup-first process give you the control to test and recover if something goes wrong.
For sites you manage on behalf of clients, or any site where downtime has a real cost, build updates into a scheduled maintenance routine rather than running them ad hoc. A monthly maintenance checklist that includes updates, backup verification, and a quick security scan is worth the hour it takes. The guide on creating a website maintenance plan covers what that routine should include.
Even with careful preparation, a plugin or theme update can occasionally produce a white screen instead of a working site. If that happens, knowing how to fix the WordPress white screen of death step by step means the site is back online in minutes rather than causing an extended outage while you track down the cause.
One step that’s easy to overlook after updating: clear your site’s cache. Cached pages may reference the old stylesheet or script versions, causing layout issues on the front end. Clearing the WordPress cache explains exactly how to do this in LiteSpeed Cache, W3 Total Cache, and WP Super Cache, plus when a full purge is appropriate versus a selective clear.
Before you start customising theme files, it’s worth setting up a WordPress child theme first. A child theme inherits everything from the parent theme but keeps your custom code in a separate folder — so when you update the parent theme, your changes remain untouched.
If you’re setting this up, it’s worth also reading our guide on fix.
Conclusion
Back up first, update plugins, update themes, update core, test after each step. That’s the entire process – and following it every time turns WordPress updates from a source of anxiety into a ten-minute routine. Keeping your site updated is also one of the most effective security measures available, alongside the steps covered in the guide on how to secure a WordPress website. For a full overview of how site maintenance fits into the broader process of running a WordPress website, the complete website building guide covers each stage in sequence.
Etienne Basson works with website systems, SEO-driven site architecture, and technical implementation. He writes practical guides on building, structuring, and optimizing websites for long-term growth.