How often should WordPress be updated?

Install WordPress security releases as soon as they are available. Update plugins and themes weekly if you can, and at least once a month. Apply major WordPress versions within a few weeks of release, once they have been tested on a copy of the site. Review the PHP version once a year. The rest of this article explains the reasoning and the exceptions.

The short version

• Security and minor WordPress releases: immediately. These normally install themselves.
• Plugin and theme security fixes: within a day or two of release.
• Routine plugin and theme updates: weekly, or monthly at the least.
• Major WordPress releases: within a few weeks, after testing.
• PHP: review yearly and move before the version you are on loses security support.

What WordPress updates by itself

WordPress has applied minor and security releases automatically in the background since version 3.7, and according to the WordPress documentation most sites are able to receive them this way. A minor release is the kind that moves the last number, for example from 7.0 to 7.0.1.

Major releases are different. They add features and change more code, so WordPress waits for someone to click Update Now.

Plugins and themes have had an auto-update option since WordPress 5.5. It is opt-in: an administrator switches it on plugin by plugin. When it is on, WordPress runs auto-updates twice a day by default. It depends on WordPress's built-in scheduler, which does not run reliably on every server, so the Site Health screen is worth checking for scheduler errors.

Why not leave everything on automatic

Automatic updates fix the problem of updates never happening. They do not fix the problem of an update breaking something.

No one tests the site after an automatic update. If a plugin update at two in the morning stops the enquiry form sending email, the site still looks fine and the fault can go unnoticed for weeks. WordPress's own documentation recommends having automatic backups in place before switching plugin and theme auto-updates on, so there is something to roll back to.

A sensible split for most business sites:

• Leave automatic minor and security updates for WordPress core switched on.
• Switch on auto-updates for small, simple plugins that have a good record.
• Update the plugins the business depends on by hand, with a backup first and a test afterwards. That means the page builder, forms, booking, payments and anything that connects to another system.

Why weekly or monthly, and not less often

Two things happen when updates are left for months.

First, known security holes stay open. WordPress.org states that only the latest version of WordPress is officially supported. Fixes are sometimes carried back to older versions as a courtesy, but that is not something to rely on.

Second, the updates pile up. Twenty plugins updated in one sitting after six months is far riskier than the same updates applied a few at a time. When something breaks, there are twenty suspects instead of two, and several plugins may have made large version jumps at once.

Monthly is a workable floor for a low-risk brochure site. WooCommerce's own documentation suggests a roughly monthly rhythm for a store's WordPress, WooCommerce, extension and theme updates, and sooner for security fixes. Weekly suits sites with many plugins or anything that takes payments or bookings.

When to update immediately

Do not wait for the next scheduled session when:

• A plugin or theme you use releases a security fix.
• WordPress publishes a security release and your site has not installed it automatically.
• An update fixes a fault that is affecting your site now.

When to wait a little

A short delay is reasonable for:

• Major WordPress releases. Give your theme and key plugins time to confirm compatibility, and test on staging first.
• Major plugin releases. A jump from version 3 to version 4 of a page builder or shop plugin often changes how things work. Read the release notes and test it.
• Busy periods. Avoid large updates on the day of a campaign launch or in peak booking season. Security fixes are the exception.

Waiting means days or a few weeks, with a date set. It does not mean leaving it until something goes wrong.

How to update without breaking the site

1. Confirm there is a backup from today.
2. Apply updates on a staging site first if you have one.
3. Update in small groups so a fault can be traced.
4. Test forms, bookings, checkout and the main pages afterwards.
5. Keep a note of what changed and when.

The full routine is in the monthly WordPress maintenance checklist.

PHP is on its own timetable

PHP is the language WordPress runs on. It is updated on the server, not in the dashboard, and each version has a published end date. Check it once a year. The process is covered in upgrading PHP on WordPress safely.

If nobody has time for this

Updates are simple until one goes wrong, and that is the part a care plan exists for. Stryx handles updates as part of its WordPress maintenance service. Get in touch to discuss your site.