Updates are the most important and at the same time the most frequently neglected maintenance task on WordPress. This guide answers how often you should update the WordPress core, plugins and themes, how to do so safely, and when automatic updates make sense.<\/p>\n\n
In short:<\/strong> Security updates for WordPress, plugins and themes should be applied within 24 to 48 hours. You should check and install all other updates at least once a week. Test major version jumps of the WordPress core on a staging environment beforehand. Every update requires a current backup beforehand and a brief functionality check afterwards.<\/p>\n\n Regular updates close known security vulnerabilities before attackers can exploit them. As soon as a vulnerability is published, automated bots specifically search for websites running the affected version. Outdated plugins are therefore the most common cause of hacked WordPress websites. In addition, updates bring bug fixes, compatibility with new PHP versions and often better loading times.<\/p>\n\n Our article Why 80% of all WordPress hacks come through outdated plugins<\/a> shows how much the risk grows over time. You can read about which vulnerabilities are typically exploited in The most common security vulnerabilities in WordPress plugins<\/a>.<\/p>\n\n Update frequency depends on the type of update, not on a rigid calendar. Security updates take priority and should be installed as quickly as possible. Feature and maintenance updates can be collected and applied in a fixed weekly rhythm. The following table summarises the recommendations.<\/p>\n\n A safe update always follows the same process: back up, check, update, verify. This ensures that a faulty update does not affect your website for longer than a few minutes. These steps have proven themselves in practice:<\/p>\n\n Automatic updates are a good choice for simple websites with a few well-maintained plugins \u2013 provided the website is monitored and backed up daily. For online shops, booking systems and heavily customised websites, we recommend controlled updates, because an unnoticed error there directly costs revenue.<\/p>\n\n WooCommerce, page builders such as Elementor and large form plugins deserve particular caution when updating. They intervene deeply in the website, often come with database updates and depend on numerous extensions. An update that runs without problems on a simple website can disrupt the cart, payment methods or email notifications in a shop.<\/p>\n\n The quickest overview is provided by the WordPress dashboard under \u201cUpdates\u201d. For security updates, however, that alone is not enough, because it does not show whether an update closes a known vulnerability. Security plugins and vulnerability scanners compare the installed versions against public databases and notify you as soon as an installed plugin is affected. Anyone looking after several websites usually uses a central management tool for this, which brings the updates, backups and uptime of all installations together in one place.<\/p>\n\n A WordPress website that is not updated becomes more vulnerable and less stable with every month. New security vulnerabilities stay open, plugins lose compatibility with each other and with newer PHP versions, and at some point an update is only possible with great effort. The longer ago the last update, the higher the risk that something breaks when many updates are applied at once to catch up.<\/p>\n\n Minor security and maintenance releases of the WordPress core are installed automatically by default. Major versions, plugins and themes only update automatically if you enable this individually for each extension.<\/p><\/details>\n\n What has proven itself: plugins first, then themes, and the WordPress core last \u2013 each time after a backup. For major core updates, first check whether all important plugins already support the new version.<\/p><\/details>\n\n Restore the backup from directly before the update, or roll the plugin that caused the problem back to its previous version. For a critical error, our WordPress emergency service<\/a> can help.<\/p><\/details>\n\n For a typical business website with 15 to 25 plugins, you should allow one to three hours per month, including backup, testing and documentation. For shops and websites with many custom modifications, it is more.<\/p><\/details>\n\nWhy are regular WordPress updates so important?<\/h2>\n\n
How often should the core, plugins and themes be updated?<\/h2>\n\n
Update type<\/th> Example<\/th> Recommended timeframe<\/th> Test beforehand?<\/th><\/tr><\/thead> Security update (core)<\/td> WordPress 6.x.1 to 6.x.2<\/td> immediately, usually runs automatically<\/td> no, functionality check afterwards<\/td><\/tr> Security update (plugin\/theme)<\/td> Plugin closes a reported vulnerability<\/td> within 24 to 48 hours<\/td> briefly, on staging for shops<\/td><\/tr> Maintenance update (plugin\/theme)<\/td> Bug fixes, minor improvements<\/td> weekly<\/td> yes for critical plugins<\/td><\/tr> Major version (core)<\/td> WordPress 6.x to 7.0<\/td> after 1 to 2 weeks, once plugins are compatible<\/td> yes, on staging<\/td><\/tr> Major plugin update<\/td> Page builder, WooCommerce, forms<\/td> after reviewing the changelog<\/td> yes, on staging<\/td><\/tr> PHP version<\/td> PHP 8.x to a newer version<\/td> before security support ends<\/td> yes, on staging<\/td><\/tr><\/tbody><\/table><\/figure>\n\n What does a safe WordPress update look like?<\/h2>\n\n
Should you enable automatic updates?<\/h2>\n\n
<\/th> Automatic updates<\/th> Controlled updates<\/th><\/tr><\/thead> Response time to vulnerabilities<\/td> very fast<\/td> fast, depending on the rhythm<\/td><\/tr> Risk of unnoticed errors<\/td> higher<\/td> low<\/td><\/tr> Effort<\/td> low<\/td> medium<\/td><\/tr> Suitable for<\/td> simple business websites<\/td> shops, bookings, custom websites<\/td><\/tr> Prerequisite<\/td> monitoring and daily backups<\/td> staging environment and clear responsibility<\/td><\/tr><\/tbody><\/table><\/figure>\n\n What should you watch out for with WooCommerce and page builders?<\/h2>\n\n
How do you keep track of pending updates?<\/h2>\n\n
What happens if you do not update WordPress?<\/h2>\n\n
Checklist for your update routine<\/h2>\n\n
Frequently asked questions about WordPress updates<\/h2>\n\n
Does WordPress update itself?<\/summary>
In what order should I update?<\/summary>
What should I do if the website stops working after an update?<\/summary>
How much time do updates take per month?<\/summary>