WordPress Core and Plugins Update

WordPress Core and Plugins Update

Outdated WordPress core and plugins — main reason for hacks. Most attacks exploit known vulnerabilities in outdated versions that have patches published. Updating is not optional.

Update Procedure

Never update in production without preparation. Correct order:

1. Create full backup (files + database)
2. Update on staging server or dev environment
3. Test key features
4. Update in production
5. Verify again

Backup Before Update

# Files
tar czf backup-$(date +%Y%m%d).tar.gz /var/www/yourdomain.com

# Database
mysqldump -u root wordpress > backup-$(date +%Y%m%d).sql

# Or via WP-CLI
wp db export backup-$(date +%Y%m%d).sql --add-drop-table

Update via WP-CLI

# Update core
wp core update

# Update all plugins
wp plugin update --all

# Update all themes
wp theme update --all

# Update translations
wp language core update
wp language plugin --all update

# Check status
wp core version
wp plugin list --update=available

Update single plugin:

wp plugin update woocommerce

Automatic Minor Updates

// wp-config.php — enable auto-update for minor core versions (5.x.y)
define('WP_AUTO_UPDATE_CORE', 'minor');

// Auto-update all plugins (carefully — might break site)
add_filter('auto_update_plugin', '__return_true');

// Auto-update specific plugin
add_filter('auto_update_plugin', function (bool $update, object $item): bool {
    return $item->slug === 'wordfence' ? true : $update;
}, 10, 2);

Plugin Compatibility Check

Before updating plugin — check its changelog: no breaking changes. For commercial plugins (ACF Pro, WooCommerce extensions) — check release notes.

# Via WP-CLI check which plugins have updates with changelog
wp plugin update --all --dry-run

Updating Major WordPress Versions

When upgrading 6.x → 7.x need extra caution:

# Check plugin compatibility
wp plugin list --format=table

# Update on test copy first
wp core update --version=7.0 --force

If Site Breaks After Update

# Rollback last plugin update
wp plugin install woocommerce --version=8.5.0 --force

# Rollback core
wp core download --version=6.6.0 --force
wp core update-db

# Restore from DB backup
wp db import backup-20240301.sql

Monitoring Updates Setup

Wordfence and ManageWP automatically notify about available updates. For batch management across multiple sites — MainWP or ManageWP allow centralized updates.

Timeframes

Planned WordPress site update with backup and testing — 1–2 hours. For sites with custom plugins/themes requiring compatibility check — 3–4 hours.