How to Update WordPress Plugins Safely, One at a Time
The safest way to update WordPress plugins is one at a time, with a look at the site after each one. The order which I follow on the eleven sites I update every month, and the updates which I hold back for a decision.
Mike Lopez
Designs and builds websites and B2B software
On this page
I think the way to update WordPress plugins safely is one plugin at a time, with a look at the website after each one, and with the few updates which need a decision set aside before you start, rather than clicked through with the rest. I update eleven WordPress sites once a month, and the first of those rounds, on the 6th of October, meant 37 plugin and theme updates across nine of them in one day, where one plugin stopped with a critical error on three sites, one needed a newer version of PHP and one needed a licence which had run out, and each of those was easy to deal with because it was the only change happening on its site at that moment.
The routine updates need no developer, so this post goes through the order which I follow and then the updates which I hold back for a decision.
Read the list before you click anything
WordPress lists every waiting update on the Updates screen under Dashboard, and I read that list in full before I touch anything, writing down the current and the new version of each item. Most rows are small steps for plugins which I know well, such as Yoast SEO, which goes on every WordPress site that I build, but a few rows mostly need a decision first, and I would sort them out at this point, because once you have pressed Update on twenty things at once it is hard to tell which one changed what.
Know where your backup is
Before the first update I check that there is a recent backup and that I know how to restore it, which is what WordPress’s own guide to managing plugins asks for, and its guide to backups adds that a full restore needs the database and the files together. Most of the sites which I update sit on a host which takes a daily backup, but one of them runs on a host with no backup that I know of, so on that site I am more careful about which updates I run at all.
Update one plugin at a time
The Updates screen lets you tick every plugin and update them together, which is quicker, but if the website breaks halfway through a batch of fifteen you are left guessing which one did it. I update one item at a time on each site, and after each one I open the home page and the page that matters most, such as the contact form or the shop, while I am logged in, because a host or a caching plugin mostly serves visitors a saved copy of each page, and a logged-in visit usually skips that copy and shows the site as it is now.
When an update says critical error
In October one plugin, Yoast SEO, stopped with a critical error on three of the nine sites, and the message looks alarming, but each time the site was still up and WordPress had kept the old version of the plugin in place, which it has done since version 6.3 whenever a manual update fails to install, as the core team’s note on rollbacks explains. So the first thing I would do is open the site in a new tab and see whether it works, and then run the same update again from the Updates screen, which installed Yoast cleanly on all three sites.
If a plugin does take the site down, WordPress emails the site’s administration address a recovery mode link, which opens the dashboard with the faulty plugin paused for you, as the core team’s note on recovery mode describes, so it’s really worth making sure that the administration email address under Settings, General is one which somebody reads.
The updates which need a decision
A new major version
A plugin which jumps a whole number, such as the PDF plugin on one of my sites going from version 5 to version 6, mostly changes more than a small step does, so I held that one back until I had read its changelog, which the View version details link beside the update opens on its Changelog tab. I would run a major version when you can test it on a copy of the site first, or at least at a quiet time of the week.
A plugin which needs a newer PHP
PHP is the language which WordPress runs on, and a plugin can state the lowest version that it needs through its Requires PHP header. One of the sites still runs PHP 7.4, so when a plugin there needed a newer version, the Updates screen said “This update does not work with your version of PHP” and left that plugin without a checkbox. WordPress recommends PHP 8.3 or greater on its requirements page, so the real fix is a PHP upgrade from the host, which I would try on a copy of the site first, because an old theme or plugin can break on a newer PHP as well.
A premium plugin whose licence has run out
Plugins which you pay for mostly update through their makers’ own servers, and the download only works while the licence is active, so a premium mega menu plugin on one site answered “Download failed. Unauthorized” because its licence key was missing or expired. On a site which I worked on in September, the security fixes for two premium plugins could not be installed at all, because the membership behind them had expired more than two months earlier, which is why I think a licence renewal belongs in the same calendar as the updates, as I wrote in my post on the questions to ask a web designer.
WordPress itself
I treat WordPress core updates as a separate decision, so in October six of the sites moved from 7.1.1 to 7.1.2 as their own step, after the plugins and with a backup offered by the host before each one.
| What you see | What I do | From the October round |
|---|---|---|
| A small step for a plugin you know | Update it on its own, then check the site | Most of the 37 updates |
| A critical error during the update | Check the site, then run the update again from the Updates screen | Yoast SEO on three sites |
| A jump to a new major version | Read the changelog first, and update when you can test | A PDF plugin from 5 to 6, held |
| An update without a checkbox | Check the plugin’s PHP requirement, and ask the host about PHP | A plugin on a site with PHP 7.4 |
| “Download failed. Unauthorized” | Renew the licence or add the key | A premium mega menu plugin |
| A new version of WordPress | Run it on its own, after the plugins and with a backup | Six sites from 7.1.1 to 7.1.2 |
Where to start
I would open the Updates screen on your own site today and write down each item with its current and new version, mark the major versions, the premium plugins and any row without a checkbox, and then update one of the small ones and open your home page and your contact page before you move on to the next. If the administration email address in Settings is an old one, change it first, and if you share your posts on LinkedIn, it’s worth checking the LinkedIn preview image after a round which updated Yoast.
Frequently asked questions
How often should I update WordPress plugins?
Once a month for routine updates, I think, since a month mostly brings a handful of updates on each site, while a site left for half a year comes back with dozens and a much harder job of finding which one broke something, and on the same day for a fix to a security problem.
Should I turn on automatic updates for plugins?
WordPress can update each plugin on its own through Enable auto-updates on the Plugins screen, and its guide to automatic updates advises making sure that you can roll the site back before you turn them on, so I would keep them for a few small plugins from careful makers and leave forms, page builders and shop plugins for the monthly round.
What should I do if a plugin update breaks my site?
Open the recovery mode link which WordPress emails to the administration address, which pauses the faulty plugin so you can deactivate it from the dashboard, and if the site is still broken after that, restore your backup and wait for a fixed version of the plugin.
Why can’t I update a WordPress plugin?
Mostly because the plugin needs a newer version of PHP than your server runs, because it is a premium plugin whose licence has run out, or because the download failed for a moment and works on a second try, and the message beside the plugin usually says which one.
