Installing WordPress updates the right way: order, auto-updates and what to do when something breaks

The safest order for WordPress updates is: first a backup that you can actually restore, then the plugins, the important ones one at a time, then the theme and finally WordPress itself. Minor WordPress versions such as 7.1.4 don't need this routine, because WordPress installs them on existing sites by itself in the background. Care is needed with major versions such as 7.1 and with every plugin that enquiries or revenue depend on: WooCommerce, page builders, caching, forms and payment methods.

How quickly an update can take a site down, I saw in August. From 19 August 2026, the day WordPress 7.1 came out, I received a striking number of emergency calls with the same picture: a white screen or "There has been a critical error on this website", and no access to the admin area. The cause was an incompatibility with the caching plugin WP Rocket; the fix is in the article Fixing the fatal error after WordPress 7.1. Anyone who knew where to start was back online within a few minutes.

The order that has proven itself

1. Make a backup. It has to contain the database and the wp-content folder with uploads, plugins and theme. If the backup only sits on the same server as the website, it is no help when that very server is the problem.
2. Update the plugins. Small plugins can go together, the big ones one at a time: WooCommerce, Elementor or another page builder, the caching plugin, form and payment plugins. After each of them, open the website's front end briefly.
3. Update the theme. If you or a previous developer made changes directly in the theme instead of in a child theme, they are gone afterwards, because the update replaces the theme files.
4. Update WordPress under Dashboard → Updates.
5. Check. Home page, one subpage, send a test form, run an order through to checkout in a shop, log out of the admin area and back in. Then clear the cache.

Why plugins before WordPress? In my experience, vendors ship their adjustments for a new WordPress version within the first few days after the release. If you install the plugin updates first, the new WordPress version meets matching code. Whether a plugin is ready shows on its page in the wordpress.org plugin directory: the "Tested up to" field names the WordPress version the developer last checked it against. According to the WordPress plugin handbook, the field ignores minor versions entirely, because a plugin should not break with them. If it still says 7.0 while you want to move to 7.1, you are better off waiting for the next plugin update.

Minor and major versions: where the risk is

WordPress has two kinds of versions. Minor versions, such as the step from 7.1.3 to 7.1.4, bring bug fixes and security fixes. Major versions such as 7.0 or 7.1 bring new features and change code that plugins and themes build on. That is where outages happen. In 2026 there have been two major versions so far, 7.0 in May and 7.1 in August, and WordPress 7.2 has been in testing since October (release overview on wordpress.org). What 7.0 changed in detail is in the article WordPress 7.0: what's new.

According to the official upgrade guide, existing installations receive minor versions automatically. Sites set up fresh on WordPress 5.6 or later also receive major versions automatically by default, unless someone has switched that off.

Install security updates immediately, minor or major. A good example is WordPress 7.1.4 from 28 October 2026: among other things it closes a weakness in the update process itself that allowed code execution, plus several bugs that let attackers inject malicious code into content. WordPress recommends updating immediately and has backported the fixes to all older major versions back to 4.7. So even a site on an old version gets the protection, as long as minor updates are not switched off. Wordfence reported the first exploitation attempts against the weakness in the update process on 29 October; I keep the current state in the article on the PHP2Shell vulnerability.

Major versions without a security reason I do not install on day one on sites that bring in enquiries or orders. Waiting a few days costs nothing, and in my experience plugin vendors ship their fixes during that time. With WP Rocket, the vendor confirmed the bug on the day 7.1 came out and fixed it with version 3.23.2.2.

Automatic updates: what I switch on and what I don't

Since WordPress 6.6 from July 2024, WordPress rolls back an automatic plugin update by itself if it causes a fatal error (WordPress 6.6 announcement). That is a good safety net, but it only catches errors that crash the site. A contact form that silently stops sending mail after an update, or a checkout that hangs on one payment method, goes unnoticed. So I decide by type of update:

Update	My recommendation
Minor WordPress versions (e.g. 7.1.4)	Leave them automatic, that is WordPress's default.
Major WordPress versions (e.g. 7.1)	By hand, after checking "Tested up to" and with a fresh backup; for shops on a staging copy first.
Small plugins that don't touch forms or checkout	Automatic, with the rollback as a safety net.
WooCommerce, page builders, caching, form and payment plugins	By hand and one at a time, followed by a test form or test order.
Theme with changes made directly in the theme	Not automatic. Move the changes into a child theme first.

You switch this on per plugin under Plugins → Installed Plugins, column "Automatic Updates". For themes it is under Appearance → Themes, in the theme details. If you use automatic updates, read the emails WordPress sends to the admin address afterwards, and have the website watched by a service that raises the alarm when it is no longer reachable.

When nothing works after the update

"There has been a critical error on this website"

Since WordPress 5.2, WordPress sends an email to the admin address when this happens, subject "Your Site is Experiencing a Technical Issue". It contains a secret link to recovery mode. Through it you get into the admin area, the faulty plugin or theme is paused for you only, and you can deactivate it or update it to a fixed version (description by the WordPress core team). The email only arrives if the address under Settings → General → Administration Email Address is still correct. That takes a minute to check.

No email and no access to the admin area

Then FTP access or your host's file manager helps. In the wp-content/plugins folder, rename the folder of the suspect plugin, for example wp-rocket to wp-rocket-off. WordPress no longer finds the plugin and deactivates it. If you don't know which plugin it was, rename the whole plugins folder, as the WordPress guide to common errors also says. Then reactivate them one by one until the error comes back.

The site is stuck on the maintenance message

During an update, WordPress creates the file .maintenance in the root directory and shows visitors a short maintenance notice. If the update is interrupted, the file stays and so does the notice. Delete .maintenance via FTP and the site is back. Then check under Dashboard → Updates whether the update ran through completely.

Undoing an update

The cleanest way is the backup from before the update. For a single plugin there is a smaller option: wordpress.org lets you download earlier versions of a plugin and install them over the current one. That is an emergency measure for a few days until the vendor ships a fixed version, not a permanent solution, because often the new update is the one that closes a security hole.

The backup that has never been restored

Every guide says: make a backup first. Hardly any says you should restore it once before you need it. A backup plugin that has reported for months that everything is saved can still be writing an empty database file or an incomplete uploads folder. You only notice when you restore it. So restore a backup to a staging copy or a local installation once and click through it. Afterwards you know that it works and how long it takes.

For my support clients, daily backups go to an independent server, separate from the website's web space, and every update runs on a staging copy first. If the site still goes down, a monitoring check that runs every ten minutes reports it.

PHP is part of it

WordPress runs on PHP, and PHP needs updates too. According to php.net, PHP 8.2 only receives security fixes until 31 December 2026, PHP 8.3 until the end of 2027. WordPress shows which version your site uses under Tools → Site Health → Info. The switch is usually made in your host's customer panel. Do it after WordPress and all plugins are current, and test afterwards as after any other update. If something breaks, the version can usually be switched back at the host. How urgent PHP updates are right now is shown by the PHP2Shell vulnerability from October.

Handing updates over

For a small website with few plugins, the routine above is enough if you do it regularly. For a shop or a site that brings in enquiries every week, an unnoticed error quickly costs more than maintenance. With my WordPress support I take over the updates with staging tests, backups and monitoring, and get in touch before a plugin causes problems. Billing is by actual effort; what that costs compared with monthly packages is in the article What does WordPress maintenance cost? Write to me via the contact form or call +49 89 3288 6771.

Frequently asked questions

How often should you update WordPress?

Security updates on the same day; for minor WordPress versions, automatic updates take care of that by themselves. Plugins and theme at least once a month, for shops better a weekly look at Dashboard → Updates. Major WordPress versions after a few days, once the important plugins have caught up.

In which order do I update plugins, theme and WordPress?

Backup, then plugins, then theme, then WordPress, then test. For minor WordPress versions the order hardly matters, because WordPress installs them automatically anyway. It matters for major versions.

Should I switch on automatic updates?

For minor WordPress versions and uncritical plugins, yes. Since WordPress 6.6, WordPress rolls back an automatic plugin update if it crashes the site. For WooCommerce, page builders, caching, forms and payment methods, no: install those by hand and test afterwards.

Can I undo a WordPress update?

Yes, most cleanly with the backup from before the update. A single plugin can also be overwritten with an earlier version from wordpress.org, but that is only a stopgap until the vendor fixes the bug.

When is the next WordPress update?

Minor versions come out as soon as bugs or security holes are fixed, most recently WordPress 7.1.4 on 28 October 2026. The next major version, WordPress 7.2, has been in testing since October 2026.