Most broken WordPress sites we see were working perfectly until an update ran. The updates are still necessary – out-of-date plugins are the single most common way a site is compromised – but there is a right way to do them.
Before
- Take a backup of files and database, and download it.
- Update one thing at a time when you can. Updating twenty plugins at once and then finding the site broken tells you nothing about which one did it.
- Do it when you can watch. Not last thing on a Friday.
Order matters
Update WordPress core first, then plugins, then the theme. Plugins are usually written against the current core, so doing it the other way round can produce failures that resolve themselves once core catches up.
Automatic updates
WordPress applies security releases to core automatically, which is good and should be left alone. Automatic updates for plugins are a judgement call: they keep you patched without effort, but they also mean an update can break the site at three in the morning with nobody watching. For a site that takes money, we would suggest automatic updates for security releases only, and doing feature updates by hand.
After
Load the front page and a couple of inner pages, log in to the admin, and check anything the site depends on – a contact form, a booking, a checkout. Then look at the error log for anything new.
If it breaks
Restore the backup rather than trying to repair a live site under pressure. Then reproduce the update somewhere safe to find out what happened. See Staging a WordPress site.
