mitza.es

Guides

How to update WordPress without breaking your site: a step-by-step guide for core, plugins and theme

What to check beforehand, in what order to update, how to do it from the dashboard or with WP-CLI, how to verify that everything works and what to do if something breaks. So you stop putting off what protects your site the most.

Published on November 10, 2026 · The mitza.es team

Many WordPress sites go without updates for an understandable reason: the fear that, once you update, something will stop working. The trouble is that this fear is expensive. The serious alerts of recent weeks, such as the one about WordPress core 7.1.4, are fixed with updates. This guide gives you a method to do it calmly and with a safety net.

What gets updated on a WordPress site

  • WordPress core: minor and security releases (for example, 7.1.3 to 7.1.4) are small and urgent; major releases bring bigger changes and call for more testing.
  • Plugins: the most frequent cause of security flaws and also of incompatibilities.
  • The theme (and the child theme, if there is one).
  • PHP and the server: they are updated at the hosting provider, not from WordPress. If your PHP version is old, some updates will stop being offered. You can see an example of why it matters in the PHP2Shell alert.

Before updating: a five-minute checklist

  1. Make a full backup (files and database) and check that it exists and that you know where it is. A backup you have never tried to restore is a hope, not a backup. More in the 3-2-1 rule.
  2. Note down the current versions of core, plugins and theme, in case you need to go back.
  3. Read the release notes of critical plugins (online store, forms, page builders) to see whether they warn about major changes.
  4. Pick the moment. Preferably when traffic is low and not right before a campaign. If you sell online, avoid updating during Black Friday week: do it beforehand and leave some margin to spot problems.
  5. If the site is critical, use a testing environment (staging): a copy of the site where you can test without risk. Many hosting providers include one.

Step by step from the dashboard

  1. Go to Dashboard → Updates. You will see whether there is a new core version, plus the lists of pending plugins and themes.
  2. If the core update is a security one, start with it. Then update the plugins and the theme.
  3. Update plugins one at a time or in small groups, not all at once. If something fails, you will know which one it was.
  4. Check the site after each important step: home page, an inner page, the contact form and, if there is a store, adding a product to the cart.
  5. If the dashboard asks you to update the database after a major update, accept and wait for it to finish without closing the tab.

With WP-CLI (for those with terminal access)

If your hosting allows WP-CLI, these commands do the same job and can be used to check it:

  • wp core version shows the installed version.
  • wp core update updates core.
  • wp plugin update --all and wp theme update --all update plugins and themes.
  • wp core verify-checksums compares the core files against the originals, a useful check after a security alert.

Afterwards: what to verify

  • The site loads properly on desktop and mobile, and there are no visible error messages.
  • Forms submit and the emails arrive (do a real test).
  • If there is a store: cart, payment gateway and order confirmation.
  • You can log in to the dashboard and edit a page.
  • Clear the plugin cache and, if you use a CDN, the CDN cache as well.
  • Check that there are no new administrator users you don't recognise.

If something breaks

  1. White screen or critical error: WordPress may send an email to the administrator with a “recovery mode” link so you can log in and deactivate the plugin or theme that is failing.
  2. If you can't log in to the dashboard: connect via SFTP or your hosting's file manager and rename the folder of the suspect plugin inside wp-content/plugins. WordPress will deactivate it.
  3. If the problem is the theme: renaming the active theme's folder makes WordPress fall back to a default one and lets you log in.
  4. If you can't find the cause: restore the backup you made beforehand and repeat the update step by step, testing each plugin.
  5. If the site seems compromised and not just broken (redirects, odd pages, new users), follow the guide on what to do if your WordPress site is hacked.

Automatic updates: when to turn them on

  • Core: minor and security releases update themselves by default on most installations. Check anyway that they were applied, as we explain in the alert about 7.1.4.
  • Plugins and themes: automatic updating has been optional since WordPress 5.5. It is reasonable to turn it on for simple, very widely used plugins; for critical plugins (store, page builders, memberships) it is preferable to test on staging first. Since WordPress 6.6, if an automatic plugin update causes a fatal error, the system tries to roll it back.
  • Whatever you decide, check the site once a week and set up alerts in case it goes down.

How often to update and what to avoid

  • Weekly review of pending updates; critical security ones within 48 hours.
  • Delete plugins and themes you don't use: deactivating them isn't enough. Replace abandoned ones with maintained alternatives.
  • Distrust “nulled” plugins and themes (pirated copies of paid ones): they carry backdoors.
  • If you haven't updated for a long time, don't jump all at once: do the update on staging and in steps, because the accumulated changes can be large.

To find out what deadlines are reasonable depending on severity, see our guide to reading a security advisory.

Frequently asked questions

Can I update without making a backup if it's “just one plugin”?

We don't recommend it. A small plugin can break the whole site, and the backup takes minutes. It is the measure that gives you the most peace of mind.

What happens if I don't update?

Every pending version is a known, public vulnerability that anyone can try against your site. In addition, your hosting provider may stop supporting old PHP versions, and new plugins will require recent versions.

Is it better to delegate maintenance?

If the site is part of your business and you have neither the time nor the desire, yes. You will find the breakdown of what a maintenance service should include in website maintenance: what it includes and how much it costs.

How we can help at Mitza

Our website maintenance service includes backups, updates with prior testing and a security review. If you would like to start by finding out what state your installation is in, there is the website security audit, or you can write to us from the contact page.

Related reading: WordPress 7.1.2 and CVE-2026-87902 and wp2shell.

Related articles

Would you rather have someone update your WordPress and take responsibility for it?

We update core, plugins and theme with a prior backup, testing and a heads-up if anything fails, as part of a website maintenance service.

No spam. No sales calls. Just your personalised reply.