A safe routine for WordPress, plugin and theme updates
PrintMost hacked WordPress sites were broken into through a plugin or theme whose security hole had already been fixed in a newer version. Under the TopHost Terms, choosing and updating plugins, themes and WordPress itself is the site owner's job. With a simple routine it takes a few minutes and rarely breaks anything.
Before you update
- Take a fresh backup. The hosting keeps daily JetBackup copies, but one made right before the update returns you to exactly where you were. Create it in WP Toolkit or cPanel.
- Pick a quiet time with few visitors and enough time to check the result. Avoid the hours before a weekend or a campaign.
- Skim the changelog for major releases of key plugins such as page builders, store and form plugins.
- Protect theme edits. If you changed theme files directly, move those changes to a child theme first, or the update will overwrite them.
Update from cPanel
cPanel lists every WordPress site on your account together with its pending updates, with no need to log in to each dashboard.
Using WP Toolkit
- Open WP Toolkit in cPanel (searching for "WordPress Management" also finds it).
- Click Updates next to the site.
- Tick the plugins, themes or WordPress core you want and click Update.
For important sites, WP Toolkit can clone the site so you can try the update on the copy first. See Complete guide to WP Toolkit in cPanel.
Using WordPress Manager by Softaculous
- Under Software, open WordPress Manager by Softaculous.
- Select the site.
- Update plugins, themes or WordPress from there.
Updating inside WordPress, under Dashboard, then Updates, works just as well; it is only slower when you look after several sites.
Work in this order
- Plugins, individually or a few at a time, checking the site after each batch.
- The theme, plus the parent theme if you use a child theme.
- WordPress core, now that the plugins are ready for it.
- Clear the cache, for example in LiteSpeed Cache, so visitors get the new version.
Update paired plugins together: Elementor with Elementor Pro, WooCommerce with its extensions. A new version next to an old companion can take the whole site down.
Quick checks afterwards
- The home page and two or three inner pages, on desktop and on a phone.
- Signing in to
wp-admin. - The contact form: send a test message and make sure it arrives.
- For stores: add something to the cart and place a test order.
When something breaks
- The dashboard still opens: deactivate the plugin you updated last and look for a fix from its author.
- The dashboard is gone: rename that plugin's folder in
wp-content/pluginsusing File Manager. The steps are in Common WordPress problems and how to fix them. - Cause still unknown: roll back to the backup you took beforehand, in WP Toolkit or with JetBackup 5.
Questions people ask
Why is my site missing from WP Toolkit?
Sites installed by hand have to be picked up with the Scan button, as shown in How to install WordPress on cPanel.
Should I turn on automatic updates?
They are a good choice for minor and security releases, and you can enable them in WP Toolkit or WordPress. On stores and complex sites, update key plugins by hand so you can check the result straight away.
How often should I check?
Once a week is a good rhythm. Apply security updates as soon as they appear.
A plugin stopped receiving updates
For a paid plugin, check the licence first. If the author has abandoned it, switch to an alternative and delete the old one; a deactivated plugin still sits on the server with its vulnerabilities.
Should I change the PHP version too?
Only after the site is up to date, compatibility is checked and a backup exists. See PHP version selection.
