Update on a weekday morning, after a backup, on a copy first, one item at a time: WordPress itself, then the theme, then each plugin. Read the changelogs before you start.

Four o'clock on a Friday

It is Friday afternoon, the week's work is done, and the dashboard shows fourteen updates waiting. There is a box to select them all and one button to apply them.

It takes about a minute. The messages scroll past, everything reports success, and the office closes for the weekend.

On Saturday morning a customer tries to book and the form does nothing. Or the shop page shows an error. Or the home page is blank.

Nobody at the business finds out until Monday, and the person who could fix it is not working until then either.

Why the timing is the problem

Updates break things occasionally. That is not a reason to avoid them, but it is a reason to choose when they happen.

A problem found at ten on a Tuesday morning is usually fixed by lunch. Everyone who could help is at work, and whoever notices can tell somebody.

The same problem at four on a Friday has the whole weekend, and for a restaurant, a shop or anything taking bookings, the weekend is when many customers arrive.

The update is identical either way. Only the cost of being wrong changes.

What update all hides

The first is the one that turns a small problem into a long one. With fourteen changes at once, finding the culprit means undoing them one by one, on a live site, at the weekend.

A backup before every update

Most hosts take a nightly backup, and most owners assume that is enough. It is a start.

By Friday afternoon, a nightly backup may be almost a day old, and restoring it throws away every order, booking and form entry received since.

So take one immediately before updating, of both the files and the database, and know how it is restored before you need to.

A backup that has never been restored is a hope rather than a plan. Ask whoever maintains your site when they last tested one.

Staging copies

A staging copy is a duplicate of your site at a private address. Many hosts offer one as a button; where they do not, whoever maintains the site can set one up.

Updates go on the copy first. If something breaks there, nobody outside the business ever sees it.

Once the copy works, the same updates are applied to the live site.

Copying the whole staging site back over the live one is a mistake on any site taking orders or bookings, because the live site has new ones the copy lacks.

Core, then theme, then plugins

WordPress itself goes first. Themes and plugins are written and tested against its current version, so their updates are best applied on top of it.

The theme comes next, since it controls how every page looks and often depends on how WordPress behaves.

Plugins go last, one by one. Where a plugin has add-ons, such as a shop with payment and shipping extensions, read their notes together, because they often need to move as a group.

After each update, check the home page, the page it affects, and the form. Two minutes per item, and you always know which change did what.

A worked example

A bike shop in a suburb sells parts online and takes repair bookings through its WordPress site.

On a Friday last spring, the manager selected all eleven waiting updates and pressed the button just before closing. Everything reported success.

On Saturday, the booking page loaded but would not accept a time. Some customers phoned instead; others presumably went elsewhere.

On Monday, the cause took most of the morning to find, because eleven things had changed. The booking plugin's update needed a newer version of a component that another plugin was still loading in an older form.

Restoring Thursday night's backup would have fixed it, and deleted every online order placed since.

The shop now updates on Tuesday mornings, on a copy first, one item at a time. The same conflict would have appeared on the copy, where it cost nothing.

Reading the changelog

Every plugin update comes with release notes, and in WordPress they are one click away, behind the link to view the version details.

Three things are worth looking for. The word security means apply it soon.

A jump in the first number, such as from 2.9 to 3.0, usually means larger changes. Any mention of a database update or a new minimum requirement means extra care.

Reading them takes a few minutes for a typical month's updates, and tells you which ones to test hardest.

Making it somebody's job

On many small business sites, updates are pressed by whoever logs in and happens to see the notice. That is how they end up happening at four on a Friday.

It works better as somebody's job, on a schedule, with the backup and the copy already part of the routine. For most businesses that means whoever maintains the site, monthly.

Whoever it is, ask them three things: when updates happen, whether they test on a copy, and how quickly the site could be restored on a Saturday.

The counter-case

Some updates should not wait for a quiet Tuesday.

A security release for a plugin that is being actively attacked is worth applying the same day, with a backup first, even on a Friday. A known hole is a bigger risk than a hurried update.

WordPress also installs its own minor security releases automatically, which is generally sensible and does not need switching off.

And a very simple site with two or three well-maintained plugins carries less risk per update, so its routine can be lighter: a backup and a check afterwards rather than a full copy every time.

For everything else, the rule is short: never update everything at once, and never just before nobody is around.

The routine

  1. Pick a weekday morning for updates.
  2. Read the changelogs before pressing anything.
  3. Take a backup of files and database.
  4. Update the copy before the live site.
  5. Do WordPress first, then the theme, then plugins.
  6. Check the site after every single update.
  7. Apply to the live site the same way.

Step one costs nothing and changes the price of a mistake more than anything else on the list. A broken site found on a Tuesday morning is an inconvenience; found on a Saturday, it is a lost weekend.

The version of PHP underneath all of this is covered in the PHP version your site runs on.

Frequently asked questions

Why not update everything at once?

Because if something breaks, you cannot tell which change caused it. Finding the culprit then means undoing updates one by one, on a live site.

Why does the day of the week matter?

A problem found on a weekday morning is usually fixed the same day. On a Friday afternoon it has the whole weekend, when many businesses are busiest.

Is the host's nightly backup enough?

Not on its own. It may be nearly a day old, and restoring it discards every order and form entry since. Take one immediately before updating.

What order should updates go in?

WordPress itself first, then the theme, then each plugin one at a time, checking the site after each so you always know which change did what.

What is a staging copy?

A duplicate of your site at a private address. Updates go on it first, so anything that breaks is found where no customer can see it.

Should security updates ever be rushed?

A security release for a plugin under active attack is worth applying the same day, with a backup first. A known hole is the greater risk.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Fourteen updates waiting on your dashboard?

Leave the button alone for now. We will apply them on a copy first, one at a time, on a weekday morning.

Start a Conversation