Out-of-date WordPress installations are the leading cause of hacked sites on shared hosting. Updates should be applied promptly, but in a controlled order.
Before updating
- Take a full backup (see our backup article) or generate a cPanel backup you can download.
- Note your current PHP version — some older themes break on newer PHP.
- If the site is business critical, test on a staging copy first.
Recommended order
- Plugins — go to Dashboard → Updates, update a few at a time and reload the front end after each batch so you can identify a culprit quickly.
- Themes — update your active theme last among themes, and check the homepage and an inner page afterwards.
- WordPress core — click Update Now on the Updates screen.
Enabling automatic updates
WordPress applies minor security releases automatically by default. You can enable per-plugin auto-updates from the Plugins screen using the Enable auto-updates link in the right-hand column.
Note: automatic updates depend on WP-Cron running. On our servers HTTP wp-cron is disabled, so you must configure a real cron job or updates will silently never run. See the article "Why wp-cron.php Is Blocked and How to Set Up a Real Cron Job".
If an update breaks the site
Restore your backup, or rename the offending plugin or theme folder in File Manager to disable it, then report the issue to the plugin developer.
