If you run a WordPress site, plugin updates are part of the job. Skip them, and you leave the door open to security holes, broken features and a site that slowly stops working. Run them carelessly, and you can take a working site offline in seconds.
To update your plugins in WordPress, back up first. Update on staging if you have it. Update one plugin at a time. Then, test the site afterwards
Why Do Plugin Updates Matter?
Plugin updates are new versions of the software that adds features to your WordPress site. They are released by the plugin developer to fix bugs, patch security flaws and add new functionality.
Three things make them worth the effort. Security comes first. According to the Wordfence 2024 Annual WordPress Security Report, vulnerabilities disclosed in 2024 rose 68% on the previous year, and roughly 35% of them remain unpatched. Patchstack’s 2025 report backs this up with its own coordinated disclosure data. A known vulnerability in a popular plugin can be exploited within hours of being published, and outdated plugins are the most common entry point.
Compatibility comes second. WordPress core, PHP and your other plugins all move forward. A plugin that stays still eventually breaks. You will see broken layouts, broken forms, broken checkout flows and white screens. Most of these problems trace back to plugins that have not been updated in a year or more.
Features and performance come third. Updates often bring new functionality you have already paid for, along with speed and accessibility improvements. Running an old version means you are getting less for the same licence fee.
Back Up Before You Touch Anything
This is the part of the process most people skip. It is also the part that saves you when an update goes wrong. And updates do go wrong, even on well-maintained sites.
Before you click anything in the WordPress admin, make sure you have a recent backup of two things. The site files. And the database. Together, these are everything you need to roll back to a working version.
You have a few options. Your hosting provider may take automatic daily backups. Log in to your hosting dashboard and check the most recent backup is from today, not last week. A backup plugin can do it on demand. UpdraftPlus, BlogVault and Solid Backups are all reliable choices. Run a manual backup and save the file somewhere off your server, such as Google Drive or Dropbox. A managed maintenance plan with an agency will usually include backups as part of the service, with a defined restore process if anything breaks.
If you do not have a backup, stop. Do not run the update. Sort the backup first.
Use a Staging Site for Anything Risky
A staging site is a private copy of your live site that only you can see. You use it to test changes before applying them to the real thing. If you break something on staging, no customers see it.
Most decent hosts (WP Engine, Kinsta, SiteGround, Flywheel) offer one-click staging. Push your live site to staging, run the updates there, test everything, and only then apply the changes to live.
For sites with ecommerce, memberships, custom forms or anything touching a payment gateway, staging is not optional. The cost of a broken checkout for half a day is much higher than the half-hour staging adds to your process. For a simple brochure site with no transactions, you can usually update directly on live if you have a recent backup and you are watching the site closely afterwards.
Where to Find Plugin Updates in WordPress
WordPress flags available updates in several places inside the admin area. Once you know where to look, you can spot them in seconds.
The admin bar at the top of every screen shows a circular arrow icon with a number. This is the total of updates available across WordPress core, themes and plugins. Click it to go straight to the Updates screen.
A red badge also appears next to “Plugins” in the left sidebar when one or more plugins have updates available. Open Plugins, then Installed Plugins, and any plugin with an update will show a notification under its name with a link to update now and a link to view the version details.
The Updates screen itself, found under Dashboard, then Updates, lists every available update in one place, separated into WordPress core, plugins, themes and translations. This is the screen you will use most.
How to Update WordPress Plugins, Step by Step
Once you have your backup sorted, the update process itself is straightforward. Here is the safe version.
Step 1. Read the Changelog First
Before you click update, read what is changing. Each plugin shows a “View version X.X.X details” link next to the update notice. Click it and you will see the changelog from the developer.
Look for three things. Security fixes, which are the most important to apply quickly. Breaking changes or “this version requires PHP X.X” warnings, which can take your site down if your server is not ready. And major version jumps, where an update from 4.x to 5.x usually means significant changes worth testing carefully.
If the changelog is empty or just says “minor fixes”, that is fine. Move on. If it mentions a database migration, a major rewrite or breaking changes, slow down. That is the kind of update that earns staging.
Step 2. Go to the Updates Screen
From your admin dashboard, go to Dashboard, then Updates. This puts every available update in one place. You can also update individual plugins from the Plugins list, but the Updates screen is better when you have several to do at once.
Step 3. Select What You Want to Update
Under the Plugins section, you will see a list of every plugin with an available update. Each one has a checkbox. Tick each plugin individually if you want to update some now and leave others for later. Or use “Select All” if you are confident running them together.
Our advice. For high-stakes plugins (eCommerce, payment gateways, page builders, security plugins), update them one at a time. Run the update, test the site, then move to the next. For low-stakes plugins (small utilities, contact forms with no recent issues), batching them is fine.
Step 4. Click “Update Plugins”
Once you have your selection sorted, click the “Update Plugins” button at the top of the list. WordPress will work through each one in turn.
You will see a progress message on screen as each plugin updates. Do not close the browser tab or navigate away. If your connection drops mid-update, you can end up with a half-updated plugin, which usually means a broken site. When the process finishes, you will see a success message telling you the updates are complete.
Step 5. Check Everything Still Works
This is the step most people skip, and it is the most important. Plugin updates can change how content displays, how forms behave and how your site looks on different devices.
Open your site in a separate browser tab (not logged in, so you see what a real visitor sees) and check the homepage and a key inner page render correctly, contact forms still submit, the checkout completes if you have one, and the site looks right on mobile and in at least one browser you do not normally use.
If you have time, open the browser developer console (F12 in most browsers) and check for new JavaScript errors. These often show up after a major plugin update and are an early warning of trouble.
Step 6. Clear Your Cache
If you run a caching plugin (WP Rocket, LiteSpeed Cache, W3 Total Cache) or your host runs server-side caching, clear it after updates. Cached pages can hide the effects of an update, both good and bad.
What to Do When an Update Breaks Your Site
It happens. You run an update, and something stops working. Here is how to handle it without panicking.
If you get the white screen of death (a blank page, usually a PHP error), disable the most recently updated plugin via FTP or your hosting file manager. Connect to your site, go to /wp-content/plugins/, find the plugin folder and rename it (add “-broken” to the end). WordPress will deactivate the plugin, and the site will come back.
If a specific feature breaks but the site loads, go to Plugins, deactivate the suspected plugin, and check if the issue goes away. If it does, you have your culprit. Reach out to the developer with details, or roll back to the previous version using a plugin like WP Rollback.
If multiple things break and you cannot tell what caused it, this is when your backup earns its keep. Restore the backup you took before the updates and start again, this time updating plugins one at a time so you can pinpoint the problem.
If the site is down and you cannot get in at all, call your host. If you are on a managed maintenance plan, call your agency. Do not start trying random fixes on a live site you cannot access. You will make it worse.
A Quick Word on Auto-Updates
WordPress lets you turn on automatic updates for individual plugins. Go to the Plugins list and you will see “Enable auto-updates” next to each one. The appeal is obvious. They run themselves, you do not forget, and security patches go on instantly.
The trade-off is that automatic updates run without you watching. An update that breaks your site at 3am will stay broken until you notice. There is no backup taken before the update and no testing afterwards.
Our take. Auto-updates are fine for low-risk plugins on a brochure site with daily backups. For business-critical plugins on a revenue-generating site, manual updates with proper backups and testing are worth the small time investment. The same logic applies to WordPress core.
Want Someone Else to Handle This?
Plugin updates are routine work. They are also the kind of routine work that goes wrong on the day you do not have time to deal with it. If you would rather have someone doing this in the background, with proper backups, staging and testing built in, that is exactly what our website support and maintenance team does every day.
If you are still finding your feet with WordPress, you might also want to read our pieces on how to secure your WordPress website and the top five WordPress fails and how to avoid them.
Let’s talk WordPress maintenance.
