Keeping WordPress safe
Auto update advice for WordPress
Most hacked WordPress sites were not hacked through WordPress itself. They were running an old plugin with a known hole. Updates are the cheapest security you will ever get; here is how to automate them without fear.
Our recommendation
| What | Auto update? | Why |
|---|---|---|
| WordPress minor and security releases (for example 7.1.3 to 7.1.4) | Yes, always | On by default. They fix bugs and security holes and almost never break anything. Never turn them off. |
| WordPress major releases (for example 7.1 to 7.2) | Yes, if you have daily backups | Major releases arrive a few times a year. On a site built from well-maintained plugins they go smoothly. Turn them on under Dashboard > Updates (Enable automatic updates for all new versions of WordPress). |
| Well-maintained plugins (Kadence Security, Yoast SEO, W3 Total Cache, WP Mail SMTP, Converter for Media) | Yes | Their authors release fixes quickly and test against new WordPress versions. On the Plugins page click Enable auto-updates next to each one. |
| Divi | Yes, once your API key is entered | See how to set Divi to update itself. |
| Shop, membership, booking or payment plugins | Your choice: auto, or within a week by hand | These touch money and customer data. If an update could break checkout, update by hand on a quiet day and place a test order straight afterwards. Never leave a security fix waiting longer than that. |
| Translations | Yes | Automatic by default. |
Make auto updates safe
- Daily backups, kept off the server. Ask your host what they back up and for how long, or use a backup plugin that stores copies elsewhere. A backup is what turns a bad update into a five-minute fix.
- Keep your PHP version current. Old PHP versions stop getting security fixes, and new plugin versions stop supporting them. Your host's control panel shows the version; PHP 8.3 or newer is a good target in 2026.
- Keep the update e-mails. WordPress e-mails the site administrator after automatic updates. Glance at your site when one arrives.
- Look at your key pages once a week: home page, contact form, checkout. Send yourself a contact form message once a month.
- Use a staging copy for big changes. Many hosts can copy your site to a test address. Try major Divi or WooCommerce updates there first if your site is complex.
If an update breaks something
- A broken plugin: rename its folder in
wp-content/plugins/with your host's file manager. WordPress turns it off and the site comes back. Then look for a fix or an alternative. - WordPress shows "There has been a critical error" and e-mails a recovery link to the administrator address. Use that link to log in and switch the plugin off.
- Divi: use Divi > Theme Options > Updates > Rollback to go back to the previous version while Elegant Themes fixes the problem.
- Still stuck: restore last night's backup.
Never install "nulled" (pirated) copies of paid themes or plugins. They cannot update, and many come with malware already inside.
Want updates handled for you?
Our managed hosting and care plans can take updates, backups and security scans off your plate, so nothing waits and nothing breaks unnoticed.