Why we do not let updates run automatically
A WordPress website is made of four parts with their own updates. We install each update separately, with a backup before and a check after.
- What gets updatesWhich parts of a website get their own updates
- RisksWhy automatic updates can cause damage unnoticed
- OrderIn what order and with what safeguards we update
Which parts get updates and how risky they are
Each part gets its own updates. We test risky ones on staging first.
Low
- Core security updates
- Minor core versions
- Helper plugins with no visible output
Medium
- Minor versions of page builders
- Form and translation plugins
- Themes without announced breaks
High
- Major versions: shop, page builder, theme
- Updates that migrate data
- Payment plugins
- Every PHP change
What goes wrong when updates simply run through
Often everything looks fine right after the update. The damage only shows later, or only for your visitors.
- Page builder updated straight on live: four hours of downtime
- PHP raised by the host: the admin area would not open
Cases from our work, treated confidentially.
How we install updates
Every update has a fixed order, a time window and a way back.
Order
- 1WordPress core
- 2Premium plugins
- 3Their add-ons, theme
- 4Free plugins
- 5Shop plugins last
Dependencies first: translation before theme, shop system before payment modules. We check after every update.
Time window
- Monday to Thursday
- Not on Friday afternoons
- Not before public holidays
- Not during your sales peaks
An update on Friday evening that nobody looks at until Monday is exactly the risk we avoid.
Way back
We then assess security notices for this version one by one, and a review date is set.
- 01Backup, confirmed
- 02Rate the risk
- 03High risk: staging
- 04Install one at a time
- 05Check pages and checkout
- 06Security scan
- 07Clear cache, check fresh
- 08If problems: roll back
- Supported version
- Not on day one
- Plugins checked beforehand
- On staging, with a log
- At most 6 months after end of support
- 24 hours of monitoring
Questions clients ask about updates
-
WordPress updates itself, so why do I need you?
WordPress can install updates itself, but with no backup before, no check after and mostly at night. If something goes wrong, it only shows when a visitor notices. We install the same updates, with a backup, a check and at a time when we are watching.
-
My host offers automatic updates. Isn't that the same?
The host's system presses the same update button, just from outside. It does not know which plugins on your website work together, and afterwards it does not check whether form, checkout and layout still work. So we switch this automation off.
-
How often do you update, and will I notice?
Regularly, not only when asked. Security updates take priority and do not wait for the next round; major versions follow after a compatibility check. If all goes well, you notice nothing. If there is a problem, you get a short note on what was found and fixed.
-
Why is my PHP not on the very latest version?
On purpose. Your website runs on a supported version, but not on the one that has just come out. In the first months, the makers of WordPress and the plugins are still finding their bugs. The switch comes as soon as your website's plugins are ready for it, at the latest six months after support for the old version ends.