WordPress is out of date: update core, plugins and themes safely
Out-of-date WordPress, plugins and themes are how most small-business sites get hacked. Updating is safe when you back up first and update one thing at a time.
- Difficulty
- medium
- Time
- about 30 minutes
- Last reviewed
- 2026-10-26
Is this urgent?
This week for normal updates; today if the alert says a vulnerability is exploited.
Easy fix, no technical skills
Take a backup first: your host's backup tool, or a plugin like UpdraftPlus. Confirm it finished.
WordPress admin, Dashboard, Updates. Update WordPress core first, then plugins, then themes.
After each group, open the homepage, a product or booking page and the checkout in a private window.
Delete plugins you no longer use (deactivated plugins can still be exploited).
If a page breaks, deactivate the plugin you just updated and ask its support, or restore the backup.
Hand it to your IT person
Copy this into an email or chat. Replace the brackets with the details from your alert.
WordPress at example.com runs core (version) with (n) outdated plugins. Please back up, update core, plugins and themes, verify the key pages, and remove unused plugins.
Technical fix (commands)
What is outdated.
wp core version wp core check-update wp plugin list --update=available wp theme list --update=available
Update in order.
wp db export backup-$(date +%F).sql wp core update wp plugin update --all wp theme update --all wp core update-db
PHP version in use.
php -v
Check it worked
wp core check-update and wp plugin list --update=available show nothing pending; the site loads.
Scan the site for its WordPress version with the free tool. All free tools.
Prevent it next time
- Turn on automatic updates for plugins you trust.
- Keep the plugin count small.
- Vulnerability Watch tells you the day a plugin you use gets a security release.
Common questions
Is this urgent?
This week for normal updates; today if the alert says a vulnerability is exploited.
Can I fix this without technical skills?
Yes. The easy fix below needs no technical skills; the commands are only for your IT person.
How long does it take?
About 30 minutes once you know who runs the website.
Hear about this before your customers do
Add your website and we check uptime, certificates, domains and email security for you, free.