Update WordPress core the day a security release ships, plugins and themes every one to four weeks, and test everything after each update. That is the honest schedule, and the one we run for every site on our care plan. Skipping updates is the single most common reason WordPress sites get hacked: Wordfence’s annual report found outdated plugins were the entry point in over half of all compromised sites.
What exactly needs updating, and how often?
| Component | Cadence | Why |
|---|---|---|
| WordPress core | Security releases same day, others within two weeks | Security and features |
| Plugins | Every one to four weeks, tested after each | The biggest attack surface |
| Themes | Same as plugins | Layout and security |
| PHP version | Before your version hits end-of-life | Speed and security |
Why not update everything the moment it releases?
Because updates are also changes, and changes occasionally break things. The vast majority of updates are completely safe, but a plugin update that conflicts with an old custom theme can take a live shop offline. That risk is manageable with backups and a test environment, which is why the schedule above pairs updates with testing. Security releases are the exception: those you apply the same day, because the window between a disclosed vulnerability and bots exploiting it is measured in hours, not weeks.
What actually happens when you don’t update?
Three things, in this order. First, your site becomes a target: bots scan for known vulnerabilities in old plugin versions and WordPress will flag outdated versions in its own update guidance. Second, it gets slower: old PHP versions run WordPress noticeably slower than modern ones. Third, it drifts out of compatibility, so when you eventually update months later, the update is much bigger and riskier than it needed to be. We see this pattern in almost every rescue we do.
Is auto-update safe to turn on?
Core minor and security auto-updates: yes, enable them, they’re the safety net. Plugin auto-updates: be selective. For non-critical plugins they’re usually fine, but for WooCommerce, booking systems and anything handling money, updates should go through testing first. The worst disasters we’ve restored were all auto-updated plugins that broke their own integrations.
Updates broke my site. What do I do?
Stay calm and do these in order. Identify the most recent update, restore the backup taken just before it (our note on verifying your backups explains why you should test that restore now, not then), and if you can’t restore, disable the updated plugin by renaming its folder through the file manager. Then check the plugin’s own changelog and support forum. A breakage like this is exactly the scenario a care plan exists for: updates done on a schedule, tested, and rolled back the instant something looks wrong.
Who should actually be doing this?
Honest answer: if your site has more than a handful of plugins, updates need to happen on a schedule with backups and testing, and most site owners don’t have the time. That’s the entire point of our care plan – updates tested, not just clicked, every month, with a health report so you know what changed and why. If you’d rather do it yourself, follow the table above and you’re already ahead of most sites.
Quick answers
Can I ignore minor updates?
No. Minor updates often include security fixes, and skipping them is how sites get compromised. Apply them within a couple of weeks.
How long can I safely delay updates?
Security releases: apply the same day. Everything else: within two weeks. Longer than that and you’re gambling with an increasingly large, risky update.
Will updating break my custom theme?
Rarely, if the theme is maintained and the update tested on a staging copy first. That test step is the difference between routine maintenance and an incident.
Do updates matter if I barely use my site?
Yes. Bots scan for vulnerabilities regardless of how popular your site is, and a hacked site can be used to send spam or host malware under your domain.
Want the schedule handled for you? Get in touch and we’ll tell you honestly whether you need a care plan, or whether your setup is simple enough to maintain yourself.