How to Update WordPress Safely

What a WordPress update actually changes

A WordPress update changes one of three things: core files, a theme, or a plugin. Core releases come as minor versions, which are security and bug fixes installed automatically, or major versions, which add features and can change how a plugin behaves. Each part sits in its own folder, so one can fail while the rest of the site keeps serving pages.

• Core — wp-admin, wp-includes, and a few loose files such as index.php and wp-login.php.
• Theme — one folder inside wp-content/themes.
• Plugin — one folder inside wp-content/plugins.
• Database — not files at all. A major release can ask you to run an upgrade script once.

Updating the software is not the same as editing a page. A post edit writes to the database; a core update replaces files. That is why a failed update can take the dashboard down while the published articles still render in a browser.

Back up and check compatibility before you click Update

Three checks take about ten minutes and decide whether a bad update costs you a coffee or a week of orders.

1. In cPanel open Files, then Backup (some servers label it Backup Wizard), choose Full Backup, and download the archive to your computer. A backup you have not downloaded is not a backup. A plugin such as UpdraftPlus works too, if you also copy the file off the server.
2. Note the PHP version in cPanel under Software, then MultiPHP Manager, or in WordPress under Tools, Site Health, Info. If the account runs an end-of-life branch, update PHP before you touch core, and test that change on its own.
3. Open Plugins, Installed Plugins and look at the last-updated date. A plugin untouched for two years is the usual suspect when a major release breaks a layout.
4. Agencies: clone the site to a staging account and run the update there first. One extra hour kills most surprises.

You are ready when the archive sits on your computer and you can say which PHP version the site runs. For a scheduled, restorable copy without the manual step, the WordPress backup service covers it.

Update WordPress core from the dashboard

The dashboard path is the one to use when the site loads and you can log in. Four clicks, one wait.

1. Open yourdomain.com/wp-admin and log in as an administrator.
2. Go to Dashboard, then Updates. The same screen opens directly at wp-admin/update-core.php.
3. Click Update Now and leave the tab open. The site shows a maintenance message for a few seconds while files are replaced.
4. Wait for the welcome screen, then open Dashboard, Updates again.

It worked when that screen reports the latest version of WordPress and the front page loads in a private window where you are not logged in. If the welcome screen appears but the site is blank, go to the failure table below before you try anything else.

Turn on automatic updates for minor releases

Minor and security releases have installed themselves in the background since WordPress 3.7, so most sites are patched without anyone clicking. Major releases are the exception: a site first built on version 5.6 or later installs them automatically, while an older site waits for someone to tick the box on Dashboard, Updates.

Plugins have their own switch. Open Plugins, Installed Plugins, and use Enable auto-updates beside each row. Turn it on for small utility plugins you would barely notice breaking, and leave it off for page builders and e-commerce extensions, where a surprise change costs revenue.

Keep one manual look each week either way. An automatic plugin update will not tell you that a layout shifted, and the next reader who does will not email to praise it.

Update plugins and themes after core, then clear the cache

Order matters: core first, plugins second, themes third. Core is the shared base, and a plugin built for the new version usually ships within days of a major release, so updating it earlier can install code written for a core you do not have yet.

• Plugins — Plugins, Installed Plugins, select all, Update plugins. Do it on a weekday morning, not before a sale.
• Themes — Appearance, Themes, update only the active theme and any parent theme it depends on.
• Caches — purge the caching plugin, any host-level cache in cPanel, and the CDN. Cached HTML hides both fixes and faults.
• Test logged out — open the home page, one article, the login screen, and one form in a private window.

A layout that looks broken straight after an update is usually an old cached page. Purge first, then debug. The order saves hours of chasing a fault that was never there.

Fix an update that failed or left the site in maintenance mode

Match what you see to the fix, make one change, and reload. Every row below is recoverable without a developer.

Restore the backup last, not first. It rewinds the whole site to the moment you took it, and any orders, comments or form entries since then go with it. A plugin folder renamed takes ten seconds and keeps the day's data.

Manual update by FTP or WP-CLI when the dashboard is broken

If wp-admin will not open, the files can still be replaced by hand. Connect with FileZilla using the FTP account from cPanel, then work in public_html.

• Download the current package from wordpress.org/download and extract it on your computer.
• Delete wp-admin and wp-includes on the server. Do not touch wp-content, and never delete wp-config.php.
• Upload the new wp-admin and wp-includes folders, plus the loose root files such as index.php and wp-login.php. Choose Overwrite when asked.
• Open yourdomain.com/wp-admin. If WordPress asks to update the database, click the button and wait.
• Reactivate plugins and purge the cache, then run the logged-out test again.

A host that gives SSH access is faster. From the WordPress root, as the account user rather than root, run three commands:

• wp core check-update — shows the version available.
• wp core update — downloads and installs it.
• wp core update-db — applies any database change the release needs.

Who should run the update on a WebJi® account

The job is ten minutes when the site is small and a monthly routine when it is not. WordPress hosting here runs on cPanel with Softaculous, one-click backups, and PHP versions you can switch yourself, from ₹400 a month or ₹3,000 a year, before 18% GST.

If nobody on the team wants the routine, managed WordPress with done-for-you core and plugin updates plus security hardening is ₹5,900 a year, before 18% GST. Email support@webji.services with the domain and the PHP version you are on, and support answers 24/7 in Hindi and English.