The Pre-Update Checklist That Keeps WordPress Safe

The safest way to update WordPress core, themes, and plugins is to take a verified backup, check compatibility first, update one item at a time, and confirm your site works after each change. Done in that order, the "Update All" button almost never causes problems. Skip any of those steps and you're gambling — especially on a busy site with a lot of active plugins.

This guide walks you through the exact pre-update workflow professional engineers use, explains why certain updates break things when others don't, and shows you what to do the moment something goes wrong.

Why Updates Break WordPress Sites at All

WordPress itself is rarely the villain. The breakage almost always comes from a conflict between components that haven't been tested together. A few common scenarios:

• A plugin was built for PHP 7.4 and your host just bumped the server to PHP 8.2. The plugin update ships new code that finally uses 8.x syntax — and older, unrelated code on your site fails.
• A page builder (Elementor, Divi, Bricks) updates its core engine before its add-ons are ready. Widgets break, layouts collapse, or the editor crashes.
• WordPress core adds a new function with the same name as one a plugin defined years ago. Fatal error on every page load.
• A theme update wipes custom CSS or template overrides a developer hand-edited inside the theme folder instead of using a child theme.

None of these are hypothetical — they're the most common calls Mend engineers get the morning after a batch update.

The Pre-Update Checklist (Do This Before Every Update Session)

1. Take a Complete, Verified Backup

A backup you haven't verified is just a hope. Before any update:

1. Run a full backup — database and files — using your host's built-in snapshot tool or a plugin like UpdraftPlus or BackWPup.
2. Download the backup to somewhere outside your hosting account (local drive, cloud storage). If your host's server has a problem, an on-server backup may be inaccessible.
3. Spot-check the backup: confirm the zip or archive is non-zero in size and that the database file is inside it.

This sounds tedious until the one day you need it. A 10-minute backup routine has saved many sites that took weeks to build.

2. Check Your Current PHP Version

Go to Tools → Site Health → Info → Server in your WordPress dashboard. Note the PHP version. Then, before updating a plugin or theme, visit its page on wordpress.org and check the "Requires PHP" field. If the plugin now requires PHP 8.1 and you're on 7.4, you have a decision to make — update PHP first (and test), or hold off on that specific plugin update.

3. Read the Changelog (It Takes 90 Seconds)

Plugin changelogs on wordpress.org are usually dry, but they tell you whether an update is a security patch, a minor bug fix, or a major rewrite. Any entry with words like "major refactor," "breaking change," "database migration," or "minimum PHP version raised" deserves extra caution. Major version bumps (2.x → 3.x) almost always mean something significant changed.

4. Check Plugin Compatibility With Your WordPress Version

The wordpress.org plugin page shows "Tested up to: X.X." If your WordPress version is newer than the last tested version, the plugin may still work fine — but it's a flag worth noting, especially for complex plugins that interact heavily with the editor or the REST API.

5. Disable Auto-Updates on Critical Plugins

WordPress auto-updates are convenient but dangerous for mission-critical plugins — WooCommerce, membership plugins, booking systems. If one of those auto-updates overnight and breaks checkout at 2 a.m., you won't know until customers do. In Dashboard → Updates or via your plugin list, you can toggle auto-updates off per plugin. Leave auto-updates on for security-only plugins (like Wordfence or iThemes Security) where speed matters, but manage everything else manually.

How to Actually Run the Updates Safely

Update in This Order

1. WordPress core — it's the foundation. Everything else should be compatible with it before you update plugins.
2. Themes — especially your active theme and any parent theme. Do your active theme last if you have a child theme relationship.
3. Plugins — one at a time, not all at once. After each plugin update, open your site in a browser tab and click around the areas that plugin affects.

The "Update All" button is fine for mature, stable sites with few customizations. For WooCommerce stores, membership sites, or anything with custom code, update one at a time.

Test These Things After Each Update

• Homepage loads without errors
• A typical interior page or post loads
• Your contact form submits
• If WooCommerce: add a product to cart, proceed to checkout
• Admin dashboard — no critical errors in Tools → Site Health
• Logged-out browser (incognito) — caching can hide errors from logged-in users

The Staging Option (Worth It for Complex Sites)

If your host offers one-click staging (WP Engine, Kinsta, Flywheel, SiteGround, and others do), clone your live site to staging, run all updates there, test thoroughly, then push changes to live. This is the gold-standard workflow for WooCommerce stores and any site where downtime costs money. If your host doesn't offer staging, the free LocalWP tool lets you pull a copy of your site to your laptop for the same purpose.

What To Do When an Update Breaks Something

Stay calm. You have a backup. Here's the fastest recovery path:

1. Identify what you just updated. If you updated one plugin and something broke immediately, deactivate it first. If you updated several things, start with the most recent.
2. Deactivate via the dashboard if you can still log in. If the admin is broken, use FTP or your host's file manager to rename the plugin folder (e.g., wp-content/plugins/bad-plugin → wp-content/plugins/bad-plugin-disabled). WordPress will deactivate it automatically.
3. Restore the previous version by downloading an older release from the plugin's Advanced tab on wordpress.org, then uploading it via FTP or the "Upload Plugin" option in the dashboard.
4. If your whole site is broken, restore from backup. Most host control panels (cPanel, Plesk, Kinsta's dashboard, etc.) let you restore a database snapshot and file backup in minutes.

If you're seeing the white screen of death or a critical error after an update, our guides on fixing the WordPress white screen and resolving critical errors walk through each recovery step in detail.

Preventing This Problem Long-Term

Maintain a lean plugin list. Every plugin you add is a future compatibility surface. Plugins that do tiny jobs (redirect a single URL, add a favicon) often have better built-in alternatives or one-line code snippets. Fewer plugins means fewer update conflicts to manage.

Use a child theme. If your theme gets updated and you've edited theme files directly, those edits are overwritten. A child theme protects your customizations. This is non-negotiable if you're on a theme that receives regular updates.

Keep a change log. A simple text file or spreadsheet noting what you updated and when takes 30 seconds per session and is invaluable when debugging a problem a week later.

Monitor your site after updates. Uptime monitors (UptimeRobot has a free tier) ping your site every few minutes and alert you immediately if it goes down. A broken site you catch in 3 minutes is far less damaging than one you notice 8 hours later.

When to Call a Professional

You should handle most updates yourself — that's the point of this checklist. But hand it off when:

• Your site is broken right now and you don't have a clean backup
• You're running WooCommerce or a membership plugin through a major version jump
• Your PHP version needs upgrading and you're not sure what else it will affect
• An update wiped customizations and you don't know what code was there
• You've tried the steps above and the problem keeps coming back

If updates have already broken something on your site, Mend's Emergency Rescue gets a senior engineer on it fast — same-day in most cases, with a backup taken before anything is touched and a plain-English report of exactly what went wrong. If you'd rather have a professional triage the situation first, the free Diagnosis costs nothing and quotes a flat price before any work begins.

The irony of WordPress updates is that the sites most likely to get broken are the ones that update carelessly — and the ones most likely to get hacked are the ones that don't update at all. The checklist above threads that needle: stay current, stay careful, and keep a clean backup within arm's reach.