Module 7 · 7.2

English

Nederlands English Deutsch

Keeping updates on track

Module 7: Security · Reading time: 8 minutes

Learning objective: After this lesson, you can set up updates so they happen quickly and safely, and you know what to do with a plugin that no longer receives updates.

Key concepts: minor version, major version, security update, automatic updates (core, plugins, themes), rollback, installer updates, abandoned plugin, changelog, staging for major updates

Why updating quickly matters more than waiting cautiously

Lesson 7.1 showed it: attackers look for known vulnerabilities for which a fix already exists. Between the release of a fix and the first large-scale scans, there's sometimes only a few hours or days. Anyone who "waits a month first to see if the update is any good" stays exposed for that whole month.

At the same time, an update can break something. The solution isn't to wait, but to make sure updating happens automatically, quickly and can be reversed:

minor updates and plugin updates automatically;
a backup right before the update, with an automatic rollback if something goes wrong;
major updates tested in staging first (lesson 8.3), but within days, not months.

Minor and major versions of WordPress

WordPress numbers versions like 7.1.4:

7.1 is the major release. A few of these come out each year, with new features.
.4 is a minor release: fixes and security updates, without major changes.

Since version 3.7, WordPress installs minor versions and security updates automatically, unless you've turned that off. You install major versions yourself by default, with a button at Dashboard > Updates. You can control this behaviour in wp-config.php:

define( 'WP_AUTO_UPDATE_CORE', 'minor' );  // default: minor versions only
define( 'WP_AUTO_UPDATE_CORE', true );     // major versions too
define( 'WP_AUTO_UPDATE_CORE', false );    // nothing automatic (not recommended)

Choose one of the three lines. The default (minor) is fine for most websites; if your installer or your host updates major versions for you, that's fine too.

WordPress officially only supports the newest major version. Security fixes are also backported to older series for a while, but you shouldn't rely on that.

Plugins and themes automatically

Since WordPress 5.5, you can click Enable auto-updates for each plugin at Plugins, and for each theme at Appearance > Themes. Turn this on for most plugins: that's where the vulnerabilities are (lesson 7.1).

Since WordPress 6.6, WordPress checks after an automatic plugin update whether the website still works. If the update causes a fatal error, WordPress reverts to the previous version (a rollback) and you get an email. That catches the biggest risk of automatic updates: a blank white website that you only notice a week later.

Installers such as Installatron (lesson 2.2) can do this too: with a backup beforehand and a fallback if the update fails. Use one of the two systems deliberately; they don't conflict with each other, but you want to know who's doing what.

Exceptions where you sometimes turn automatic updates off:

a plugin you know often changes things in major versions (a page builder, a webshop plugin with integrations); update these after testing in staging, but quickly;
a theme with changes made directly to its own files. Better: put those changes in a child theme (lesson 5.2), so the parent theme can update automatically without issue.

Paid plugins

Paid plugins only receive updates for as long as your licence is active. An expired licence means: no security updates. Keep track of your licences (lesson 9.4). And a paid plugin from a download website doesn't get any updates at all (lesson 5.3).

The abandoned plugin

A plugin without updates for a long time, or one that's been removed from the wordpress.org plugin directory ("This plugin has been closed"), no longer receives fixes. What to do:

Find out why. A closed plugin often states the reason (for example a security issue). If it's a security issue, act immediately.
Look for an alternative that's actively maintained (lesson 5.3), or check whether you still need the functionality.
Replace it in staging, test, and then remove the old plugin completely.

Leaving an abandoned plugin in place "just in case" is exactly the risk you want to avoid.

Reading the changelog

Every update comes with a changelog: what's changed. At Dashboard > Updates or on the plugin page (the Development or Changelog tab). Look especially for words like "security", "beveiliging" or "fix vulnerability": then you want to update as soon as possible. And for "breaking change", "requires PHP 8.x" or "new version of": then you test first.

After an update

Take a look at your website, including the key functions (form, shopping cart, logging in).
Read the emails from WordPress or your installer about successful, failed or reverted updates. A rollback means the old (vulnerable) version is running again: resolve it, often by also updating PHP, the theme or another plugin, or by replacing the plugin.
Check Site Health (lesson 5.4) for any remaining notices.

In practice: what it looks like in a panel

In the WordPress admin area:

Dashboard > Updates: the status of WordPress, plugins and themes. This also shows whether automatic updates for major versions are turned on.
Plugins: in the Automatic updates column, "enable" or "disable" for each plugin. At the top, you can turn several on at once with Bulk actions.
Appearance > Themes: click a theme for the automatic updates button.

In Installatron (DirectAdmin), you set this per installation at Edit > Settings > Auto-Update. In Softaculous (cPanel) and the WP Toolkit (Plesk), the same option is in the installation settings.

Summary

Known vulnerabilities are exploited quickly; updating needs to be fast, automatic and reversible.
WordPress installs minor versions automatically (since 3.7); major versions by default after a click, or automatically if you choose.
Turn on automatic updates for most plugins and themes; since 6.6, WordPress rolls back failed plugin updates.
An expired licence or abandoned plugin means no security updates: replace it.
Read the changelog and the emails after an update; actively resolve a rollback.

Quiz

Exercise

Exercise A7.2: Is your WordPress up to date? Check your website's admin area at Dashboard > Updates to see which version of WordPress you have, and enter it, along with your domain. The tool fetches the newest version from the public version API at wordpress.org and compares: green if you have the newest, orange if you're on the same major version but missing a minor update, red if you're running an older major version. Also enter how many plugins have automatic updates turned on and how many don't, and why those don't.

Cookies at WebOké

Cookie settings

Necessary

Marketing