You log into WordPress and there it is again: a small red badge saying 14 updates are waiting. Most business owners handle it one of two ways. They click “Update all” and hope nothing breaks, or they close the tab and leave it for next month. Then the month after that.
Both habits cause trouble. Skipped WordPress plugin updates leave known security holes open on your site. Rushed ones can take down your contact form or checkout without anyone noticing for days.
This guide explains what plugin updates do, whether you should turn on auto-updates, a simple routine for updating safely, how to cut down a long plugin list, and what to do when an update breaks something.
What WordPress Plugin Updates Actually Do
A plugin update usually contains one or more of three things:
- Security fixes. When someone finds a flaw in a plugin, the developer patches it and ships an update. Until you install it, your site still has the flaw.
- Compatibility fixes. WordPress, PHP (the language WordPress runs on) and other plugins keep changing. Updates keep a plugin working with all of them.
- New features and bug fixes. Nice to have, but rarely urgent.
The security part is the one that matters most. In its State of WordPress Security in 2026 report, the security company Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 42% more than the year before. 91% of them were in plugins, 9% in themes, and only 6 in WordPress itself.
Speed matters too. For the vulnerabilities attackers went after, Patchstack measured a weighted median of five hours between the flaw becoming public and the first attacks. Attackers don’t pick sites one by one. Automated bots scan the web for known vulnerable plugin versions, so a small business site is as likely to be hit as a big one. An update you postpone for a month leaves that window open for a month.
Updates are not optional. The real question is how to apply them without breaking things. (Security also depends on logins, so read our post on why every WordPress site should use two-factor authentication.)
1. Should You Turn On WordPress Auto-Updates?
What auto-updates do
Out of the box, WordPress automatically installs minor core releases (for example 6.8.1 to 6.8.2, which are mostly security and maintenance fixes) and translation files. Plugins and themes don’t update on their own unless you turn it on. Since WordPress 5.5 you can do that plugin by plugin from the Plugins screen, with the “Enable auto-updates” link. WordPress then checks for updates twice a day and installs them in the background.
WordPress 6.6 added a safety net. If an automatic plugin update causes a fatal PHP error (the kind that crashes the site), WordPress puts the previous version back and emails the site administrator. You can read how it works in the rollback feature announcement.
That safety net has a limit worth knowing about. It catches updates that crash the site. It doesn’t notice a contact form that stops sending, a checkout that fails at the payment step, or a page layout that falls apart. Those problems only show up when a person, or a customer, uses the site.
When auto-updates are fine
- Small brochure sites with a handful of plugins.
- Small, single-purpose plugins from well-known developers that update regularly.
- Security releases, when nobody will be available to update by hand in the next few days.
When auto-updates are risky
- Online stores. WooCommerce updates can change checkout, emails and the database.
- Page builders like Elementor. A builder update can shift layouts across every page.
- Forms, bookings and memberships. Anything that collects leads, payments or logins.
- Sites with many plugins, where one update can clash with another.
Auto-updates also run at random times, with no fresh backup taken right before, and nobody checks the site afterwards.
A sensible middle ground
Turn on auto-updates for small, trusted plugins. Update the big ones (your store, your page builder, your forms, your membership plugin) by hand, on a schedule, following the routine below.
2. How to Update WordPress Plugins Safely: A 5-Step Routine
- Back up first, and know how to restore. Take a full backup of your files and database right before updating. Many hosts and backup plugins do this in one click. A backup only helps if you have restored one before, so test it once, before you need it.
- Read the changelog. Every plugin lists what changed in its update. A jump in the first number (version 8.9 to 9.0) is a major release and deserves extra care. Small fixes (9.0.1 to 9.0.2) are usually safe.
- Test big updates on a staging copy. A staging site is a private copy of your website. Many hosts include one. Update there first, check that everything works, then update the live site.
- Update one plugin at a time. “Update all” is tempting, but if something breaks after 14 updates you won’t know which one caused it. Do the big plugins one by one; small ones can go in small groups.
- Check the pages that make you money. After updating, submit your contact form, run a test order, try a booking or a login. Then clear your cache and keep a short log of what you updated and when.
3. Too Many Plugins? Where to Start Cleaning Up
“How many plugins is too many?” is one of the most common WordPress questions, and there is no magic number. Twenty well-built, maintained plugins can run better than five abandoned ones. But every plugin is more code to update, more possible conflicts and more ways in for attackers, so fewer is better. (For how a developer chooses plugins, see how developers use plugins to build better websites.)
If your list has grown over the years, clean it up in this order:
- Delete deactivated plugins. A deactivated plugin doesn’t run, but its files stay on your server. Bots look for vulnerable files by their address, and some flaws can be exploited even when the plugin is switched off. If you’re not using it, delete it.
- Find abandoned plugins. On each plugin’s page on WordPress.org, look at “Last updated” and “Tested up to.” A plugin that hasn’t been updated in a year or more, or that WordPress.org flags as untested with recent versions, is a risk. If the page says the plugin has been closed, replace it as soon as possible: closed plugins no longer get updates through WordPress.
- Merge plugins that do the same job. Two SEO plugins, three slider plugins or several form builders are common on older sites. Pick one and move everything to it.
- Replace one-feature plugins. A plugin installed to add one tracking code or one small tweak can often be replaced by a theme setting or a few lines of code from your developer.
- Remove what you no longer need. Old event plugins, a popup from a campaign three years ago, a migration tool you used once.
Removing heavy plugins also tends to make the site faster. If speed is your main problem, read why your website is slow and how to fix it.
4. What to Do When a Plugin Update Breaks Your Site
First, don’t start clicking around or installing fixes. Find out what changed, then undo it.
- If you see “There has been a critical error on this website,” check the administrator’s inbox. Since WordPress 5.2, WordPress sends an email with a special recovery link. It lets you log in with the broken plugin paused so you can deactivate it (how recovery mode works).
- If the site loads but something is wrong (a form, the checkout, a layout), think about which plugins you just updated. This is where updating one at a time pays off.
- Roll back. Restore the backup you took before updating, or reinstall the previous version of just that plugin. The free WP Rollback plugin does this for plugins from WordPress.org.
- Tell the plugin developer through its support forum, and wait for a fixed version before updating again.
If your site takes payments or bookings, roll back first and investigate later. Every hour the checkout is broken costs you orders.
5. When to Hand It Off
Doing updates yourself works well for a small site and a little spare time each week. It stops making sense when:
- Your site runs WooCommerce, memberships or bookings, and a broken update costs real money.
- You have 30 or more plugins, or a site someone else built that you don’t fully know.
- Nobody on your team has time to check the site after every update.
- You’ve already had an update break something, or a security scare.
A WordPress maintenance plan covers all of the above every month: backups, tested plugin updates, security scans, uptime monitoring and a person who checks your site afterwards. At Graphem, a member of our team does every update by hand, and a real person answers every support request. We don’t use AI for either.
Keep Your WordPress Site Safe with Graphem Solutions
Plugin updates are one of the simplest things you can do to protect your website, and one of the easiest to get wrong. Back up first, update the important plugins by hand, check the pages that bring in business, and trim plugins you don’t need.
If you’d rather not think about it, Graphem Solutions can take care of it for you. Our WordPress maintenance plans start at $199 a month (CAD), month-to-month, and we also take over sites built by other agencies. See all our services, or contact us to talk to a real person about your site.
