Quick answer: Keeping WordPress secure means updating WordPress core, themes and plugins, using strong unique passwords, limiting administrator access and maintaining recoverable backups. Updates matter, but test important changes before applying them to a busy site.
For practical steps, follow our WordPress plugin update checklist. If an update causes an HTTP 500 error, consult our troubleshooting guide before attempting a full database restore.
Because WordPress is so popular it, therefore, attracts the attention of hackers around the world, whose aim is to break and exploit those sites. They might do that to leave political messages, they may just do it for fun to appear on hacking league tables, or more seriously they may use your website to target your customer data or to use your site for illegal activities, such as embedding malicious content that spammers direct people to – eg phishing websites.
It’s therefore important (and within our service terms and conditions) that customers keep their websites up to date with any security updates – for the main WordPress core software as well as the installed themes and plugins. We would also recommend that unused themes or plugins are removed/uninstalled if no longer required.
We’ve created this page to act as a reference point to guide you through the process of checking and updating your WordPress sites to make sure they are up-to-date and remain so.
First of all log into your WordPress dashboard
If there is a WordPress software update due, you should see that on your main dashboard, the link will direct you through the update process:
When you click on Plugins on the left, it will show which plugins require an update and you can set it to have auto-updates enabled.
By clicking on Appearance on the left, you’ll see which themes can be updated.
When you hover over a theme, you can access the theme details:
This then allows you to enable auto-updates for the theme.
You may prefer to leave auto-updates off, and process updates manually, to be able to check that the installs process without error. If that’s the case, then it’s important that you log in to your WordPress site regularly to check for site issues or vulnerabilities.
A safe WordPress maintenance routine
- Confirm that a recent backup includes both site files and the database, and that you know how to restore it.
- Review the updates listed under Dashboard > Updates and check the release notes for major changes.
- Update plugins and themes from trusted sources; remove unused plugins and themes you do not need.
- For business-critical sites, test major updates on staging before changing the live website.
- After updating, check the homepage, contact forms, checkout if applicable, mobile navigation and error logs.
- Use individual accounts, strong unique passwords and multifactor authentication where available.
Should you enable automatic updates?
Automatic updates can reduce the time a known vulnerability remains unpatched. They are not a substitute for backups or monitoring, however. For a straightforward website, automatic minor updates may be sensible; for sites with custom integrations, membership features or online payments, use a tested update process and check the site afterwards. See our WordPress plugin update checklist.
What if an update breaks the site?
Do not repeatedly apply changes without knowing what failed. Note the error and the time it appeared, check PHP and WordPress logs, and disable the suspected plugin only if you can do so safely. If necessary, restore a known-good backup, remembering that a restore can overwrite recent orders, messages or content. For diagnosis, see our WordPress 500 error guide.