Once we took on a project that hadn't been updated in two years: 47 outdated plugins, three of which had known CVEs with a CVSS score of 9.3. After updating without preparation, the site went down for six hours, and recovery cost a sum comparable to a month's revenue. Since then, we have developed a rigid update protocol that eliminates such situations. This article details concrete steps proven on hundreds of projects — with numbers that help you assess risks.
The average cost of recovering a site after a hack due to an unapplied patch ranges from $500–2k, and downtime losses are even higher. Regular updates reduce these risks by 90% and save up to $900–1.3k per year on support.
Why updating CMS and plugins is critical for security?
Outdated plugins cause 80% of WordPress hacks (data from Sucuri). But broken updates are equally dangerous: updating without a backup and testing can break layout, break custom functions, or cause 500 errors. We guarantee that every stage — from backup to deployment — follows a scheme that minimizes risks.
What is a safe update order?
Safe order: database → CMS Core → plugins → themes. Never update everything at once with the "Update All" button. Before updating, always create a fresh backup (no older than 24 hours) and verify that it can be restored. A full backup of a typical 10,000-page site's database and files takes 15 to 30 minutes.
How to check plugin compatibility before updating?
Before major updates:
- Study the changelog for breaking changes.
- Check the "Tested up to" field in the repository — compatibility with the current CMS version.
- Ensure the plugin works with your PHP version.
- Check compatibility with other key plugins (e.g., WooCommerce requires synchronous updates for Stripe, Shipping add-ons).
For example, when updating WooCommerce from 7.0 to 8.0, we encountered incompatibility with a custom delivery module — staging testing caught it before deployment.
Testing on staging: why is it mandatory?
A staging environment allows you to detect conflicts without affecting live users. Here is a comparison of two approaches:
| Criteria | Update on staging | Update on production |
|---|---|---|
| Breakage risk | Low (isolated environment) | High (real users) |
| Rollback time | Fast (delete staging) | Complex (restore from backup) |
| Testing possibilities | Full | Limited |
Create staging via your hosting panel (Kinsta, WP Engine) or manually using WP-CLI.
How to update WordPress and plugins via WP-CLI?
WP-CLI is three times faster than the admin panel. Here are typical commands:
# List plugins with available updates wp plugin list --update=available --format=table # Update a specific plugin wp plugin update woocommerce --dry-run # first dry-run wp plugin update woocommerce # Update all plugins (with caution) wp plugin update --all # Update WordPress Core wp core update wp core update-db # update database schema after core update After updating WooCommerce, run wp wc update. This is not optional — without the database schema update, some functions may work incorrectly.
Which updates should be automated?
WordPress supports auto-updates for Core (minor versions enabled by default). Configure in wp-config.php:
// Enable auto-update for major Core versions define( 'WP_AUTO_UPDATE_CORE', true ); // Or only minor (safe patches) define( 'WP_AUTO_UPDATE_CORE', 'minor' ); // Auto-update only security plugins add_filter( 'auto_update_plugin', function( $update, $item ) { $auto_update_slugs = [ 'wordfence', 'sucuri-scanner', 'updraftplus' ]; return in_array( $item->slug, $auto_update_slugs ); }, 10, 2 ); What to do when an update fails?
If the site breaks, roll back the plugin to the previous version:
wp plugin install woocommerce --version=8.0.0 --force Or restore only the plugin files from the backup, then disable auto-updates for that plugin.
Comparison of automatic vs manual updates
| Criteria | Automatic | Manual with testing |
|---|---|---|
| Speed | Instant | 1-4 hours |
| Security | Risk of conflicts | Verified on staging |
| Suitable for | Security plugins, minor patches | Major versions, custom solutions |
For critical updates, always use manual control.
What's included in our turnkey CMS and plugin update service?
We offer a full cycle:
- creation of database and file backup;
- update on a staging environment;
- compatibility check and functional testing;
- update on production with monitoring;
- recommendations for automation and ongoing maintenance.
Our experience spans over 5 years working with projects of any complexity. We have updated more than 200 sites. Order our update service and get a compatibility guarantee. Contact us for a consultation — we will help you choose the optimal update schedule for your project.
Timelines
A scheduled update of 20–30 plugins with staging testing takes 2 to 4 hours. Complex projects with custom modules require up to 8 hours. Contact us for an accurate assessment of your project.