CMS and Plugins Update

CMS Plugin Updates

Updating WordPress, themes and plugins is regular task that cannot be delayed. Most WordPress compromises happen through vulnerabilities in outdated plugins, not core. However, reckless updates in production without testing break sites as often as vulnerabilities do.

Update Order

Safe order: database → WordPress Core → plugins → themes. Never update everything at once with "Update All" button.

Before updating — backup. Backup should be fresh (no older than 24 hours) and verified (can be restored).

Checking Compatibility

Before updating major plugin versions:

1. Check plugin changelog — any breaking changes?
2. Check compatibility with current WordPress version ("Tested up to" field in repository)
3. Check compatibility with PHP version on server
4. Check compatibility with other key plugins (WooCommerce requires specific addon versions)

WooCommerce is particularly sensitive: when updating core WooCommerce, update WC Stripe, WC Shipping and other official addons simultaneously — they version together.

Testing Before Update

Correct scheme: staging → production.

Staging created either via hosting panel (Kinsta, WP Engine, Cloudways have built-in staging) or manually:

# Clone site to staging domain
wp --allow-root search-replace 'https://example.com' 'https://staging.example.com' \
    --skip-columns=guid \
    --precise \
    --all-tables

On staging: update plugins → run key scenarios manually → check PHP logs for errors.

Update via WP-CLI

# List plugins with available updates
wp plugin list --update=available --format=table

# Update specific plugin
wp plugin update woocommerce --dry-run  # dry-run first
wp plugin update woocommerce

# Update all plugins (carefully)
wp plugin update --all

# Update WordPress Core
wp core update
wp core update-db  # update database schema after core update

# Update themes
wp theme update --all

WooCommerce Database Update

After WooCommerce update may appear notice to update database:

wp wc update
# or via PHP
WC()->install();

This is not optional — without schema update some WooCommerce functions work incorrectly.

Automatic Updates

WordPress supports automatic Core updates (minor versions enabled by default). Manage via wp-config.php:

// Enable auto-update for major versions Core
define( 'WP_AUTO_UPDATE_CORE', true );

// Or only minor (safe patches)
define( 'WP_AUTO_UPDATE_CORE', 'minor' );

For plugins auto-update via filter:

// Auto-update only security plugins
add_filter( 'auto_update_plugin', function( $update, $item ) {
    $auto_update_slugs = [ 'wordfence', 'sucuri-scanner', 'updraftplus' ];
    return in_array( $item->slug, $auto_update_slugs );
}, 10, 2 );

Rollback on Issues

If update broke site:

# Rollback plugin to previous version via WP Rollback (plugin)
# or manually via WP-CLI
wp plugin install woocommerce --version=8.0.0 --force

Or restore from backup only plugin files:

# Restore wp-content/plugins/woocommerce/ from backup
# then disable auto-update for this plugin via filter

Monitoring After Updates

After production update — check:

• PHP error log (/var/log/php/error.log or WP_DEBUG_LOG)
• Key pages: homepage, catalog, product card, checkout, personal account
• Contact forms (send test submission)
• Performance (server response time)

Timeline

Scheduled update of 20–30 plugins with testing on staging — 2–4 hours.