How to Update WordPress on Your Website Safely

To update WordPress safely, back up your files and database first. Then go to Dashboard > Updates, update WordPress itself, then your plugins, then your themes, and check the pages that matter most: the home page, a contact form and anything that takes payments. For a security release within the same version (7.1.2 to 7.1.3, say), that takes about fifteen minutes. A jump across major versions takes longer, so do it on a staging copy if your host offers one. This guide covers each step, the automatic update settings worth turning on, and what to do if an update goes wrong.

Why now#

On 6 October 2026, WordPress released 7.1.3, a maintenance and security release with seven security fixes and four bug fixes. They include a stored cross-site scripting (XSS) flaw on the Comments admin screen that can be triggered through pending comments, an SQL injection in the WXR export tool, and a flaw that let anyone see comments on private and unpublished posts without logging in. The announcement asks everyone to update immediately. It also says the fixes are being backported to every branch that still gets security fixes, currently back to 4.7.

WordPress's release archive puts it plainly: "Only the most recent in the 7.1 series is safe to use". Older branches got patches the same day (7.0.7, for example), but they are only kept on life support. If your site is on anything other than the latest 7.1 release, this is the week to fix that.

Step 1: Check what you're running#

Log in and open Dashboard > Updates. The top of the page tells you which WordPress version you have and whether a newer one is available. Below it are lists of plugins and themes with updates waiting.

While you're there, check your PHP version under Tools > Site Health > Info > Server. At the time of writing, WordPress's requirements page recommends PHP 8.3 or greater and MySQL 8.0 or greater or MariaDB 10.11 or greater. WordPress still runs on PHP 7.4 and later, but the same page warns that those older versions have reached their end of life and "may expose your site to security vulnerabilities". If your host lets you choose the PHP version, move up after the WordPress update, not at the same time, so you know which change caused any problem.

Step 2: Back up the files and the database#

WordPress's backup guide says a site has two parts, the database and the files, and "you need both to be able to fully restore a typical WordPress site". The database holds your pages, posts, comments and settings. The files hold WordPress itself, your themes, plugins and uploaded images.

The easiest way is your host's backup tool. Most hosts have a "back up now" button in their control panel. If yours doesn't, use a backup plugin, or export the database from phpMyAdmin as SQL and download the wp-content folder over SFTP. Two things make a backup worth having:

• Keep it somewhere else. A backup stored only on the same server disappears with the server. Download a copy.
• Know how to restore it. Find your host's restore button now, while nothing is broken.

Step 3: Update WordPress itself#

On Dashboard > Updates, click the update button for the latest version (7.1.3 at the time of writing). WordPress downloads the new files, puts the site into maintenance mode for a few seconds and replaces its core files. According to the official update guide, that's all most sites need.

Things that can interrupt it:

• It asks for FTP details. WordPress can't write to its own files, usually because they're owned by your FTP account rather than the web server. Enter the FTP or SFTP details your host gave you, or ask the host to fix the file permissions.
• "Briefly unavailable for scheduled maintenance" won't go away. The update was interrupted. Delete the .maintenance file from the WordPress folder over SFTP or your host's file manager, then try again.
• It asks to update the database. After a major update, WordPress may send you to a database upgrade page (wp-admin/upgrade.php) the next time you open the admin area. Follow it straight away.

If you have a caching plugin or your host caches pages, clear the cache afterwards so visitors get the new version.

Using WP-CLI instead#

If your host gives you SSH access with WP-CLI, the same update is three commands:

wp core update
wp core update-db
wp core verify-checksums

wp core update installs the latest version (add --minor to stay within your current major version). wp core update-db runs any database upgrade. wp core verify-checksums compares your core files with the checksums WordPress.org publishes, which is also a quick way to spot files someone has tampered with.

Step 4: Update plugins, then themes#

With WordPress updated, go back to Dashboard > Updates and update your plugins. If you have a lot of them, update a few at a time rather than all at once. If something breaks, you'll know which group caused it. Read the changelog of any plugin that jumps a major version (2.x to 3.0), especially plugins that handle forms, bookings or payments.

Then update your themes. Themes from the WordPress.org directory update from the same screen. Themes you uploaded as a zip, including Freeframe's WordPress themes, are updated by uploading the new version. The block theme guide explains how, and what happens to your Site Editor changes. Freeframe themes such as Bistro and Handy need WordPress 7.1 or later, so update WordPress before the theme.

While you're here, delete plugins and themes you don't use. A deactivated plugin is still code on your server, and it still needs updates.

Step 5: Check the site#

Open the site in a private browser window, so you see it as a visitor does, and click through:

• the home page and two or three of your most visited pages;
• the contact form, by sending yourself a real message (the contact form guide has a testing checklist that applies here too);
• anything that takes bookings or payments, as far as you can go without paying;
• your login page and the admin area, including the Site Editor if you use a block theme.

Finally, look at Tools > Site Health > Status. It lists critical issues and recommended fixes, such as an old PHP version or a failing scheduled task.

Step 6: Let WordPress keep up for you#

You don't have to do this by hand every time. WordPress has four kinds of automatic background updates: core, plugins, themes and translations, as explained in the upgrade documentation.

Core. Minor and security releases install automatically on most sites. New installations since WordPress 5.6 also get major releases automatically. You can see and change the setting at the top of Dashboard > Updates. If you or your host have set it in wp-config.php, the WP_AUTO_UPDATE_CORE constant overrides that screen: true enables all core updates, 'minor' enables only minor ones, and false turns them off. Check that nobody has defined AUTOMATIC_UPDATER_DISABLED as true. That switches off every automatic update, security fixes included, and WordPress strongly advises against it.

Plugins and themes. Since WordPress 5.5 you can opt in plugin by plugin and theme by theme (how it works). On the Plugins screen, use the Automatic update column, or the bulk actions to switch on several at once. For themes, open the theme in Appearance > Themes and click Enable auto-updates. WordPress checks twice a day and emails the site's admin address after each attempt, successful or not, so make sure that address is one you read.

A sensible setup for a small business site:

• core minor and security updates: on (the default);
• well-maintained plugins you rely on: on;
• plugins that run payments or bookings: off, updated by hand after a backup and a quick read of the changelog;
• regular automatic backups from your host, so any automatic update can be undone.

If automatic updates never seem to happen, look in Tools > Site Health for a scheduled event error. Background updates depend on WordPress's built-in scheduler (WP-Cron), which some setups break.

If an update breaks something#

Don't panic, and don't start reinstalling things at random.

1. If it's a plugin, deactivate it on the Plugins screen. If you can't get into the admin area, rename that plugin's folder inside wp-content/plugins over SFTP. WordPress deactivates a plugin it can't find.
2. If it's WordPress itself, restore the backup you made in step 2. The update guide also links to the release archive for the files of earlier versions. Only roll back as a last resort for security releases, because it puts the vulnerability back.
3. Tell the developer. A plugin or theme that breaks on the latest WordPress needs fixing upstream. Report it on its support forum with your WordPress and PHP versions.

Make it a routine#

Updates aren't a one-off. Put a monthly reminder in your calendar: back up, update, click through the key pages. It takes a quarter of an hour, and every security fix you install closes a hole that's already public. If you also run a site on another stack, the same habit works there: see the guides to updating Next.js and updating Astro, and how template versions work.