How to Update WordPress Safely in 2026

You have an update notification sitting in your WordPress dashboard right now. Maybe several. You’ve been meaning to click it, but something always comes up. Or maybe you’re about to click it this second, without doing anything first.

Both scenarios make me nervous.

Skipping a backup before a WordPress update is the fastest way to turn a five-minute task into a four-hour recovery. I’ve talked to site owners who lost e-commerce orders, contact form data, and weeks of content because a plugin conflicted with a new core version and they had nothing to roll back to.

The update itself wasn’t the problem. The missing backup was.

This guide walks you through the full process: how to back up before you touch anything, how to use staging to test updates before they hit your live site, and a couple of methods for running the actual update.

Here are the key takeaways:

• WordPress updates provide critical security patches, new features, and bug fixes that keep your site secure and performing well
• Always create a full backup before updating to protect against data loss and compatibility issues
• Update in order: themes and plugins first, then WordPress core to minimize conflicts
• Use automatic backups and staging environments to make updates safer and less stressful
• Two update methods available: one-click dashboard update or manual FTP upload for flexibility

Table of Contents

Why Update WordPress Regularly?

Updating WordPress is crucial for the success and security of your website. Here are some helpful benefits you’ll get with every update.

• Security Enhancements

With each new update, WordPress addresses potential security vulnerabilities, making it more challenging for hackers to exploit your site. By keeping your site updated, you can stay one step ahead of potential WordPress security threats.

• New Features

WordPress is constantly evolving, with each update bringing new features and improvements. These can enhance the functionality and user experience of your website. 

• Bug Fixes and Performance Improvements

Like any software, WordPress is not immune to bugs or performance issues. When users report these issues, the development team releases updates to address them. These updates not only fix bugs but also optimize performance, making your website faster and more efficient.

• Compatibility with Themes and Plugins

If you don’t update WordPress, there’s a risk that outdated themes or plugins may not be fully compatible. Updates reduce the chances of any functionality or design-related problems.

Before You Update WordPress: 4 Things to Do First

Every failed WordPress update I’ve seen had one thing in common: the site owner skipped at least one of these steps. None of them take long, but all of them matter.

Step 1: Back Up Your Entire Site

Before anything else, you need a complete backup: database, files, themes, plugins, and uploads. If something goes wrong during the update, this is the only thing that gets your site back.

I use Duplicator Pro for this. It creates a single zip file of your entire site that you can restore from even if your WordPress admin is completely inaccessible.

To get started, select a subscription for Duplicator Pro. You could use the free version of the plugin, but the premium version offers easier restore options, drag-and-drop migrations, and even multisite support.

Then, install Duplicator in your WordPress dashboard. Next, find Settings » General. Paste the license key you received with your purchase and activate it.

Now you can back up your website! To do this, go to Duplicator Pro » Backups » Add New.

Give the backup a name with dynamic tags. Then, select a storage location. Duplicator supports a variety of options, including:

• Duplicator Cloud
• FTP
• Google Drive
• Dropbox
• Microsoft OneDrive
• Amazon S3
• Wasabi
• Google Cloud
• DreamObjects
• Vultr
• DigitalOcean Spaces
• Cloudflare R2
• Backblaze B2

To create a complete backup of your entire site, expand the Backup section and select the Full Site preset. This will include all your plugins, themes, media files, and other data.

Click Next. You’ll see that Duplicator performs a full scan of your site.

Hit Create Backup. Once it’s ready, it’ll be listed on the Backups page.

Download your backup. You should also consider setting a disaster recovery point so you can easily roll back your site if the update causes compatibility issues. 

Step 2: Check Your PHP Version

WordPress requires PHP 8.3 at minimum. If your server is running an older version and you update WordPress core, you may get a white screen with an error message.

To check your PHP version, go to Tools » Site Health, then click the Info tab. Scroll down to the Server section and expand it. Look for the PHP version row.

If you’re on PHP 7.4 or lower, contact your host before updating WordPress. Most managed WordPress hosts let you switch PHP versions from your hosting control panel with one click.

Step 3: Pause Your Caching Plugin

Active caching plugins can interfere with the update process and mask whether your update actually worked. After a core update, a cached version of your site might load fine in your browser while the actual updated files have a conflict sitting underneath it.

Temporarily deactivate your caching plugin. You’ll reactivate it after the update is done.

Step 4: Create a Staging Site and Update There First

For minor security releases, backing up and updating directly on production is fine. For major version jumps, updating a few plugins at once, or any time you’re also changing your PHP version: create a staging site first.

Duplicator Pro creates an isolated copy of your live site from right inside your WordPress dashboard. Go to Duplicator Pro » Staging in your sidebar. Click Create Staging Site.

Select the pre-update backup you created in Step 1. Name your staging site and choose a unique admin color scheme to avoid accidentally editing production.

Duplicator handles the rest automatically. Log in using the same credentials you use on your production site.

You’ll see a Staging Site badge in the admin bar. That’s how you know you’re working in staging and not on your live site.

Now run the WordPress update on staging first. If something breaks, you find out here before any of your visitors do. Once staging looks clean, go back to production and repeat the same updates there.

Duplicator’s one-click staging is available on Pro and Elite plans. If you’re using the free version, you can upload a backup into a local development environment like LocalWP, WAMP, or XAMPP and test the update there.

How to Update WordPress

If you’re new to WordPress, here’s how to update your website.

Update WordPress Themes and Plugins

As a WordPress website owner, you’ll have to regularly update three parts of your site:

• Core WordPress software
• Themes
• Plugins

If you go to the Updates page on your dashboard, you’ll see what needs to be updated. For both plugins and themes, you can bulk-select them and install the new versions.

There will also be notifications on your Plugins and Themes pages. You can view information about the new update and hit Update Now.

This allows you to update each one individually.

Additionally, you could enable auto-updates so you don’t have to worry about keeping all of your WordPress plugins and themes up to date. 

Updating your theme could delete any customizations you’ve made to it. To solve this problem, consider creating a child theme. 

Update WordPress Core Files

Now that you’ve updated your themes and plugins, it’s time to update your WP core files. I’ll show you two different methods, so you can keep your site secure no matter your experience level.

• Method 1: Admin Dashboard Update: One-click update from WordPress Updates page (recommended for most users)
• Method 2: Manual FTP Update: Download and upload files via FTP client for advanced users or when dashboard method fails

Method 1: Update WordPress Version in Your Admin Dashboard

One way to update WordPress is through your wp-admin dashboard. When there’s a new major version of WordPress, you’ll see it at the top of the Updates page.

Simply click on the Update to version X.X.X button to start the update. While the software is installed, your site will temporarily go into maintenance mode.

After this, you’ll be directed to a welcome screen. Depending on the update, you may see some descriptions of features or functionality that weren’t available in the previous version. 

When you re-visit the Updates page, you’ll see that you have the latest version of WordPress.

After this core update, you can continue to manage your website, knowing that it’s fully secure!

Method 2: Manually Update WordPress Version

I’d recommend using the one-click update on the WordPress admin screen for any WordPress upgrades. However, this may not work or you might prefer to update WordPress manually.

You can also update your website by manually uploading the new version of WordPress to a File Transfer Protocol (FTP) client or File Manager.

Go to WordPress.org and download the latest version available.

This will save a zip file with the WordPress update to your computer. Extract the zip file. You’ll see a folder named wordpress with all the files for the new update.

Then, open an FTP client and connect your website. For this tutorial, I’ll be using FileZilla, which is a free FTP/SFTP tool.

You’ll see your site’s core files under the public_html directory in the right-hand box. In the Local site box, open the wordpress folder, select all the files, right-click, and hit Upload.

The new WordPress update will move from your computer to your website. Since you’ll already have the same files, select Overwrite and Always use this action.

After this, the older versions of your WordPress files will be replaced with updated versions. Once this is done, open your admin dashboard. Sometimes, you’ll need to also update your database.

In this case, simply click Update WordPress Database. This will fully update your website!

What to Do After Updating WordPress

The update is done, but you’re not finished. These steps take five minutes and catch the issues that don’t show up immediately.

Re-enable and purge your caching plugin

Reactivate whichever caching plugin you paused before the update. Then open its settings and purge all cached files. This forces WordPress to serve fresh pages built from the updated files, not cached versions from before the update.

If you skip this, you or your visitors might load a cached page that looks fine while an underlying error sits underneath it.

Test your site in a private browser window

Open an incognito or private window to bypass your own browser’s cache. Visit your homepage, click through to at least two or three internal pages, and check that navigation, images, and layouts look right.

Then test whatever matters most for your site specifically.

• For a blog: load a post and confirm comments work.
• For a business site: submit a contact form and check that the confirmation message appears.
• For a WooCommerce store: add a product to the cart and step through checkout up to the payment screen without completing it.

Frequently Asked Questions (FAQs)

Keep Your Site Thriving with Regular Updates

You just updated your WordPress site to the latest version!

Remember, this isn’t a one-time task. It’s the beginning of a healthy maintenance routine that will keep your site secure, fast, and feature-rich.

Set a monthly reminder to check for updates, and you’ll never have to worry about falling behind on security patches or the latest features.

Need to quickly back up your site before updates? Download Duplicator Pro to protect your site from data loss!

While you’re here, I think you’ll like these extra WordPress guides:

• How to Downgrade Your WordPress Version and Revert Bad Updates
• 9 Best WordPress Maintenance Services For Easy Site Management
• How to Update WooCommerce (Without Breaking Your Online Store)
• How to Update Your WordPress Theme and Keep Your Customizations
• 11 WordPress Maintenance Tasks You Won’t Want to Forget