Two extremes, both expensive: I do not update so it will not break (then you get hacked through an old hole) and clicking Update All live on Friday afternoon (then it breaks). The middle is a system.
The right order
- 1. A backup — files plus database. No exceptions. Five minutes.
- 2. Plugins first, one at a time — update, refresh the site, check; then the next. If it breaks, you know exactly which.
- 3. Then the theme — if it was edited manually, your changes get wiped (that is what a child theme is for)
- 4. The WordPress core last
- 5. A check — homepage, contact form, cart and checkout if you have a store
When staging exists — use it
Staging is a copy of your site where you test without risk. On our plans it is created in a minute; you update there, verify, then push. For stores this is not a luxury — it is standard.
Automatic updates: yes or no
Small security updates to the core — yes, leave them on. Major versions and plugins — manually, when you are at the screen, not at 3am. Auto-updating everything on a store is a recipe for a Sunday surprise.
If it breaks
Do not panic: restore the backup (or deactivate the last plugin via File Manager) → the site returns. Then investigate on staging.
Rhythm
Once a week is enough for most sites. Stores — more often. And always read what an update changes if the plugin is critical (payments, delivery).
With us: updates, staging, backups and monitoring are part of maintenance — you do not even have to think about it.