How to handle WordPress plugin updates without breaking your site
WordPress plugin updates are the most routine job on any site, and the one most likely to take it down. Skip them and you leave known security holes open. Click "Update all" without thinking and, now and then, you get a white screen, a broken checkout or a contact form that silently stops sending.
This guide gives you a routine that sits between those two extremes. It covers when to use auto-updates and when to update by hand, how to read a changelog, what to back up first, the order to update things in, what to do when WordPress plugin updates fail or break the site, and how to keep all of this manageable across many sites.
Why WordPress plugin updates matter (and why they break things)
Plugin updates bring security fixes, bug fixes and new features. Security fixes are why you can't ignore them: once a vulnerability is fixed and announced, attackers know what to look for on sites that haven't updated.
Updates break sites for a few predictable reasons:
- Conflicts between plugins. Two plugins load different versions of the same library, or one changes something another depends on.
- Version requirements. A new release needs a newer PHP or WordPress version than your site runs.
- Custom code or big releases. Your theme relies on something the plugin changed, or a major version reworks settings or data that don't migrate cleanly.
None of this is a reason to stop updating. It is a reason to update with a plan, so you notice problems quickly and can undo them.
Manual updates vs auto-updates
Since WordPress 5.5, the Plugins screen has an "Enable auto-updates" link next to each plugin. Turn it on and WordPress installs new versions of that plugin in the background, without you clicking anything. The official auto-updates documentation explains the details.
Recent WordPress versions add safety nets, such as recovery mode emailing the admin when a plugin causes a fatal error. They catch crashes, not a layout that quietly broke or a form that stopped sending.
| Auto-updates | Manual updates | |
|---|---|---|
| Security fixes | Applied quickly, even when nobody is watching | Only as fast as your routine |
| Control | Low: updates land whenever they're released | High: you choose the time and test afterward |
| Noticing problems | Later, often from a visitor or client | Straight away, because you're looking |
| Best for | Small, simple plugins with a good track record | Ecommerce, page builders, membership, forms, anything with custom code |
A sensible split: enable auto-updates for small, low-risk plugins (a cookie notice, a redirect helper) and update the critical ones by hand during a fixed window. If a plugin handles payments, logins or the layout of every page, be looking at the site when it updates.
Finer control with an update manager plugin
The built-in toggle is on or off per plugin. For more, such as delaying updates, blocking a specific plugin, or setting rules for core, plugins and themes in one place, use an update manager plugin. The best-known is Easy Updates Manager (many people search for it as "easy update manager"). It is free on WordPress.org with a premium version; check the plugin page for current features. Don't mix its rules with the built-in toggles.
Before you click Update: changelogs, backups and staging
Read the changelog
Every plugin on WordPress.org has a Changelog tab, and "View version details" on your Plugins screen opens it. You don't need to read every line. Look for:
- Version jumps. 4.2.1 to 4.2.2 is usually a fix. 4.x to 5.0 can change a lot.
- Words like "security", "fixed vulnerability" or "XSS". These updates go to the front of the queue.
- Words like "breaking", "removed", "deprecated", "requires PHP" or "migration". These go to staging first.
- "Tested up to". If the plugin hasn't been tested with your WordPress version, be more careful.
Take a backup you can actually restore
Back up files and the database right before updating, not last week. Keep at least one copy off the hosting server and make sure you know how to restore it. A backup you have never restored is a hope, not a plan.
Use staging for risky updates
A staging site is a private copy of your live site, and many hosts create one in a click. Run major versions and anything touching checkout, memberships or the page builder there first, check the important pages, then repeat the update on live.
The order to update things in
Order matters because plugins depend on WordPress and on each other. A routine that works for most sites:
- Back up files and database.
- Check PHP and WordPress requirements for any major plugin release.
- Update "parent" plugins first. If you run WooCommerce and WooCommerce extensions, or a page builder and its add-ons, update the main plugin, then the add-ons.
- Update the remaining plugins one at a time, or in small batches, starting with security fixes. If something breaks, you know which update caused it.
- Update themes, then WordPress core if a new version is waiting (check plugin compatibility with the new core version first).
- Clear caches (caching plugin, host cache, CDN).
- Test the homepage, a typical post, the main contact form, search, and checkout or login if the site has them.
When WordPress plugin updates fail or break the site
Either the update didn't install, or it installed and broke something. Handle them differently.
The update didn't install
- "Briefly unavailable for scheduled maintenance." WordPress creates a
.maintenancefile during updates. If the update was interrupted, the file can stay behind. Delete it from the site root by FTP or your host's file manager, then run the update again. - "Another update is currently in progress." WordPress sets a lock while updating. It normally clears itself after about 15 minutes; wait, then try again.
- "Could not create directory" or "Installation failed". Usually file permissions or a full disk. Check your hosting storage and ask your host to fix ownership of the
wp-contentfolder. - Download or timeout errors. Try again later, or upload the plugin zip manually under Plugins > Add New > Upload Plugin.
- Premium plugin won't update. Usually an expired license or a site not activated with the vendor.
The update installed and broke something
- Find the culprit. If you updated one plugin at a time, you already know. If you updated in bulk, check the error message, the recovery mode email WordPress sends to the admin address, or deactivate the recently updated plugins one by one.
- Get the site working. If you can reach wp-admin, deactivate the plugin. If you can't, rename its folder in
wp-content/pluginsby FTP or file manager; WordPress deactivates it automatically. - Roll back. Restore the previous plugin version from your backup or a rollback snapshot, or restore the whole site backup if the update also changed the database.
- Report it and hold. Post on the plugin's support forum with your WordPress, PHP and plugin versions, and turn off auto-updates for that plugin until a fixed version is out.
For the rollback step in more detail, including what to do when you have no backup, see our guide to rolling back WordPress plugins, themes and core.
How to manage plugins across many sites
On thirty sites, logging into each wp-admin to manage plugins takes a day. Agencies usually solve this with WordPress management plugins: dashboards such as ManageWP, MainWP or InfiniteWP that connect to each site through a worker plugin and apply updates in bulk, often alongside backups and uptime checks. Our guide to managing multiple WordPress sites covers how to choose one and a weekly routine to run with it.
Whatever tool you use, standardize: the fewer different plugins across your sites, the fewer different update problems you'll see.
Updating plugins by asking an AI assistant
If you use Claude or ChatGPT with WPMate, you can handle updates from the same chat. The free Mate Connector plugin lists a site's plugins and themes, and its read-only security audit reports pending updates. Applying updates needs the Mate Connector Pro add-on, included in the Pro and Agency plans.
With Pro, a plugin update works like this: the assistant says what it is about to change, the update waits until you approve it in the WPMate dashboard, and a rollback snapshot of the plugin is taken before it runs. If the new version breaks something, you ask the assistant to restore the snapshot.
Two limits: Pro restores the snapshot taken before the change (not any older version by number), and it isn't a backup. Keep regular backups and use staging for major releases.
Frequently asked questions
Should I turn on auto-updates for all WordPress plugins?
Not usually. Auto-updates suit small, simple plugins with a good track record. Update ecommerce, page builder, membership and form plugins by hand during a fixed window so you can test straight afterward.
Why are my WordPress plugin updates failing?
The common causes are a leftover .maintenance file from an interrupted update, an update lock that hasn't cleared yet, file permission problems, a full disk, connection timeouts or an expired premium license. The fixes for each are in the section above.
Is Easy Updates Manager still needed now WordPress has auto-updates?
For many sites, the built-in per-plugin toggle is enough. An update manager plugin is worth it if you want extra rules, such as delaying updates, blocking specific plugins or controlling core, plugin and theme updates from one screen.
Can WPMate update my plugins?
With the Mate Connector Pro add-on (Pro and Agency plans), yes. Each update waits for your approval in the WPMate dashboard and a rollback snapshot is taken first. The free Mate Connector can list plugins and report pending updates but doesn't change them.
Update plugins from chat, with a snapshot first
Connect your site free, see which plugins need updates, and upgrade to Pro when you want approved updates with rollback.
Create free account