Do not treat a hacked site as a routine update
If malware, unknown administrators, redirects or malicious files are present, preserve evidence and use a security-recovery process. Updating alone may leave backdoors or destroy useful traces.
Before updating
Create a recovery point and inspect compatibility
- Back up both website files and the database, and confirm where the backup is stored.
- Record the WordPress, PHP, active theme and important plugin versions.
- Check release notes and compatibility for premium themes and plugins.
- Obtain valid licences and current packages for premium components.
- Choose a low-impact maintenance window for a busy or transactional site.
Controlled update
Update one layer at a time
- Open Dashboard > Updates or use WP Toolkit in Plesk.
- Update supported plugins and the active theme, checking for errors between logical groups.
- Update WordPress core using the built-in one-click process when available.
- Complete any requested database upgrade once.
- Clear application and page caches.
- Remove abandoned components only after confirming they are not required.
Acceptance test
Check more than the home page
- Open the home page and several inside pages in a private browser window.
- Test login, navigation, forms, search and any checkout or payment flow.
- Check mobile layout, images, scheduled jobs and outgoing email.
- Review WordPress Site Health and the relevant PHP/web error log.
- Keep the pre-update backup until the site has run normally for an appropriate period.
If an update fails
Stop repeated retries and identify the failing layer
- Maintenance message remains
- Confirm no update is still running, then remove the stale .maintenance file only when safe.
- White screen or 500 error
- Read the PHP error log and disable only the component named by the error.
- Layout breaks
- Clear caches, then check the active theme and page-builder compatibility.
- Admin inaccessible
- Use WP Toolkit recovery or restore the verified backup instead of guessing in production.
- Very old installation
- Plan staged core, PHP, theme and plugin changes; a single jump may combine several incompatible changes.
Automatic updates still need backups and monitoring
They reduce exposure to known vulnerabilities but can reveal compatibility problems. Enable them selectively and make sure failed-update notifications reach someone who will act.
Need WordPress maintenance or recovery help?
Send the domain, current WordPress and PHP versions, failing component, exact error, last successful backup and changes already attempted. For a hacked site, use the security-recovery route rather than routine upgrade assistance.
Ask the WordPress team