If you run a WordPress site for your business, you’ve seen the update badges pile up in the dashboard. Core updates, plugin updates, theme updates — sometimes a dozen at once. So how often update WordPress properly without breaking your site or leaving it open to attack? This guide gives you a plain-English schedule built for Australian small business owners, with real 2026 security numbers behind every recommendation.
The short version: updates aren’t optional, but they’re also not all equal. Some need to go on within hours. Others should sit on a staging site for a week first. Getting the timing right is the difference between a site that runs quietly and one that ends up defaced or offline.
So how often should you update WordPress?
For most small business sites, a good baseline is: apply security updates within 24–72 hours, review plugin and theme updates weekly, and schedule major version changes for a quiet window after testing. That single habit puts you ahead of the overwhelming majority of sites that get hacked.
Here’s the routine broken down by component.
| Component | How often | Why |
|---|---|---|
| Core security/minor releases | Within 24–72 hours | Patch known, actively targeted flaws |
| Core major versions | Within 1–2 weeks, after a staging test | Bigger changes can clash with plugins or themes |
| Plugins (security) | Immediately | Plugins are the number-one attack surface |
| Plugins (features) | Weekly, in small batches | Easier to spot what broke something |
| Themes | Weekly review; security fixes straight away | Fewer updates, but still a real risk |
| Full backup | Before every update, plus daily automated | Your safety net when an update goes wrong |
The rest of this article explains the reasoning, because the “why” is what helps you make the call when a specific update looks risky.
WordPress core: minor updates vs major versions
WordPress splits its releases into two types, and they deserve different treatment.
Minor releases (like the 6.9.1 maintenance update that shipped on 3 February 2026) are almost always security and bug fixes. They rarely break anything, and they patch the exact holes attackers scan for. Apply these quickly — within a couple of days at most. WordPress can even install them automatically, and for minor releases that’s usually a safe default.
Major versions (6.8 to 6.9, for example) introduce new features and bigger changes under the bonnet. These are the ones that can occasionally clash with an older plugin or a custom theme. You don’t need to rush them. Give it a week or two, update a staging copy of your site first, click through your key pages and forms, then push it live during a quiet trading period. If you’re on decent managed WordPress hosting, a one-click staging environment is usually built in.
One rule holds regardless of version: update core before plugins and themes where you can. It keeps everything talking to the same foundation and cuts down on conflicts.
Plugins are where the real risk lives
If you take one thing from this article, make it this. The threat to your WordPress site is almost never WordPress itself — it’s the plugins.
The 2026 data is stark. Across the year, 91% of newly disclosed WordPress vulnerabilities were found in plugins and about 9% in themes, while WordPress core accounted for a tiny handful. Security researchers logged more than 250 new plugin vulnerabilities every week, and over 80% of hacked WordPress sites were running an outdated plugin or theme at the time. Vulnerability disclosures have climbed sharply year on year, and a meaningful share of flaws can be exploited without the attacker even needing to log in.
That’s why plugin security updates get the “immediately” treatment. When a plugin you use ships a security patch, the clock is already running — attackers reverse-engineer patches to find the very hole they fix. Roughly a quarter of disclosed flaws still sit unpatched a month later, so the gap between “update available” and “update installed” is exactly the window a bot is looking for.
Feature updates are calmer. Batch those into a weekly review, ideally five or six plugins at a time so that if something misbehaves, you know which one to blame. And run a plugin audit each quarter: list every active plugin, check when it was last updated by its developer, and delete anything you’re not actually using. Every plugin you remove is one less thing to patch and one less door to lock.
What about themes?
Themes follow the same logic as plugins, just with a smaller footprint. You’ll see far fewer theme updates, but when a security fix lands, treat it with the same urgency.
The big win with themes is housekeeping. WordPress ships with default themes you’ll never use, and old sites accumulate abandoned ones. An inactive theme still contains code that can be exploited, so delete every theme except the one you’re running and a single default fallback. Fewer files on the server means a smaller attack surface and a faster site — which also helps your SEO, since page speed feeds into rankings.
Should you turn on automatic updates?
This used to be simple advice: switch everything to auto-update and forget about it. In 2026 the answer is more nuanced.
Automatic updates are still the right call for WordPress core minor releases and for trusted, well-maintained plugins on a small site with no custom code. They close the patch-delay gap without you lifting a finger.
But 2026 also brought a sharp reminder that auto-updating everything isn’t a silver bullet. In a supply-chain attack earlier in the year, some sites were compromised precisely because they auto-installed a poisoned update from a source they trusted. The lesson isn’t “stop updating” — it’s that blind automation carries its own risk. For plugins that touch payments, memberships or anything custom-built, a human eye on each update is worth the few minutes it takes.
A sensible middle ground for most Gold Coast businesses: auto-update core minor releases and low-risk plugins, but manually review anything critical, and always keep a fresh backup so you can roll back fast if an update misbehaves.
A safe update routine you can actually keep
Good intentions fade. A routine sticks. Here’s one that works for a busy owner:
- Back up first, every time. A full file and database backup before any update, plus automated daily backups running in the background. A tool like Cloudflare sitting in front of your site adds another layer, but backups are the non-negotiable.
- Read the changelog. Thirty seconds checking what an update changes tells you whether it’s a quick security fix or a big feature release that needs testing.
- Test major changes on staging. Never learn that an update broke your checkout by watching it break on the live site.
- Update in the right order. Core, then plugins, then themes.
- Click through afterwards. Load your homepage, a key service page, and your contact or booking form. Confirm the important stuff still works.
- Log it. A simple note of what you updated and when makes troubleshooting far easier later.
None of these steps are hard. The trouble is remembering to do them consistently while you’re running a business — which is exactly why so many owners let updates slide until something goes wrong.
What happens when you don’t update
A quick, real-world scenario. A Gold Coast retailer we spoke with hadn’t touched their WordPress dashboard in eight months — the site “was working fine”. A contact-form plugin they’d installed years earlier had a known vulnerability, patched by its developer six months prior. A bot found the unpatched version, injected spam redirects, and Google flagged the site with a “deceptive site” warning. Traffic collapsed overnight.
The fix wasn’t complicated once we were in — update everything, remove the malware, request a review from Google. But the site sat penalised for the better part of two weeks, right through a sale period. An update that would have taken 60 seconds cost them real revenue. That’s the true price of “I’ll get to it later”.
When to hand updates to someone else
Plenty of owners simply don’t have the headspace to babysit updates, and that’s a fair call. If updates are the thing that always slips, a website maintenance plan takes it off your plate — someone tests and applies updates on a schedule, keeps backups running, and watches for the security patches that matter. It also pairs well with proper website security monitoring so problems get caught before they cost you customers.
If you’d rather keep it in-house, at least get the foundations right: a reliable host, daily backups, and a recurring calendar reminder. And if your site is showing its age or feels slow and fragile every time you touch it, that may be a sign it needs a rebuild rather than another patch — our Gold Coast web design team can tell you which. A well-built site is far less stressful to keep current, and it protects the investment you’ve made in Google Ads and organic traffic by keeping your landing pages online.
The bottom line
Updating WordPress isn’t about chasing every badge the moment it appears — it’s about matching urgency to risk. Security patches for core and plugins go on within hours to a couple of days. Major versions get tested first. Themes get the same care as plugins, and unused ones get deleted. Back up before every change, and you’ll almost never get burned. Do that consistently and your site stays in the safe majority, not the 80% of hacked sites running something they should have updated months ago.
Not sure your current setup is holding up? A quick health check will tell you where you stand, and if you would rather run updates yourself with confidence, our WordPress training Gold Coast sessions cover exactly that.
FAQs
How often should you update WordPress?
Update WordPress security and minor core releases within 24–72 hours, review plugin and theme updates weekly, and schedule major version updates for a quiet window after testing on staging. Security patches should always go on fast, because attackers actively target known, unpatched flaws. Feature updates can be batched. Always take a full backup before any update.
Do WordPress updates happen automatically?
WordPress can install minor core releases and, if enabled, plugin and theme updates automatically. In 2026, auto-updating core minor releases and low-risk plugins is still sensible, but security experts now recommend manually reviewing critical or custom plugins after a supply-chain attack showed that automated updates can occasionally carry risk. Keep backups so you can roll back quickly.
Can updating WordPress break my site?
Yes, occasionally an update can clash with an older plugin, a custom theme or outdated code. This is why you back up before every update and test major version changes on a staging copy first. Minor and security updates rarely cause problems. The bigger, more common risk by far is not updating and leaving a known vulnerability exposed.
Why are WordPress plugins a security risk?
Plugins are the main attack surface because most WordPress vulnerabilities live in them rather than in core. In 2026, roughly 91% of newly disclosed WordPress flaws were found in plugins, with more than 250 new plugin vulnerabilities logged each week. Keeping plugins patched, removing unused ones, and auditing them quarterly dramatically lowers your risk.
Should I update WordPress plugins immediately?
Apply plugin security updates immediately, because attackers reverse-engineer patches to exploit the exact flaw being fixed, and about a quarter of disclosed vulnerabilities remain unpatched a month later. Feature-only updates are less urgent and can be batched into a weekly review, ideally a few plugins at a time so any conflict is easy to trace. Back up first.
What happens if I never update WordPress?
An un-updated WordPress site accumulates known vulnerabilities that bots actively scan for and exploit, leading to malware, spam injections, defacement or a full compromise. Over 80% of hacked WordPress sites were running outdated plugins or themes. Beyond the cleanup cost, Google may flag an infected site, causing search rankings and traffic to collapse until it’s fixed and reviewed.
