Some people are very reluctant to update their sites – they fear, perhaps not wrongly, that their stuff will break.  So they stand on the deck of their slowly sinking ship (read – outdated website), afraid to step off into potentially shark-infested water.  Well, that is maybe not the best analogy – the newest version of WordPress or your updated themes and plugins are not shark infested water.  Probably.  I mean, they shouldn’t be.

As a brief practical aside, this is not a sustainable way to live your digital life.  You should pick reputable themes and plugins – and pay money for them, so they will be maintained and kept current.  Then you can update without worry.

All this is to say you should update when WordPress pushes out a new version, and you should update your themes and plugins.  But how quickly?  And what is the process to do it safely?

For years, WordPress (and therefore the attendant themes and plugins) averaged updates every 4 months, and, it seems to me, they usually try to time the big releases for the end or beginning of the year.

One school of thought is to immediately update on all minor releases, as those are only bug-fixes and security patches.  You can tell it’s a minor release by the 3rd digit – eg, 5.1.1. Some people wait on the major updates – eg, the latest 5.2 from last week.   Sometimes this is the sort of update to break your site, and sometimes, because these are bigger updates to a lot of WordPress files, there are errors.  And sometimes there is another update almost immediately afterward to fix those errors (please see the list of release dates for major updates and then the next minor update – they are often only separated by days).   So some people wait for that next minor after the major.

As stated above, I use only themes and plugins that I know are actively maintained and will work with the latest version of WordPress.  But I do like to update them on a staging site first.

For further reading:

Slightly dated but still great article on doing your research before clicking update.

Setting your automatic updates in the wp-config file

You know how the royal family has to travel separately, in order to mitigate risk to the line of succession?  Of course you do, it was the entire plot of King Ralph.  Keeping your domain and hosting separate helps to manage the risk that your site can be hacked.

Think about it – if someone hacks your site, at least they can’t take your domain as well (this is assuming they figured out the account user name and password with the host/registrar).  If they get your domain, that’s a little trickier, but at least your still have your site on the host.  And if your host’s backup of your files fails, at least you have a copy of your site in your DropBox, your Google Drive (and for the extra paranoid, a hard copy of your site on a usb stick, which was a brilliant idea I got from an InMotion support dude.  Not all heroes wear capes, guys)

You’ll also tend to feel kind of stuck if you want to transfer away from that host – and a lot of times those sweet first year hosting plans get pretty pricey the second year.  It doesn’t cost any more to register somewhere other than your web host, and you can just pick one domain registrar and then shop around for a plan to host your sites.  It’s a good habit to spread the risk around and make things harder for hackers.

Also consider two factor authentication and installing wordpress in a subdirectory.  These are simple steps but hackers go for low hanging fruit, so harden up your site, yo.