The short answer
Check updates every week — most hacks use a plugin flaw fixed months earlier.
Back up files and database right before updating, and keep copies off the hosting account.
Test the pages that earn money after every update: forms, WhatsApp, checkout and payment.
What actually needs updating
A WordPress site has four layers. Each is updated separately, and each is a way in if it falls behind.
WordPress core
Small security releases install themselves on most hosts. Major versions do not — check for them within two weeks of release.
Plugins
The most common way in. Every plugin comes from a different developer, and one neglected plugin is enough.
Theme
Premium themes only update when the licence key is entered. Many sites built by freelancers run a theme without one — and never get its fixes.
PHP version
Set in your hosting panel, not in WordPress. Aim for PHP 8.3 or newer — 8.2 stops getting security fixes at the end of 2026. Tools → Site Health shows the version you run.
A weekly routine that takes fifteen minutes
Done every week, updates are small and boring. Left for six months, they are large and risky.
Pick a quiet time
A weekday morning — not Friday night, and not the week before Hari Raya, Chinese New Year or a sale, when nobody can fix a problem quickly.
Back up first
Take a fresh backup of files and database right before you update, even if a nightly one exists.
Update in small batches
Small updates together; big version jumps (4.x to 5.0) one at a time, checking the site after each.
Check the pages that earn money
Home page, contact form and WhatsApp button. For stores: add to cart, checkout and a test FPX or card payment.
Write down what changed
One line in a shared note: date, what was updated, anything odd. When something breaks next week, the answer is there.
Plugins that need extra care
Most updates are harmless. These are the ones worth testing every time.
WooCommerce and payment gateways
Update WooCommerce and your gateway plugin together, then make a test payment. A mismatch can quietly stop orders coming through.
Page builders
Elementor, WPBakery and Divi updates can shift layouts. Check your key pages on a phone afterwards.
Security and caching plugins
These touch every page. If the site goes blank after an update, they are the first to switch off.
Abandoned plugins
If a plugin has not been updated in over a year, or has been closed on wordpress.org, replace it. It will not get security fixes.
Backups that actually restore
A backup only counts if you can get the site back from it. Most owners find out theirs is incomplete on the day they need it.
Files and database, both
Content lives in the database; images, themes and plugins live in files. A backup missing either is half a site.
Kept off the hosting account
If the account is hacked, suspended or cancelled, backups stored inside it go too. Keep copies in Google Drive, Dropbox or cloud storage.
Daily, kept for 30 days
Hacks are often noticed weeks later. Thirty days of history lets you go back to before it started.
Test a restore twice a year
Restore to a staging site or a spare folder and click through it. It is the only way to know the backup is complete.
Know what your host keeps
Many Malaysian hosting plans include backups, but the number of days, whether email is included and whether restores cost extra vary. Ask in writing.
Try big changes on a staging site
A staging site is a private copy of your website. Updates that might break something are tried there first.
Your host may already include one
Hostinger and many cPanel hosts can create a staging copy in a few clicks. Check your hosting panel before paying for a plugin.
What to test there
Major WordPress versions, a new PHP version, a major WooCommerce release, or a new theme.
Careful with online stores
Copying staging over a live store can wipe orders and customers that came in meanwhile. Repeat the tested update on the live site instead.
Keep it private
Password-protect the staging copy and tick “Discourage search engines” in Settings → Reading, so it never shows up on Google.
When an update breaks the site
It happens to everyone eventually. With a fresh backup, it is a short problem rather than a lost week.
Stop updating
Note what you just updated. Updating more on top makes the cause harder to find.
Use the recovery email
On a white screen or “critical error”, WordPress usually emails the admin a recovery-mode link. Log in through it and deactivate the plugin that caused it.
Roll back that one plugin
Install the previous version from the plugin’s wordpress.org page (Advanced view) or from your backup, then wait for a fixed release.
Restore if you have to
If several things broke, restore the backup you took just before updating. That is what it was for.
Quick answers.
01How often should WordPress be updated?
Check every week. Security updates should go on within a few days — most hacks on small Malaysian sites use flaws that were fixed months earlier.
02Should I turn on automatic plugin updates?
For small, well-maintained plugins, yes. Keep WooCommerce, payment gateways and page builders on manual, so you can test them first.
03Is my host’s backup enough?
It is a good first layer, but it lives on the same account as the site. Keep a second copy somewhere your host cannot lose.
04Which backup plugin should I use?
UpdraftPlus and similar plugins can send scheduled backups to Google Drive or Dropbox. Whichever you choose, test a restore.
05Will updating break my site?
Occasionally, which is why you back up first and test the pages that matter. Not updating carries the bigger risk: an outdated plugin is how most sites get hacked.
06The site works fine. Can I skip updates?
Working fine is how most hacked sites looked the week before. Updates close holes that are already public, and attackers scan for them automatically — small Malaysian business sites included.
07What does CST charge?
Care plans from RM 100 a month cover updates, backups and someone who answers, on your own hosting. One-off fixes are RM 150 an hour.
Related guides
Guide 04 · Hacked website
Website hacked? What to do first — a Malaysian guide
9 min read
Guide 02 · Hosting & domains
Hosting and domains in Malaysia: .com or .com.my?
8 min read
Guide 02.2 · Business email
Business email on your own domain: Google Workspace, Microsoft 365 or hosting email
8 min read
“He explains things in plain language. No jargon, no upselling. I always know what I am paying for.”