What actually needs updating
A WordPress site has four layers. Each is updated separately, and each is a way in if it falls behind.
- WordPress core. Small security releases install themselves on most hosts. Major versions do not — check for them within two weeks of release.
- Plugins. The most common way in. Every plugin comes from a different developer, and one neglected plugin is enough.
- Theme. Premium themes only update when the licence key is entered. Many sites built by freelancers run a theme without one — and never get its fixes.
- PHP version. Set in your hosting panel, not in WordPress. Old PHP versions stop getting security fixes; Tools → Site Health shows yours.
A weekly routine that takes fifteen minutes
Done every week, updates are small and boring. Left for six months, they are large and risky.
- Pick a quiet time. A weekday morning — not Friday night, and not the week before Hari Raya, Chinese New Year or a sale, when nobody can fix a problem quickly.
- Back up first. Take a fresh backup of files and database right before you update, even if a nightly one exists.
- Update in small batches. Small updates together; big version jumps (4.x to 5.0) one at a time, checking the site after each.
- Check the pages that earn money. Home page, contact form and WhatsApp button. For stores: add to cart, checkout and a test FPX or card payment.
- Write down what changed. One line in a shared note: date, what was updated, anything odd. When something breaks next week, the answer is there.
Plugins that need extra care
Most updates are harmless. These are the ones worth testing every time.
- WooCommerce and payment gateways. Update WooCommerce and your gateway plugin together, then make a test payment. A mismatch can quietly stop orders coming through.
- Page builders. Elementor, WPBakery and Divi updates can shift layouts. Check your key pages on a phone afterwards.
- Security and caching plugins. These touch every page. If the site goes blank after an update, they are the first to switch off.
- Abandoned plugins. If a plugin has not been updated in over a year, or has been closed on wordpress.org, replace it. It will not get security fixes.
Backups that actually restore
A backup only counts if you can get the site back from it. Most owners find out theirs is incomplete on the day they need it.
- Files and database, both. Content lives in the database; images, themes and plugins live in files. A backup missing either is half a site.
- Kept off the hosting account. If the account is hacked, suspended or cancelled, backups stored inside it go too. Keep copies in Google Drive, Dropbox or cloud storage.
- Daily, kept for 30 days. Hacks are often noticed weeks later. Thirty days of history lets you go back to before it started.
- Test a restore twice a year. Restore to a staging site or a spare folder and click through it. It is the only way to know the backup is complete.
- Know what your host keeps. Many Malaysian hosting plans include backups, but the number of days, whether email is included and whether restores cost extra vary. Ask in writing.
Try big changes on a staging site
A staging site is a private copy of your website. Updates that might break something are tried there first.
- Your host may already include one. Hostinger and many cPanel hosts can create a staging copy in a few clicks. Check your hosting panel before paying for a plugin.
- What to test there. Major WordPress versions, a new PHP version, a major WooCommerce release, or a new theme.
- Careful with online stores. Copying staging over a live store can wipe orders and customers that came in meanwhile. Repeat the tested update on the live site instead.
- Keep it private. Password-protect the staging copy and tick “Discourage search engines” in Settings → Reading, so it never shows up on Google.
When an update breaks the site
It happens to everyone eventually. With a fresh backup, it is a short problem rather than a lost week.
- Stop updating. Note what you just updated. Updating more on top makes the cause harder to find.
- Use the recovery email. On a white screen or “critical error”, WordPress usually emails the admin a recovery-mode link. Log in through it and deactivate the plugin that caused it.
- Roll back that one plugin. Install the previous version from the plugin’s wordpress.org page (Advanced view) or from your backup, then wait for a fixed release.
- Restore if you have to. If several things broke, restore the backup you took just before updating. That is what it was for.
Questions
How often should WordPress be updated?
Check every week. Security updates should go on within a few days — most hacks on small Malaysian sites use flaws that were fixed months earlier.
Should I turn on automatic plugin updates?
For small, well-maintained plugins, yes. Keep WooCommerce, payment gateways and page builders on manual, so you can test them first.
Is my host’s backup enough?
It is a good first layer, but it lives on the same account as the site. Keep a second copy somewhere your host cannot lose.
Which backup plugin should I use?
UpdraftPlus and similar plugins can send scheduled backups to Google Drive or Dropbox. Whichever you choose, test a restore.
Will updating break my site?
Occasionally, which is why you back up first and test the pages that matter. Not updating carries the bigger risk: an outdated plugin is how most sites get hacked.
What does CST charge?
Care plans from RM 100 a month cover updates, backups and someone who answers, on your own hosting. One-off fixes are RM 150 an hour.