More than you realize.
A WordPress website is not a “set it and forget it” website. It’s got “moving” parts. First, you have the core software, WordPress, but then have plugins. Most WP sites we do have many plugins. My new website “blueprint” for any new site starts with ten active plugins, and depending on the complexity of the site, could go up a lot from there.
So say you have WordPress installed, and conservatively say you have 5 plugins. That’s six different things that will, at one point or another, have updates available that need to be run. Why? Because these updates often patch security issues that may arise.
WordPress is popular. It powers over 25% of the web. So it’s a huge target for hackers. The WordPress community does an excellent job of securing and updating the software, but part of the responsibility lies with the website owner. You have to login, you have to hit the update button.
I manage over 150 sites right now, and part of that management includes running updates. There is not a single day that goes by that I don’t have updates to run… usually many. Sometimes they are just compatibility updates, usability updates, or new features. But sometimes there’s security too.
A few years ago, a neighbor who wrote a blog mentioned to me that she was getting a lot of comment spam. I said, “I can fix that. Send me a login and I’ll take care of it for you.”
She did, and I logged in. And I was shocked at how old her WordPress version was. I was shocked at how many updates were available. In fact, not a single update had been done on this site since it was set up and the software was so old, you couldn’t even update it with the one-click option; it needed a manual update.
I emailed my friend and said, “Do you realize how many updates you have for this site that need to be done?”
She responded, “The guy who set it up told me I never needed to do those.”
And then my brain exploded.
I fixed her spam issue, and then I also updated all of her software and told her to keep doing the updates. My fingers get really twitchy if I login to a site and see updates available. My first instinct is to hit the update button.
It’s not hard to do.
It only takes a few minutes, but it does require you to login, look around, and hit that button.
But what if it breaks my site?
It could happen. This is the biggest reason people are hesitant to run updates. A lot of developers will tell you that you need to have a staging server running at all times to check that the updates don’t break your site. And that’s not bad advice. If you have a big website that has a lot of traffic, and you don’t want to risk it having an issue, then for sure, this is recommended. But for the majority of my clients, and for myself with so many sites to manage, it’s a lot of extra work to maintain a staging server to verify that every single update is going to work perfectly. If you are backing up your site every day (and you are, right? if not, that’s a post for another day), then I don’t worry too much about the updates breaking a site. I can always roll it back and see what’s going on – but the truth is, the vast majority of the sites don’t break when I run updates.
But I don’t want to have to do this? Can you do it for me?
Absolutely. Just sign up for one of our maintenance plans.
Amy Masson
Amy is the co-owner, developer, and website strategist for Sumy Designs. She's been making websites with WordPress since 2006 and is passionate about making sure websites are as functional as they are beautiful.