Support
Support

90 seconds to find lost revenue: agencies’ WordPress update workflow

Back up the full site, then update from wp-admin or a staging copy, test the affected feature, and roll back if anything breaks. That’s the whole process. For low-risk plugins, a single click in the dashboard is enough. For anything touching payments, membership access, or page-building, run it through staging first and check the changelog before you click “update now.”

TL;DR:

  • Always back up your site fully before updating any plugin, especially for high-risk features like payments or memberships, and test updates in staging first.
  • Use the plugin’s changelog to identify potential breaking changes or requirements before proceeding with the update.
  • Enable automatic updates only for low-risk plugins such as security or SEO tools, while manually reviewing critical plugins like payment gateways and page builders.
  • After updating, thoroughly test specific features, like checkouts or forms, using real scenarios and verify no issues occur on both desktop and mobile.
  • Implement a structured workflow with weekly checks, immediate patching of vulnerabilities, and staged testing to maintain plugin hygiene and security.

Table of Contents

How do you update plugins in WordPress from the dashboard?

Most updates happen in seconds through wp-admin, and knowing both the single-plugin and bulk routes saves real time across a client portfolio.

For a single plugin, go to Plugins → Installed Plugins. Any plugin with an update waiting shows a note under its name reading “New version available.” Click “update now” directly beneath that notice, and WordPress fetches and installs the new files without you leaving the page.

Bulk updates work differently and matter more once you’re managing several sites with a dozen plugins each. Here’s the sequence:

  1. Go to Plugins → Installed Plugins and click the “Update Available” filter link at the top of the list.
  2. Tick the checkbox next to each plugin you want to update, or tick the header checkbox to select all of them.
  3. Choose “Update” from the Bulk Actions dropdown.
  4. Click “Apply” and let WordPress process the batch.
  5. Keep the browser tab open until the process finishes. WordPress works through each plugin in sequence, and closing the tab mid-update can leave one in a partially updated state.

You can also update from Dashboard → Updates, which shows a consolidated view of core, plugin, and theme updates in one place. This is useful when you want a single screen showing everything that’s outstanding, rather than jumping between menus.

Once the process completes, confirm two things. First, check the version number listed under each plugin now matches the version stated in the changelog. Second, confirm the “update available” notice has actually gone from the plugin row. Occasionally the admin screen caches the old state for a moment, particularly on sites running full-page caching, so a hard refresh clears up any confusion about whether the update actually landed. This official flow is documented in WordPress’s own plugin management guide, which also flags the backup step you should never skip.

What should you check before you update a plugin?

The update itself takes seconds. The damage from skipping preparation can take days to undo, which is exactly why a short pre-update routine earns its place every time, particularly on client sites where downtime means an angry phone call.

Run through this before touching the update button:

WP Remote’s update safety guidance makes the same point agencies learn the hard way: staging isn’t optional caution for high-risk plugins, it’s the difference between a five-minute update and a five-hour recovery.

Pro Tip: Screenshot the plugin’s changelog page before you update, not after. If something breaks, you’ll want that text in front of you rather than hunting through a version history that’s already moved on.

Should you turn on automatic plugin updates?

WordPress has supported per-plugin automatic updates since version 5.5, and the toggle sits right next to each plugin on the Plugins → Installed Plugins screen. Turn it on, and WordPress checks for and applies updates on its own schedule, then emails your admin address a summary of what changed.

The judgement call is which plugins get that toggle switched on. A rough split that holds up across most agency portfolios:

WP Remote’s guidance backs this split directly, recommending automation for low-risk utilities while keeping business-critical plugins on a staged, human-reviewed process. For agencies, that means auto-updates handle the background noise while your team’s attention goes to the handful of plugins that could actually take a client site down.

How do you update plugins manually via ZIP, SFTP, or WP‑CLI?

Manual methods matter when wp-admin isn’t available, or when you’re working with a premium plugin bought outside the WordPress.org repository.

ZIP upload works through Plugins → Add New → Upload Plugin. Select the new ZIP file from the vendor, and WordPress will usually prompt you to replace the existing version. Be cautious with vendor ZIPs that don’t clearly state a version number in the filename. It’s easy to re-upload the same version by mistake and assume nothing changed.

SFTP gives you direct file control. Download and keep a copy of the current plugin folder before uploading the replacement, and make sure the new folder keeps the exact same name as the old one, or WordPress will treat it as a separate plugin entirely. If a plugin is misbehaving and you can’t reach wp-admin, renaming its folder via SFTP disables it instantly.

WP‑CLI suits teams with SSH access managing several sites:

  1. wp plugin update <slug> updates one named plugin.
  2. wp plugin update --all updates everything with an available update.
  3. wp plugin update --all --exclude=<slug> updates everything except plugins you want to hold back.
  4. Wrap the command with wp maintenance-mode activate beforehand and wp maintenance-mode deactivate afterwards, so visitors see a holding page rather than a half-updated site.

The full command set is documented in the WP‑CLI plugin command reference.

What should you test right after updating a plugin?

Test the actual feature the plugin controls, not just whether the site loads. A homepage that renders fine can still be sitting on a broken checkout or a form that silently fails to send.

What do you do when a plugin update breaks the site?

Start with the simple fix: refresh the admin screen. Occasionally the WordPress UI lags a step behind what’s actually installed, and a hard refresh clears the confusion before you assume something’s broken.

If wp-admin itself won’t load, connect via SFTP and rename the plugin’s folder inside /wp-content/plugins/. That disables it immediately without needing dashboard access, and the site should come back.

From there:

How should agencies build plugin hygiene into their workflow?

The plugins causing the most late-night calls are usually the ones nobody remembers installing. Ruthless hygiene beats reactive firefighting every time: delete anything unused, and where a plugin’s last update was years ago, replace it with an actively maintained alternative before it becomes a liability.

Plugin modules sorted through maintenance workflow

Speed matters more than most agencies assume. Research from ManageWP found a median time to first mass exploitation of roughly five hours once a vulnerability goes public, and 46% of disclosed vulnerabilities had no fix available at the time. That’s why security patches need same-day attention, not a place in next week’s update queue.

A workable cadence for agency portfolios:

Wpcto’s own update checklist walks through this in more depth. If you’re not sure how much recurring revenue this kind of process is already leaving on the table across your client base, the WordPress Profit Calculator will show you in under 90 seconds.

Pro Tip: Keep a shared spreadsheet of every plugin your agency has ever disabled for being unreliable. The next account manager who inherits that client won’t reinstall the same problem two years later.

Marcel’s quick take: what agencies learn the hard way

Most emergency out-of-hours calls trace back to the same root cause: an update went out with no backup, no staging, and no test afterwards. A routine doesn’t just prevent the outage, it removes the panic decision-making that turns a ten-minute fix into a three-hour one.

Outsourcing to a managed partner tends to make sense the moment update-related firefighting starts eating into billable hours. Train account managers to flag “we’ll fix it later” requests immediately. Those are the ones that come back as Sunday emergencies.

— Marcel

How Wpcto removes plugin-update risk for agencies

Wpcto is the alternative to absorbing plugin updates into your own team’s week. Every update we run goes through a backup, a staging test where the plugin warrants it, and verification against the site’s actual features, not just a version number ticking over.

Wpcto

That’s backed by proper monitoring, a documented emergency support process, and Service Level Agreements that mean a security patch doesn’t sit in a queue for five days while attackers move in hours. Agencies who white-label this through us keep the client relationship and the recurring revenue, while we handle every ticket, update, and out-of-hours fix in the background.

If you want to see what that’s actually worth in numbers, run your client list through the WordPress Profit Calculator. It takes under 90 seconds and shows exactly how much uncaptured revenue is sitting in the maintenance work you’re currently doing for free. From there, take a look at our white-label support services and get in touch about handing your update workload over entirely.

Sources

Secret Link