Recently, a colleague reached out to me for help. She had inherited a WordPress website where the content was up to date, but plugin and theme updates had been neglected. When she tried to update the plugins, it broke the website. She was able to get it restored and a test site set up, but she needed help figuring out how to make the updates safely.

I agreed to take a look to see if I could help. Here are the things I tried, what I learned, and what ended up being successful.

Test/Dev Website

Thankfully they had a cloned version of their website. This allowed me to try out solutions before we attempted them on the production website. If you don’t have a test/dev version of your WordPress website, get one if you can. Do your updates there first to make sure you don’t break your production website. If this is not an option, see if your host has an easy way to restore from a backup. This will allow you to restore the site to a version when it was still working.

Too Many Themes

The first thing I noticed was that they had installed almost 60 themes. 51 of them needed updates. You can only use one theme, so it didn’t make sense to have all of the extras. I recommended deleting the 51 she didn’t use. We did keep a few of the WordPress default themes because these can be good to revert to if you are troubleshooting a problem with a theme. While it can be useful to try different themes when you are developing a website, you should delete the ones you don’t end up using. Why? Because if any of these themes have a security issue, they are installed on your website and can potentially be a vector to compromising your website. They are also taking up storage space.

I then updated the theme they were actively using and the other WordPress Twenty* themes we were keeping. That all went well.

Delete Inactive Plugins

The next thing I noticed is that they had 17 inactive plugins. These were plugins that had been installed but were not being used anymore. Some of the updates were for these plugins. I recommended we delete the 17 plugins that were not actively being used. Again, these plugins are taking up storage space and are a security risk. You aren’t using them, so it is best to remove them. If you need them in the future, you can reinstall them.

Update Plugins and Rollback If Needed

Now that the unused themes and plugins were gone, I attempted to update the plugins one by one. They had the WP Rollback plugin installed. This plugin allows you to easily roll back plugins and themes to a previous version. I documented the versions they were using before making the updates. This allowed me to revert back to the version they had just been using if the update caused a problem. This is an important step, don’t leave it out.

I recommend updating plugins one by one and then testing the site. This allows you to know which one caused a problem. If you do them all at once, it will be harder to tell which one caused the issue. Sometimes the logs can help, but you may not have access to them.

I updated 23 plugins. Most of them went fine, but 4 crashed the front end of the website. I was able to use WP Rollback to roll back to the version they had been using which fixed the website, but they were still out of date.

Turn Off Plugins During the Update

I next decided to try to deactivate all of the plugins except WP Rollback and update the problematic plugins one by one again. That worked! I then reactivated the plugins and the site was working! Why did this work? I’m not 100% sure, but it was likely a plugin or code conflict. By turning off all of the plugins they were able to update without conflict during the update.

Update WordPress Core

WordPress was also out of date. I was not able to update WordPress core due to permission issues on the server. I contacted the system administrator who was able to help. He updated WordPress and the site was now up-to-date.

Rinse and Repeat

Now that we know what would work, we followed the same steps on the production website. We deleted the unused themes and plugins. We updated the plugins one by one. We turned off the plugins to update the problematic ones. We asked the system administrator to update WordPress.

Lessons Learned

WordPress is an amazing content management system. The extensibility through a robust repository of plugins and themes makes it very popular. However, it also takes care and maintenance. The more plugins you install, the more likely you are to have conflicts. Each piece of software is written by different programmers. They cannot account for everything else you have installed. Security issues happen, so it is critical to keep your software up to date.

Recommendations

• Get a test or development site to update and test your plugin and theme updates. On the test site, you may want to enable automatic updates. You will get an email every time a plugin or theme is auto-updated. Consider keeping a running list so you know what to revert back to if there is a problem.
• Only install what you really need. The more plugins you have, the more likely you are to have conflicts.
• Delete any themes and plugins you are not using.
• Only get themes and plugins from reputable sources including WordPress.org
• Update your plugins and themes regularly, at least weekly. If you have a test site, make sure they are working there first.
• Use a security plugin. I really like WordFence. The free version works very well. The paid version is even more robust.
• Keep an eye on your comments. This website had over 80,000 comments, most of them approved due to settings not requiring moderation. Use a spam plugin like Aksimet and require that all comments are moderated.

Managed Hosting Alternative

If this is all too much to worry about consider managed WordPress web hosting. OIT offers managed WordPress web hosting to UCI faculty, staff, and graduate students on our UCI Sites network. You are limited to the provided themes and plugins, but you have peace of mind that the software is up-to-date and secure. Every plugin and theme that is available has gone through code review and is supported by our hosting partner, CampusPress. If you need more control over what plugins and themes are available, you can also pay CampusPress to set up your own WordPress website or network.