You see the little red number on the Plugins menu. Three updates waiting. Your shop is busy this week, and the last time you clicked "update," the contact form stopped working for a day. So you leave it.

That is a reasonable instinct. It is also the one that gets sites into trouble, because some updates are not about new features. They close a hole.

The good news: you do not have to guess. Most updates can wait a few days. A few should not wait an hour. Here is how to tell them apart.

Why both choices feel risky

Updating can break things. A new version may not get along with your theme, another plugin, or an old PHP version. Sometimes the site shows an error. More often something quieter breaks: a form, a checkout button, a page layout.

Not updating is risky in a different way. When a plugin maker fixes a security problem, the fix is public. Anyone can read the changelog and see what was wrong. That is how attackers learn where to look. The longer you run the old version, the longer your site has a known hole.

So the real question is not "update or not." It is "how fast, and how carefully."

Check what the update is for

Open the plugin's page in your dashboard (Plugins, then "View details") and read the changelog. You are looking for one thing: does it mention security?

Words that mean yes: "security fix," "vulnerability," "XSS," "CSRF," "privilege escalation," "unauthorized access," "sanitize," "escape." If you see those, treat the update as a fix for a hole.

Words that mean it can wait: "new feature," "improved layout," "translation," "compatibility with WordPress 6.x."

If the changelog says nothing useful, that is a sign too. Some makers keep security notes vague on purpose, so ask the next question.

Check who can use the hole

Not every security fix is equally urgent. The question that matters most is who can use the problem:

  • Anyone on the internet, no login needed. Do not let it slide past this week; same day if you can.
  • Anyone with an account on your site, even a basic one (a customer, a subscriber). Update within a few days, sooner if your site lets visitors sign up.
  • Only admins or editors. Update this week. It is still a fix, but an attacker needs a way in first.

Next, ask whether attackers are already using the problem. If yes, treat it as "update today" whatever else is true. Watchfox AI marks a problem Today when, for example, attacks on it are confirmed.

What this week looks like

Here are real examples from the problems published this week. This week's list has 15 problems in 14 plugins and themes.

  • LiteSpeed Cache: anyone, with no login, could see shoppers' personal details from WooCommerce cart and checkout pages. Fixed in 7.9.2. Watchfox AI marks it "This week" because no attacks have been confirmed yet, but since no login is needed, update it as soon as you can test the site. LiteSpeed Cache also sits in front of every page, so a quick check of the site afterward is worth it.
  • WP Fastest Cache: anyone, with no login, could see private information from a cached page. Fixed in 1.5.4. Also marked "This week" on the list, but since no login is needed, update it as soon as you can test the site, in the same sitting as the other cache plugin if you run one.
  • GiveWP: someone with certain logged-in accounts on your site could make themselves an admin (the report does not say exactly which accounts). Fixed in 4.19.1.1 (the changelog lists it under Security). A donation site should update within a few days, then make a test donation.
  • Customer Reviews for WooCommerce: someone with a Contributor account (a role that can write posts but not publish them) could plant harmful code. Fixed in 5.127.0 (the changelog lists it under Security). If you have no Contributor accounts you do not trust, this one can wait a few days.

Two of these are caching plugins. Caching plugins change what every visitor sees, so they are among the more likely to cause a visible problem after an update. That is a reason to test, not a reason to skip.

Not sure which of your plugins are on a list like this? Watchfox AI checks your site every day and emails you only when a plugin needs fixing, with how urgent it is.
Try Watchfox AI free for 14 days

Update without the fear

When you decide to update, a few habits make it safe enough:

  1. Make sure you have a recent backup you could restore. If you do not have one, make one first. Your host may offer one-click backups.
  2. Update one plugin at a time, not all at once. If something breaks, you know which one did it.
  3. Open your site in a private window right after. Look at the home page, a normal page, and the part that makes you money: the contact form, the checkout, the booking page.
  4. Log in as a normal user if your site has accounts, and check that part too.
  5. If it breaks, go back. Restore the backup, or reinstall the previous version from the plugin's "Advanced View" page on WordPress.org. Then tell the plugin maker what happened.

A staging copy of your site, if your host offers one, is the best place to try the biggest updates first.

What WordPress does and does not catch for you

WordPress has been adding safety nets. Since version 6.3, if you manually update a plugin or theme and the update causes a PHP fatal error, the plugin is not switched back on, so the site is not left showing an error. Since WordPress 6.6, if a plugin's automatic update causes a fatal error on the home page, WordPress puts the previous version back and emails the site admin.

Notice what that check looks for: a crash. It does not notice a form that sends no emails, or a checkout button that does nothing. Those still need your own quick look.

When there is no update

Sometimes a problem is public and the maker has not released a fix. This week's list has three of those: Mobile builder, Slim Jetpack and Remove Google Fonts. Your choices then:

  • Turn the plugin off until a fix arrives, if you can live without it.
  • Replace it with another plugin that does the same job.
  • If you must keep it, limit who can log in, and watch for a fix.

Do not leave it running and hope. An unfixed problem with a public description is the worst combination.

What about auto-updates?

Automatic updates remove the "I forgot" problem. They suit plugins you trust, that are updated often, and that do not touch your money flow. A sensible middle ground: switch them on for small plugins and update the big ones by hand after a backup. Pick what fits how much time you have.

Do this today

  1. Open Dashboard, then Updates. Write down which plugins have updates waiting.
  2. For each, read the changelog and look for the word "security."
  3. Update security fixes first, one at a time, after a backup.
  4. Check your forms, checkout and login after each one.
  5. Leave feature-only updates for a quiet day this week.
  6. If a plugin has a public problem and no fix, turn it off or replace it.

You do not need to read security news every day to do this. Watchfox AI sends plain-English security alerts for WordPress: every day our AI reads the security news and emails you when a plugin on your site needs fixing. It never changes anything without your OK. When a plugin has a known security problem and a fix is out, its "Fix it now" button can update it for you after you confirm, saving a copy of the old files first and putting them back if the site stops working. Every site gets a 14-day free trial with no card needed, and there is a free plan for one site. If you would rather just read, the free Monday list brings you the week's new WordPress security problems in plain words. You can sign up on any page of watchfox.site.

Get told which updates matter, and how fast.
Install Watchfox AI free

First published on the Watchfox AI blog.