Patching without breakage
WordPress Update Management: Patching Without Breakage
Hand over WordPress updates and stop choosing between an unpatched site and a broken one. Core, plugins and themes are applied to a staging copy every week, the paths that earn money are tested, and only then does the live site move. 100+ sites on this cycle.
Get a free written site audit
Send the address and we return a written report inside one working day: patch backlog, exposure, load timings, restore status.
- Every update tested on a staging copy before it reaches the live site
- Checkout, booking and contact forms tested — not just that the homepage loads
- A plugin that breaks stays back, and you are told which one and why
- Rollback from a backup that is minutes old, not from last night
What this covers
- WordPress core, minor and major releases
- Plugin updates, including paid plugins with your licence keys
- Theme updates, with child-theme overrides preserved
- PHP version upgrades, tested before the host forces them
- Staging copy built and refreshed for every cycle
- Post-update testing of checkout, forms and login
- Rollback if anything regresses
- A monthly log of what was updated, held back, and why
Why the staging step is the whole service
Anyone can press the update button. The service is what happens around it.
The failure mode we see most often on sites arriving from elsewhere is not an unpatched site — it is a site that was updated automatically, broke somewhere nobody looks, and stayed broken. A booking form that stopped emailing. A checkout that fails on one payment method. These do not throw errors; they just quietly stop earning.
What we test after every batch
- Checkout, end to end, on every enabled payment method.
- Every form that sends mail, confirming the mail actually arrives.
- Login, including two-factor.
- Search and key templates, with a visual diff against the previous build.
- Server response time, because a plugin update that adds 400ms is a regression even when nothing visibly breaks.
The same sequence, written out so you can run it yourself, is in the guide to updating WordPress without breaking the site. Doing it in-house costs the staging environment and the testing time rather than the licence, which is the arithmetic on maintenance plans and pricing. Patching is one half of keeping a site out of trouble; the other is hardening and daily scanning, and both sit inside WordPress maintenance rather than being bought separately.
How the work runs
- We take the backup firstOff-site, verified restorable, before a single file changes. This is the step that makes everything after it reversible.
- Staging copy is refreshedSame PHP version, same data, same plugin set as production, so a pass on staging means something.
- Updates applied in batchesGrouped so that when something breaks we know what broke it. One batch of thirty tells you nothing.
- The money paths are testedCheckout, booking, contact, login, search. A visual diff catches layout regressions on key templates.
- Promote or holdClean batches go to production. A plugin that regresses stays back and gets a note in the report, not a silent skip.
- You get the logWhat moved, what did not, and what we are watching.
Plans that include this
- Starter$39/monthor $390 a year — two months freeBlogs, portfolios and brochure sites
- UpdatesMonthly
- BackupsWeekly, 30-day retention
- Uptime5-minute checks
- Malware removalNot included
- Most chosenProfessional$79/monthor $790 a year — two months freeSmall businesses and lead-generation sites
- UpdatesWeekly + PHP version management
- BackupsDaily, 60-day retention
- Uptime1-minute checks
- Malware removalIncluded
- Business$149/monthor $1490 a year — two months freeStores, membership sites, anywhere downtime costs money
- UpdatesWeekly, tested on staging first
- BackupsDaily, 90-day, multi-location
- Uptime1-minute + 2-hour restore
- Malware removalIncluded
What clients say
They found malware two of our previous agencies had missed, cleaned it in an afternoon, and told us exactly how it got in.
Operations Director, professional services, 4 sitesThe staging step is the whole point. Three years and not one update has taken our booking form down.
Practice Manager, healthcareWe resell it to 31 clients under our own brand. The reports go out with our logo and our clients have never heard their name.
Agency Founder, digital agency
Related pages
Questions people ask before calling
How often should WordPress be updated?
Security releases within days. Everything else on a weekly tested cycle. Monthly is too slow for plugin CVEs, and daily produces more breakage than it prevents.
Why not just turn on auto-updates?
They apply untested changes to a live site. For core security releases that trade is usually worth it; for thirty plugins with their own release schedules it is how sites break unattended.
What if a plugin update breaks the site?
It breaks staging, not production. The plugin stays on the working version, you are told, and we either wait for a fix or find a replacement.
Do you handle paid plugin licences?
Yes. We hold the keys or use yours, and we tell you before a licence lapses rather than after updates silently stop.
Will you upgrade PHP?
Yes, tested on staging first. Host-forced PHP upgrades are one of the most common causes of a site going down with no warning.