--- gravity_agent_document: 1 document_type: "page" page_id: "page:tips/update-plugins-weekly-but-wait-on-major-releases" representation_of: "https://www.websitemanual.com.au/tips/update-plugins-weekly-but-wait-on-major-releases/" canonical_html: "https://www.websitemanual.com.au/tips/update-plugins-weekly-but-wait-on-major-releases/" title: "Update plugins weekly, but wait on major releases | Website Manual" summary: "A weekly update day keeps a WordPress site safe. The exception is a big new version of a plugin: let a few fix releases come out first." language: "en-AU" page_role: "page" content_intents: [] source_hash: "sha256:52c9b804c353cb52503a21ff5b937ec9f03e238445b6123edb2748f02dc9d014" primary_entities: [] entity_refs: [] relationships: [] --- # Update plugins weekly, but wait on major releases | Website Manual **Update plugins weekly, but wait on major releases** A weekly update day keeps a WordPress site safe. The exception is a big new version of a plugin: let a few fix releases come out first. - Tip · WordPress - By Daniel Doherty, MerlinFX - 8 November 2026 ## TL;DR Update your plugins once a week. When a plugin jumps to a new major version, like 3.0, skip it for now and wait until a few fix releases are out (3.0.4 or 3.0.5) before you update. WordPress core security releases are the opposite: install them as soon as they come out. ### Why weekly Plugin developers fix bugs and security holes all the time, and the fix only protects your site once it’s installed. Leave updates for months and the site runs with holes that are already public. A set day each week keeps the job small: a few updates at a time, and a quick look at the site afterwards. That’s how we update every client site we look after on WordPress. ### Why we wait on major releases A major release (3.0, 4.0 and so on) changes more code at once, so it’s the release most likely to break something: a layout, a form, a clash with another plugin. The first few fix releases after it usually sort those problems out. So when a plugin offers a new major version, we hold that one update back and keep updating everything else as normal. Once a few fix releases are out, say 3.0.4 or 3.0.5, we install it. ### The exception: WordPress core security WordPress core security releases go on as soon as they’re available, because the problem they fix is public from the moment they come out. WordPress usually installs these minor core releases for you. ### Your web developer should be doing this If someone built your website or looks after it for you, keeping the plugins and WordPress up to date should be part of their job. Ask them to make sure it is. That’s how it works for MerlinFX clients: we update and manage every plugin, keep WordPress current and look after the site’s security, so our clients don’t have to do any of this themselves. ### If you look after your own site Here’s the weekly routine: 1. Take a backup, or check your host made one today. 2. Go to **Dashboard**, **Updates**. 3. Update every plugin, except any plugin that’s offering a new major version. 4. Check WordPress itself is on the latest version. 5. Open the home page and a page with a form, and make sure they still work. ### Questions **How do I tell a major release from a small one?** Look at the version number. When the first number changes (2.9 to 3.0), it's a major release with new features and bigger changes. When only the last number changes (3.0.4 to 3.0.5), it's a fix release. Some plugins also count a jump like 4.2 to 4.3 as major, so read the changelog if you're not sure. **What if the major release fixes a security problem?** Then don't wait. If the changelog or the plugin's announcement mentions a security fix, update straight away and check the site afterwards. **Do I need to do anything for WordPress core security updates?** Usually not. WordPress installs minor core releases, which carry the security fixes, automatically unless someone has turned that off. Check Dashboard, Updates every week to make sure the site is on the latest version. **Should I take a backup before updating?** Yes. Take a backup or make sure your host has one from today, so you can roll back if an update breaks something. MerlinFX client? [Ask for this done and recorded on your own site](https://www.websitemanual.com.au/request-a-recording/#request). ### More tips [Tip · Website care Delete form entries from your website automatically Every form someone fills in on your site is also saved in its database. Set your form plugin to delete entries after a few days, so a hack has less to steal. Article](/tips/auto-delete-form-entries-from-your-website/) [Tip · WordPress Delete the WordPress themes you don't use Most major WordPress updates install the year's new default theme. If your site runs on Astra and a child theme, delete the extras so your theme list stays clean. Article](/tips/delete-the-themes-you-dont-use/) [Tip · Website Manual Teach someone your website with one link Got a new team member to show around your website? Save the videos they need, share the list, and they open one link and start watching. Article + 3 videos](/tips/train-a-new-team-member-with-a-saved-list/)