Home / Guides / Website Security
Website Security · 4 min readHow to Keep a WordPress and PHP Site Patched and Safe
A plain-English routine to keep a WordPress and PHP site patched and safe: what to update, how often, how to test updates, and when to call for help.
To keep a WordPress and PHP site safe, you need a simple habit: back up, update WordPress, plugins, themes and PHP on a schedule, test, and remove what you don't use. This guide gives you a routine you can follow in under an hour a month.
Know the four layers you need to patch
Your site is a stack of parts, and each one gets its own updates:
- PHP, the language on the server that runs WordPress. Your host usually updates it.
- WordPress core, the main software.
- Plugins, the add-ons that give your site extra features.
- Your theme, which controls the design.
October 2026 showed why all four matter. PHP fixed two critical holes on October 21 (PHP.net, Oct 21 2026), WordPress put out security releases on October 6 and October 28 (WordPress.org, Oct 28 2026), and backup plugins had their own fixes. Updating only one layer would have left gaps. Our October roundup lists them all.
Step 1: Make backups you can trust
Before any update, you need a way back.
- Back up files and database.
- Keep copies off the server, for example in cloud storage.
- Keep several copies, not just the latest one.
- Test a restore every few months, on a copy of the site. A backup you've never restored is a guess.
Step 2: Stay on a supported PHP version
The PHP project only fixes certain versions. As of October 2026, supported versions get fixes, but PHP 8.1 and older get none (PHP.net, Oct 21 2026). PHP 8.2 stops getting security fixes on December 31, 2026.
How to check: in WordPress go to Tools, then Site Health, then Info, then Server (WordPress.org, Oct 21 2026). Before you switch to a newer PHP, check that your theme and plugins say they support it, and try it on a staging copy first.
Step 3: Update WordPress core quickly
WordPress security releases are small and meant to be installed fast. Most sites install them automatically. Check Dashboard, then Updates, once a week to make sure. Big version jumps (for example a new major version) deserve a staging test first.
Step 4: Keep plugins and themes lean and current
- Update weekly. Plugin holes are common, and fixes only help once installed.
- Delete what you don't use. A deactivated plugin still has files on the server.
- Avoid abandoned plugins. On the plugin's page at WordPress.org, check when it was last updated and which WordPress version it was tested with.
- Only install from trusted places, like the WordPress.org directory or the maker's own site. Never use "free" copies of paid plugins.
Step 5: Test updates on a staging copy
A staging site is a private copy of your website. Many hosts make one with a click. Update there first, check your key pages, then update the live site. This matters most for shops, booking sites and anything that takes payments. If you've moved or rebuilt a site before, the same idea appears in our guide on redesigning without losing Google rankings.
Step 6: Lock down logins and users
Updates close holes, but good habits make holes harder to reach:
- Give each person their own login. Never share an admin account.
- Give people the lowest role they need. Writers don't need to be admins.
- Turn on two-step login for admins.
- Remove old staff and contractor accounts.
- Turn off "Anyone can register" under Settings, then General, unless you need it.
Step 7: Watch for warning signs
Look out for:
- admin users you didn't create
- pages, posts or links you didn't add
- the site sending visitors to other sites
- a sudden drop in Google traffic or a warning in Google Search Console
- your host emailing about malware
Keeping your robots.txt and sitemap in order also helps here: if strange pages suddenly appear in your sitemap or Search Console, that's a red flag.
A simple monthly routine
Weekly (10 minutes):
- Check Dashboard, then Updates.
- Install security updates after confirming last night's backup ran.
Monthly (30–45 minutes):
- Take a fresh backup.
- Update plugins and themes on staging, then live.
- Check your PHP version in Site Health.
- Review users and delete unused plugins.
- Click through key pages and forms.
Every few months:
- Test a full restore on a copy.
- Check how long your PHP version has left before end of life.
You can automate parts of this, such as backup reports and update alerts. Our guide on where to start with automation shows how to pick the first job to hand off.
When to call for help
Get help when your site is many versions behind, when an update breaks something you can't fix, when your host can't update PHP, or when you see any warning signs above. Also call if you run your own server and aren't sure how to patch PHP safely.
How Social Buzz can help
We look after PHP and WordPress sites: backups, updates tested on staging, PHP upgrades with your host, and cleanup of old plugins and accounts. If you'd rather hand off this routine, see our website security service or email info@social-buzz.app.
Questions people ask
How often should I update WordPress and plugins?
Check at least once a week. Apply security releases as soon as they come out, and do other updates on a regular schedule after a backup.
Who updates PHP on my website?
Usually your web host. On shared or managed hosting you can often pick the PHP version in your control panel. If you run your own server, you or your developer update it.
Is it safe to turn on automatic updates?
Automatic updates for minor WordPress security releases are a good default. For plugins, auto-updates work well on simple sites; on busy or complex sites, many owners test updates on a staging copy first.
What is a staging site?
A private copy of your website where you can try updates and changes without affecting the live site. Many hosts can create one with a click.
Patch, harden and watch your PHP and WordPress site.
Old PHP versions, outdated WordPress plugins and weak logins are common ways websites get broken into. We update and patch your site, close common gaps, and watch it so problems are caught early.
See how we help →