How to Update and Secure WordPress Using the Plesk WP Toolkit

WP Toolkit makes it easy to keep your WordPress sites up to date and secure. Outdated WordPress installations are a common target for hackers, so regular updates and security hardening are essential. This guide covers updating and securing WordPress through WP Toolkit.

Updating WordPress Manually

1. Log in to Plesk.
2. Go to WordPress.
3. If an update is available, you will see a notification next to the installation (e.g., "Install plugin updates", "Update WordPress").
4. Click the notification to view available updates.
5. Select the updates you want to install. Keep the Restore Point checkbox selected to create a backup before updating.
6. Click Update.
7. Wait for the update to complete. Your site will be briefly unavailable during the process.

Configuring Automatic Updates

1. Go to WordPress and click on your WordPress installation.
2. Click Autoupdate settings.
3. Choose your preferences:
   • Update WordPress automatically: Select "Yes, but only minor (security) updates" for production sites, or "Yes, all" for staging sites.
   • Update plugins automatically: Select "Defined individually, but security updates are autoinstalled" for the best balance of security and stability.
   • Update themes automatically: Same recommendation as plugins.
4. Click OK.

Securing Your WordPress Installation

1. Go to WordPress.
2. If security issues are detected, you will see a warning message (e.g., "Fix security" or "Check security").
3. Click the security message.
4. Review the list of available security measures:
   • Critical measures: Turn off XML-RPC pingbacks, set secure file permissions, prevent directory listing, and more.
   • Recommended measures: Additional hardening steps for improved security.
5. Select the measures you want to apply.
6. Click Secure.

You can also secure multiple installations at once by clicking Security at the top of the WordPress page.

Important Notes

• Always create a restore point before updating WordPress core.
• Security measures applied by WP Toolkit can sometimes affect plugin functionality. If something breaks, use Revert to undo specific measures.
• Automatic updates for plugins and themes can be configured individually — go to the Plugins or Themes tab on the installation card.

Troubleshooting

Website breaks after an update:

• Go to WordPress → click Back up / Restore on the installation card.
• Restore the backup that was created before the update.

Security measures broke a plugin:

• Go to WordPress → click the security status message → select the problematic measure → click Revert.