Skip to main content

How to Install and Update WordPress Plugins Safely

Plugins add features to WordPress, like forms, SEO tools, or a store. They're also the most common reason a WordPress site breaks or gets hacked. A little care up front goes a long way. These steps are for WordPress 6.x and later.

Before you install anything

  • Check whether you really need it. Every plugin is more code to update and more that can go wrong.
  • Look at the plugin's page in the WordPress.org directory: when it was last updated, how many active installs it has, which WordPress version it's tested with, and what people say in the support forum.
  • Only download from trusted places: the WordPress.org directory or the developer's own site. Never use "free" copies of paid plugins. They often contain malware.
  • Back up first. See Website Backups: What to Back Up, How Often, and How Restores Work.

Install a plugin from the directory

  1. Log in at yoursite.com/wp-admin.
  2. Go to Plugins > Add Plugin.
  3. Search for the plugin by name.
  4. Click Install Now, then Activate.
  5. Look for the plugin's settings. They're usually in the left menu or under Settings.

Install a plugin from a zip file

Paid plugins usually come as a zip file you download from the developer's site.

  1. Go to Plugins > Add Plugin.
  2. Click Upload Plugin at the top.
  3. Choose the zip file and click Install Now.
  4. Click Activate Plugin.
  5. If it's a paid plugin, enter your license key in its settings so it can get updates.

Update plugins

  1. Back up your site.
  2. Go to Dashboard > Updates, or Plugins > Installed Plugins and look for update notices.
  3. Read the changelog for big updates (look for View details).
  4. Update a few plugins at a time, not everything at once. That way, if something breaks, you know what caused it.
  5. Check your site after each round: the home page, forms, checkout if you have one, and anything the plugin does.

Rather not deal with plugin updates yourself? We can handle them on demand at reasonable hourly rates, so you only pay for what you need.

For more on the whole process, see How to Update WordPress Safely (Back Up First).

Should you turn on auto-updates?

On Plugins > Installed Plugins, each plugin has an Enable auto-updates link. Once it's on, the column shows Auto-updates enabled, and you can turn it off again from the same spot. (There's also a Manage auto-updates link.) Auto-updates are handy for small, well-maintained plugins and they close security holes fast. For plugins your site really depends on, like a store or a page builder, many people prefer to update by hand so they can test right away. Whatever you choose, have backups running.

Deactivate or delete plugins you don't use

  1. Go to Plugins > Installed Plugins.
  2. Click Deactivate under the plugin.
  3. Click Delete to remove it.

A deactivated plugin is still on your server, so delete anything you're not using. Some plugins leave settings in the database after you delete them. Check the plugin's docs if you want a clean removal.

If a plugin update breaks your site

  • If you can still log in, deactivate the plugin you just updated.
  • If you can't log in, your web team or host can turn it off by renaming its folder in wp-content/plugins.
  • Restore your backup if the site is down and you can't fix it quickly.
  • Open a ticket if you're a client. See How to Get Support From 3by400.

Related

Prefer we handle it?

If you'd rather spend your time running your business, our boutique hosting, available to our clients, including sites moved over from another host, takes a proactive approach to security and monitoring, with nightly backups, 24/7 outage monitoring, and ongoing core CMS updates.

Hosting & Security