Maintenance, Updates & Backups

WordPress Fundamentals

Chapter 10 · Maintenance, Updates & Backups

A WordPress site is never really "finished" — it's an ongoing responsibility, not a one-time build. This closing chapter covers what keeps a site healthy after launch: updates, backups, and safe ways to test changes before they touch the live site.

Updates — Three Separate Layers

Layer	What to know
WordPress core	Minor releases (including security fixes) are applied automatically by default — a genuinely good, safety-first default. Major releases typically require a manual, deliberate update
Themes	Update notifications appear in the dashboard; skipping updates on a heavily-customized theme risks losing compatibility, echoing WordPress Fundamentals 5's own child-theme material
Plugins	Same dashboard-driven process as themes; per WordPress Fundamentals 6, an abandoned or outdated plugin is a real, specific security risk, not just an inconvenience

This is not a hypothetical risk

A neglected WordPress update — core, theme, or plugin — is a textbook, real-world instance of OWASP Top 10's own Vulnerable & Outdated Components category: known, publicly documented vulnerabilities in old software versions are actively, automatically scanned for and exploited across the web. WordPress's own huge market share, named back in WordPress Fundamentals 1, makes it a genuinely common, high-value target for exactly this kind of automated scanning.

Safe Update Practice

Back up before any major update — covered in full below
Read the changelog for anything described as a "breaking change" before updating a heavily-customized site
Update one thing at a time when troubleshooting becomes necessary — directly echoing WordPress Fundamentals 6's own plugin-conflict isolation technique
Test on staging first, covered below, for anything beyond a routine minor update

Backup Strategy

A real WordPress backup needs two genuinely separate things, tracing directly back to WordPress Fundamentals 1's own LAMP-stack material:

What	Why it's separately needed
The database	Every Post, Page, comment, and user account — the MySQL layer from WordPress Fundamentals 1 — backing up only files would lose all of this entirely
The files	WordPress core, the active theme, every plugin, and the media library — backing up only the database would lose every uploaded image and every installed theme/plugin

Where backups actually need to live

A backup stored only on the same server it's protecting is genuinely close to useless — if that server fails entirely or is compromised, the backup is lost right alongside everything it was meant to protect. A real backup strategy stores copies off-site: a separate cloud storage location, a dedicated backup plugin (UpdraftPlus is a common example) configured to push backups elsewhere automatically, or host-level automatic backups that are themselves stored independently of the live server.

Staging Sites

A staging site is a private, non-public copy of the live site used to test updates and changes safely before they ever touch the real, live version visitors see. Many hosts (particularly managed WordPress hosts, per WordPress Fundamentals 2's own hosting-type material) offer one-click staging environments built for exactly this purpose.

Why this matters most for major updates

Testing a major WordPress core update, a significant theme change, or a plugin known to sometimes cause conflicts on a staging copy first catches problems before they affect real visitors — a genuinely cheap insurance policy against exactly the kind of update-related breakage this chapter has already covered.

WordPress Fundamentals — Where This Course Leaves You

Ten chapters have covered everything a site owner genuinely needs: installation, the dashboard, the Block Editor, themes, plugins, media and organization, users and roles, comments, and now ongoing maintenance — all without writing a single line of PHP. WordPress Intermediate/Advanced picks up exactly where the black boxes in this course were deliberately left closed — theme anatomy, the template hierarchy, plugin development, and real, code-level security — starting with the exact theme structure WordPress Fundamentals 5 only ever installed as a finished product.

Hands-On Exercises

Exercise 1

A site owner backs up only their WordPress database, believing they're now fully protected. Explain what they would still lose in the event of a server failure, using this chapter's own material.

📄 View solution

Exercise 2

Explain why this chapter connects a neglected plugin update directly to a real, named OWASP Top 10 category rather than describing it only as a vague "best practice."

📄 View solution

Exercise 3

Explain why storing a backup only on the same server it protects is described as "genuinely close to useless," and describe what a correct backup location looks like instead.

📄 View solution

Chapter 10 Quick Reference — Course Complete

Core minor/security updates apply automatically by default; major core, theme, and plugin updates need deliberate action
A neglected update is a real instance of OWASP Top 10's own Vulnerable & Outdated Components category, not a hypothetical risk
Safe updates: back up first, read changelogs, update one thing at a time when troubleshooting, test on staging for anything major
A real backup needs both the database (all content) and the files (core, theme, plugins, media) — and must live off-site to be genuinely useful
Staging sites — a private copy of the live site for safely testing changes before they go live
This completes WordPress Fundamentals — WordPress Intermediate/Advanced opens every black box this course deliberately left closed