Updates and security

Level: Advanced | Reading time: 12 minutes

Keep your WooCommerce online store up to date without breaking the site, and strengthen its security.

In this chapter :

WooCommerce Guide - Updates

Key statistic - 90% of hacked WordPress sites used outdated versions. Regular updates reduce the risk of hacking by 95%. Not updating means leaving the door open to hackers.

Why update

Ignoring updates is a huge risk.

Security

Fixed vulnerabilities - WordPress, WooCommerce and plugins discover vulnerabilities regularly. Updates correct them.

Example 2024: WooCommerce 8.2 contained a critical SQL injection flaw. Update 8.2.1 corrected it. Non-updated sites were hacked on a massive scale.

Public vulnerability database - The wpvulndb.com website lists known vulnerabilities. Hackers scan the Internet and exploit obsolete sites automatically.

An obsolete version is an easy target.

New features

Updates add useful new features: improved checkout, analytics and integrations.

WooCommerce 8.0 (2024) has brought new checkout blocks, 30% improved performance and AI-generated product descriptions.

Staying up to date allows you to benefit from innovations.

Compatibility

Recent plugins require recent versions of WordPress and WooCommerce. WooCommerce 9.0 requires WordPress 6.4 or higher.

An obsolete site makes it impossible to install modern plugins. You're stuck with outdated technologies.

Performance

Updates optimize code. PHP 8.2 offers 25% more speed than PHP 7.4.

Updates make your site faster for free.

Update strategy 🔺

NEVER update production blindly. A methodical procedure is mandatory.

Types of updates

Minor - WordPress 6.4.2 → 6.4.3. These updates fix bugs and security holes. The risk is low.

Major - WordPress 6.4 → 6.5. These versions bring new features and architecture changes. The risk is medium.

Core - This is WordPress itself.

Theme - This refers to the design of the site.

Plugins - These are extensions that add functionality.

PHP - This is the server language version (modified by the host).

Each type of update presents a different level of risk.

Timing of updates

Security updates (marked "Security") - To be applied immediately. A public vulnerability means that hackers are already active.

Minor updates - Weekly or bi-weekly.

Major updates - Monthly, during scheduled maintenance.

PHP updates - Quarterly, after rigorous testing.

Never update during Black Friday, sales or commercial events. The risk of downtime could result in a massive loss of sales.

Staging environment 🔺

The staging is an identical copy of your production site, invisible to the public, which is used for testing.

Why staging?

Test your updates on staging without any risk. If the site breaks, it doesn't matter, because production remains intact.

The recommended workflow is as follows:

  1. Clone production to staging
  2. Update staging
  3. Perform comprehensive tests
  4. If all OK, update production
  5. If problems appear, analyze them, correct them and start again

This approach guarantees zero production downtime.

Create staging

Premium hosting providers like Kinsta, SiteGround or WP Engine offer 1-click staging via cPanel.

The plugin Duplicator (free) lets you clone your site to a subdomain such as staging.votresite.com.

The WP Staging plugin (free) creates a staging on the same server, invisible to the public.

The ideal solution is to use staging on a separate sub-domain with the URL https://staging.votresite.com.

Access staging

Protect access by password (.htaccess authentication) or IP whitelisting.

If staging is indexed by Google, it creates duplicate content that penalizes your SEO. Block it in the robots.txt file:

User-agent: *
Disallow: /

Secure procedure 🔺

Here's a step-by-step checklist for a risk-free update.

Pre-update

  1. Full backup - Create a full backup with UpdraftPlus just before the production update. This is your safety net.

  2. Check compatibility - Consult the WordPress and WooCommerce changelog to identify any breaking changes. Check that your plugins are compatible with the new version.

  3. Up-to-date staging environment - Make sure your staging is a recent production clone.

  4. Maintenance Mode (production) - The "WP Maintenance Mode" plugin displays a "Maintenance in Progress" page to visitors during the update. This prevents customers from seeing bugs during the process.

Update staging

  1. WordPress core - Go to Dashboard > Updates > Update WordPress

  2. Theme - Go to Appearance > Themes > Update (if an update is available)

  3. Essential plugins - Update WooCommerce, Yoast SEO and WP Rocket first.

  4. Secondary plugins - Update the rest of the plugins one by one

  5. PHP (if necessary) - Change PHP version via cPanel > Select PHP version

Test staging

Here's the checklist of items to test:

  • Does the homepage load correctly?
  • Are product pages displayed?
  • Does the shopping cart work?
  • Does the complete checkout work?
  • Is a test payment successful?
  • Is administration accessible?
  • Are WooCommerce reports OK?
  • Are emails sent?

Test EVERYTHING. A bug that goes unnoticed means disaster in production.

If you detect a bug :

  • Identify the culprit plugin or theme (disable them one by one to isolate the problem)
  • Contact the plugin developer to get a fix
  • Or delay updating until a fix is available

Update production

If staging is OK, proceed as follows:

  1. Final production backup - Create a final security backup

  2. Maintenance mode ON - Activate maintenance mode

  3. Updates identical to staging - Apply the same updates in the same order and with the same versions.

  4. Rapid production testing :

  5. Test the homepage
  6. Perform a checkout test

  7. Check admin access

  8. Maintenance mode OFF - Deactivate maintenance mode

  9. 24-hour monitoring - Monitor errors, logs and performance for 24 hours.

If a problem occurs in production :

  • Restore the backup immediately
  • Analyze differences between staging and production
  • Correct the problem, retest on staging, then reapply the update in production

WordPress security 🔺

Beyond updates, proactively reinforce your site's security.

Basic hardening

Wordfence (free plugin) - Firewall blocks attacks, malware scan runs daily and connection protection limits attempts and activates 2FA.

To install: go to Extensions > Add > Wordfence > Install > Activate. A configuration wizard will guide you.

iThemes Security (free) - This is an alternative to Wordfence. It offers multiple protections: against brute force, file modification detection and SSL enforcement.

Login security

Username - NEVER use "admin" as your username. Create a unique username. Delete "admin" if it already exists.

Strong passwords - Use passwords of 16 characters or more, with alphanumeric characters and symbols. Password managers (1Password, LastPass) can generate and store them.

2FA (Two-Factor Authentication) - Install the "Two Factor Authentication" plugin (free) or use Wordfence's built-in functionality. Login then requires a password and a code generated by a mobile application.

Attempt limit - Wordfence automatically blocks IP addresses after 5 failed connections. This stops brute force attacks.

File permissions

On a Linux server, correct file permissions prevent unauthorized modifications.

  • Folders must have permissions 755
  • Files must have permissions 644
  • The file wp-config.php must have permissions 440 or 400

Check these permissions via FTP with FileZilla. Wordfence scan automatically detects incorrect permissions.

Unnecessary deletion

Disabled plugins - Remove them completely (don't just disable them). Inactive code is an attack surface.

Unused themes - Keep only the active theme and a backup theme (such as Twenty Twenty-Four). Delete all others.

User accounts - Remove accounts for departed employees and test accounts. Unnecessary access is a risk.

Perform a quarterly audit to clean up regularly.

Monitoring and alerts 🔺

Detect problems before they impact your customers.

Uptime monitoring

Uptime Robot (free up to 50 monitors) - Pings your site every 5 minutes. In the event of downtime, you receive an immediate alert by email or SMS.

Pingdom (free trial, then $10/month) - This is a premium alternative with an elegant interface.

For configuration:

  1. Go to uptimerobot.com
  2. Click on Add Monitor > HTTP(s)
  3. Enter URL: yoursite.com
  4. Set interval: 5 minutes
  5. Add your alert contacts: email/SMS

If downtime exceeds 5 minutes, you will receive a notification. React quickly.

Error logging

Query Monitor (free plugin) - Displays PHP errors, slow requests and hooks, visible only in administration.

Check weekly. Recurring errors mean there are bugs to be fixed.

Server logs - Access it via cPanel > Error Log. Here you'll find critical PHP and MySQL errors. Check them monthly.

Security scanning

Wordfence daily scan - Detects malware, backdoors and modified files. You receive an email if a problem is detected.

Suguri SiteCheck (free online) - Perform a weekly external scan at sitecheck.sucuri.net

WPScan - A professional CLI tool that scans for known vulnerabilities in plugins and themes.

Performance monitoring

Google Search Console (free) - Detects crawl errors, Core Web Vitals and indexing problems. Consult it weekly.

Google Analytics - Measures traffic and page load times. A sudden drop indicates a problem.

New Relic (paid, overkill except for large sites) - This is a professional APM offering real-time server monitoring.

In a nutshell

WordPress and WooCommerce updates correct critical security vulnerabilities and should be applied promptly. Always test major updates in a staging environment before production. Create a full backup just before each update, so you can roll back if necessary. Update in order: WordPress core, then plugins, then theme. Check the compatibility of your extensions with new versions before updating. Enable automatic updates for minor versions (security patches), but keep control over major versions.

Next steps 🔺

  • Backups - Protect your data
  • Speed - Speed up your site
  • SEO - Search Engine Optimization
  • Back - Overview

Navigation: ← Backups | Updates | Next: Extensions →