Updates fix security holes and bugs. Most hacked WordPress websites were running an outdated plugin, theme or WordPress version, so keeping everything up to date is the most important thing you can do to protect your site.

Before you update

• Back up your website. Use Softaculous (All Installations > back up) or a backup plugin, so you can restore it if something goes wrong. See Backing up WordPress with Softaculous.
• For big updates, such as a new major version of your theme or a page builder, test on a staging copy first. See Creating a staging copy of your WordPress site.

Updating manually

1. Log in to your WordPress dashboard.
2. Go to Dashboard > Updates.
3. Update WordPress, then your plugins and themes.
4. Check your website after updating, including any forms and your checkout if you have a shop.

Turning on automatic updates

• WordPress: security and minor updates install automatically by default.
• Plugins: go to Plugins and click Enable auto-updates beside each plugin you trust to update on its own.
• Themes: go to Appearance > Themes, open the theme and click Enable auto-updates.
• Softaculous: can also update WordPress, plugins and themes for you. Change this in All Installations by editing your installation's auto-upgrade settings.

Good housekeeping

• Delete plugins and themes you don't use. Deactivated plugins can still be hacked. Keep one default WordPress theme as a fallback.
• Replace abandoned plugins. If a plugin hasn't been updated for over a year, look for an actively maintained alternative.
• Keep PHP up to date too. See Changing your PHP version and settings.

We'll do our best to help troubleshoot WordPress, plugins, themes and other third-party software, but for in-depth help, please contact the software's developer or its official support forum.