WordPress years behind: updated without breaking it
A small business site still on a 2021 WordPress release. Nothing looked broken, which is why nobody touched it: the owner's worry was that pressing "Update" would take the site down. Meanwhile every security fix since 2021 was missing, and out-of-date WordPress and plugins are the usual way small sites get hacked. Here is the same site before and after, and exactly how it was updated so that nothing a customer uses stopped working.
| Before | After | |
|---|---|---|
| WordPress | 5.7.2 (May 2021) | the current release, minor security updates set to install on their own |
| PHP on the server | 7.2 (security support ended November 2020) | 8.x, switched in the hosting panel |
| Plugins | 14 installed, 9 out of date, 1 closed on WordPress.org | 13, all current; the closed one replaced by a maintained plugin doing the same job |
| Theme | edits made directly in the theme, so updating it would have wiped them | edits moved to a child theme, then the theme updated |
| Admin users | 4, two of them former staff | 2 (the owner's call; nothing deleted without asking) |
| What customers use | contact form, phone link, menu on a phone, booking page: checked working before the update and after it | |
How it was done
- Full backup first, files and database, downloaded off the server, so the site can be put back exactly as it was if anything goes wrong.
- Read what is installed: the WordPress, PHP and theme versions, and every plugin with its last update date. A plugin nobody has updated in years, or one WordPress.org has closed, gets a maintained replacement instead of an update.
- Record what works today: send a test message through the contact form, tap the phone number, open the menu on a phone, walk through the booking or checkout page. This is the list checked again at the end.
- Update a copy, not the live site. Most hosts have a one-click staging copy; if not, a private copy on a subdomain that search engines are told to ignore.
- One piece at a time on the copy: PHP, then WordPress itself, then each plugin, then the theme, loading the site after every step. When something breaks, it points at the one update that caused it, and that one gets fixed rather than the whole update being abandoned.
- Same order on the live site, at a quiet hour, then the step 3 list again on a desktop and on a phone. The backup is kept for 30 days.
For the record, this is how to see the version a site runs (WordPress prints it in the page source unless a plugin hides it):
<meta name="generator" content="WordPress 5.7.2" />
and WordPress.org publishes which versions are still considered safe at
api.wordpress.org/core/stable-check/1.0/.
What it costs
A fixed price, quoted before anything is touched; usually $150 for a site several years behind, including the backup, the plugin replacements and the checks above. You pay only after it works on your side. No password needed: WordPress lets you add me as a user, and you remove me afterwards. You get a short list of every change.
The site in the table is a composite built for this demo, not a real business; the steps are the ones followed on a real one. More before/after examples, and who I am: all demos.