Quick answer: WordPress core has two kinds of releases. Major releases, such as 5.3 which came out on 12 November 2019, add features and arrive a few times a year. Minor releases, such as 5.2.4, fix bugs and security issues and install automatically on most sites. Plugins and themes have their own separate release schedules set by their developers. A safe routine is to let minor core updates run automatically, test major core releases and important plugin updates on a staging copy first, keep backups, and never leave updates waiting for months.
Why update basics matter to site owners
Most WordPress security problems come from outdated software, especially plugins. At the same time, careless updates can break layouts or features. Understanding how releases work helps you decide what to update straight away, what to test first and who is responsible.
How WordPress core versions are numbered
WordPress uses version numbers like 5.3 or 5.2.4:
- Major releases change the first two numbers: 5.1, 5.2, 5.3. The step from 4.9 to 5.0 was a major release too, not a bigger jump. WordPress does not follow strict semantic versioning, so 5.0 was simply the release after 4.9.
- Minor releases add a third number: 5.2.1, 5.2.2 and so on. These are maintenance and security releases for that major version.
So 5.3 is a major release, and 5.3.1, when it arrives, will be a minor release for it.
Major releases
Major releases bring new features, interface changes and developer improvements. Recent examples:
- 5.0 (December 2018) introduced the block editor, known as Gutenberg. See our guide to the Gutenberg block editor.
- 5.1 (February 2019) began the Site Health project, warning sites running outdated PHP versions.
- 5.2 (May 2019) added the Site Health screen and fatal error protection, which lets administrators recover from a plugin or theme that crashes the site. It also raised the minimum PHP version to 5.6.20. Our Site Health guide explains the checks.
- 5.3 (November 2019) improved the block editor, introduced the Twenty Twenty default theme, automatically scales down very large uploaded images, refreshed admin styles and added compatibility with PHP 7.4.
Each major release goes through a public process: development, beta releases for testing, release candidates when the code is considered ready, then the final release. Release candidates are a good moment for developers and agencies to test client sites and plugins.
Since 5.0, major releases have come roughly every three to four months. Dates can move if testing finds problems.
Minor releases and automatic updates
Since WordPress 3.7 in 2013, sites update automatically to new minor releases by default. That means security fixes reach most sites within hours of release, without anyone logging in.
Major releases do not install automatically by default. You click to update from Dashboard > Updates, or your host or developer handles it.
Hosts and developers can change this behaviour. Some managed hosts control updates themselves. Developers can turn automatic updates off or extend them to major releases with configuration constants or filters. If you are not sure how your site is set up, ask whoever manages it.
The WordPress security team also releases security fixes for older major versions. Even so, staying on a current major version is the safest option, because older branches only receive critical fixes and many plugins stop supporting them.
How plugin updates work
Each plugin has its own developer and its own schedule. Some release updates every week, others a few times a year. Plugins from the WordPress.org directory update through your dashboard. Premium plugins usually need an active licence key to receive updates.
Plugins can declare which WordPress and PHP versions they require and which version they were tested up to. A plugin that has not been updated or tested with recent WordPress versions for a long time is a warning sign. It may be abandoned, and abandoned plugins are a common security risk.
Plugin updates are not automatic by default. Some hosts and management tools offer automatic plugin updates, which can work well for reliable plugins, but complex plugins such as ecommerce, membership or page builders deserve testing first.
Our list of essential WordPress plugins favours well maintained plugins partly for this reason.
How theme updates work
Themes update the same way as plugins. The key risk is customization. If someone edited theme files directly, an update overwrites those changes.
To avoid that:
- Use a child theme for code changes to a third-party theme
- Use the Customizer and Additional CSS for small style changes, as covered in our WordPress Customizer guide
- For a custom theme built for you, updates come from your developer rather than a public repository. See WordPress theme development for how those are built and maintained
The block editor plugin
The block editor is developed in a separate Gutenberg plugin that releases new versions about every two weeks. Features are tested there, then merged into core with each major release. Most business sites do not need the Gutenberg plugin installed. Core gets the stable features a few months later.
PHP: the update people forget
WordPress runs on PHP, and PHP versions reach end of life too. Running an old PHP version is slower and less secure, and newer plugins may stop supporting it. Check your PHP version under Tools > Site Health. Our guide to PHP versions and WordPress explains how to upgrade safely.
A safe update routine for business sites
Weekly or fortnightly
- Take a fresh backup of files and database
- Review available plugin and theme updates and read changelogs for anything major
- Apply low-risk updates on the live site
- Check key pages and forms afterwards
For major core releases and big plugin updates
- Wait a few days after release unless it contains an urgent security fix. Early bugs are often fixed in a quick minor release
- Copy the site to a staging environment
- Apply updates on staging and test: home page, key templates, forms, checkout, logins, editor
- Apply to live with a fresh backup in place
- Keep an eye on error logs and uptime for a day or two
Always
- Remove plugins and themes you do not use
- Keep an update log so you know what changed when something breaks
- Know how to restore a backup quickly
This routine is part of any sensible WordPress maintenance plan and works best alongside version control for custom code.
FAQ
Is it safe to update WordPress straight away?
Minor releases, yes, and they usually install automatically. For major releases, waiting a few days and testing on staging is safer for business sites.
What happens if an update breaks my site?
Since WordPress 5.2, fatal error protection often lets administrators log in and deactivate the faulty plugin or theme. Otherwise, restore your backup and investigate on staging.
Do I need to update plugins I am not using?
Delete them instead. Inactive plugins can still contain vulnerable files.
Who should handle updates?
Someone who will do them consistently and test afterwards. That could be you, your developer or a maintenance service. The worst option is nobody.
Keep current without surprises
WordPress updates are routine when you understand the pattern: automatic minor releases, tested major releases and a regular plugin and theme schedule backed by good backups. If you want a WordPress site that stays current and keeps converting visitors, see our Turn visitors into customers service.
