Software updates explained

Your website runs on software, and that software needs to be updated regularly, just like the apps on your phone. What there is to update, and who does it, depends on what your site is built on. This guide explains what gets updated on each platform, why, and how we do it safely.

What "software" means on your website

What needs updating depends on your platform:

Platform	What gets updated	Who does it
WordPress	WordPress core, plugins, your theme, and the PHP version on your server	You, or us on our care plan
Squarespace	Nothing routine. Sites still on version 7.0 can make a one-off move to 7.1	Squarespace handles the hosting and the software
Shopify	Your theme, if it's from the Shopify Theme Store and an update is released	Shopify runs the platform; you choose when to add a theme update
Webflow	Nothing for you to install	Webflow runs the platform
Wix	Nothing for you to install. Wix runs the software behind your site; ask us about any third-party apps you rely on	Wix, for the platform
Custom-coded	The framework and code packages the site is built with	Your developer

If your site runs on WordPress, it has three layers of software:

Layer	What it is	Example
WordPress core	The foundation that runs everything	WordPress 7.x
Plugins	Add-ons that power specific features	Contact forms, SEO tools, e-commerce
Theme	Controls the design and layout	Your custom theme or a commercial theme

Each of these is developed by a separate team. Each team releases updates at different times. Keeping all three layers current, and compatible with each other, is an ongoing job.

Compatibility matters

On WordPress, a plugin update can sometimes conflict with another plugin or your theme. That's why we never update everything at once, and why we always test on a staging site first.

Why updates matter

Updates do three things:

Fix security holes. Developers discover vulnerabilities and patch them. Every day you run old software, a known hole stays open.
Fix bugs. Things that were broken or behaving oddly get fixed.
Add improvements. Performance gains, new features, and compatibility with newer technology.

WordPress's own security guidance is blunt about this: the most important thing you can do for your site's security is to keep WordPress, its plugins and its themes up to date. See Why websites need maintenance for more on this.

How we run updates safely

We don't click "update" on your live site and hope for the best. On WordPress, our process:

Take a full backup. Before any update, we back up your entire site: files and database. If anything goes wrong, we can restore to the exact state it was in before.

Apply updates to a staging site. A staging site is a private copy of your site. We run all updates there first, so your live site is never at risk. See How we test changes before they go live.

Test the staging site. We check your key pages, navigation, forms, and any custom functionality to confirm nothing broke.

Approve and push to live. Once we're confident everything is working, we apply the same updates to your real, live site.

Do a quick live check. We verify the live site looks and works correctly after the update.

The visitor arrow never crosses into the lower box. Your live site is copied from, and written to exactly once, after the change has already been tested somewhere it could safely have failed.

Read this as text

Your live site keeps serving visitors throughout. Nothing in this process interrupts it until the very last step.

Before significant work, we refresh a staging copy from the live site: an exact copy on a private URL that visitors cannot stumble across. Every change, update and fix is made there.

We then test it: key pages, navigation, forms, and whatever the change actually touched. For visual work or new content we usually share the staging URL so you can review it and say yes before anything moves.

Only once it has passed do we apply the same tested change to the live site. So the live site is read from at the start and written to once at the end, and everything that could go wrong goes wrong somewhere your customers never see.

Updating a Shopify theme

Shopify has a safety net of its own. A Theme Store theme update arrives as a new copy of the theme in your draft themes, not a patch applied to your live theme, and adding it doesn't affect your current theme. Changes made in the theme editor are copied across. Code edits made directly to theme files, by you or by an app, are copied across only if they don't conflict with the update. Some apps might not be compatible with the new version.

So the process is: add the update to your draft themes, reapply any changes that didn't carry over, test, then publish. Not every theme receives updates, and updates aren't supported for themes bought outside the Shopify Theme Store. See premium themes and licenses.

How often do we update?

For WordPress sites on our care plan, we run routine software updates on a regular schedule, typically weekly or bi-weekly, depending on your care plan. Security-critical patches (urgent fixes for actively exploited vulnerabilities) are applied as soon as possible.

You don't need to request updates. We handle them proactively as part of your care plan.

What about major updates?

Some updates are "major" releases that involve more significant changes. For WordPress, a major release is a change in the first two numbers (7.0 to 7.1, for example), and these usually introduce new features. Don't confuse this with Squarespace's 7.0 and 7.1, which are versions of the Squarespace platform, not WordPress. For a plugin, it might be a jump from version 2 to version 3. These sometimes require extra testing or small compatibility fixes.

We'll let you know before we run a major update if there's anything to be aware of. In some cases we may ask you to review the staging site yourself before we push live.

What if an update breaks something?

This is rare when following our process, but it does occasionally happen. On WordPress, if a staging-site test reveals a problem, we:

Identify the conflicting plugin or theme
Either hold that specific update until the developer releases a fix, or find a compatible alternative
Push only the safe updates to live

If, in the rare case, something slips through to your live WordPress site, we restore from the backup we took immediately before the update. The fix is typically fast.

On Shopify, a theme update sits in your draft themes until you publish it, so you can fix problems before your customers see them. On a custom-coded site, your developer can put the previous deploy back live while they fix the problem.

Common questions

Can I update plugins myself?

On WordPress, technically yes, but we recommend against it unless you've taken a backup first and are comfortable testing afterward. Running updates without a staging environment or backup can break your live site. If you want to update something urgently, contact us first.

On Shopify, you can add a theme update yourself. It goes into your draft themes, so your live store doesn't change until you publish it. If your theme has custom code, tell us first: code edits are only carried over if they don't conflict with the update.

Do I need to do anything for updates?

If your WordPress site is on our care plan, no. Updates are handled automatically as part of your care plan. We'll only contact you if a major update needs your input or review.

On Squarespace, Webflow and Wix, the platform runs its own software. On Shopify, theme updates are something you choose to add. Our care-plan update service covers WordPress sites only at this time.

What's a PHP update?

This applies to WordPress and other sites with their own hosting. PHP is one of the programming languages WordPress is built on. Your hosting server runs a version of PHP. Keeping it current is important for both security and performance. We coordinate PHP updates with your host and test carefully before applying them.

My site isn't on WordPress, what about updates?

Webflow and Squarespace are hosted platforms: the vendor runs and updates the software behind your site, so there's no WordPress-style routine of applying core, plugin and theme updates. Webflow, for example, says its all-in-one platform removes the need for third-party plugins. Squarespace is a partial exception: sites still on its version 7.0 can be moved to version 7.1 with Squarespace's own version update tool, which is a one-off change you choose to make rather than routine maintenance. And if you use any integrated third-party tools, those may still need attention.

Shopify is hosted too, and you don't apply security updates to it. The one update task is your theme: if it's from the Shopify Theme Store, Shopify and other theme designers periodically release new versions, which you add when you're ready (see Updating a Shopify theme). Shopify can also apply small automatic updates that fix bugs or security issues without changing your theme's look, content or settings.

Wix runs the software behind your site, so there's nothing for you to install. Third-party apps are a different matter: ask us about any app you rely on.

On a custom-coded site, your developer updates the framework and code packages the site is built with, then deploys the change. If a deploy causes a problem, they can put the previous one back live.