WordPress How-To's Archives

Protect Yourself from WordPress 5.0

tl;dr: WordPress site owners should install a protection plugin ASAP, and then wait until January 2019 to update WordPress past version 4.9.8.

Public service announcement for everyone who has a WordPress site: WP 5.0 is going to be released on Dec. 6, 2018.

The new post/page editor in 5.0 completely revolutionizes the way posts and pages are created, but it is also likely to cause problems when editing post/pages that already exist, especially if you have any kind of custom formatting (extra HTML code, CSS, shortcodes, page-builder or landing-page plugins, etc.) on any of your posts/pages.

The good news is that it’s extremely easy to protect your site, without sacrificing security or usability, and upgrade to the new editor on a schedule of your choosing, instead of having that schedule dictated by the timing of a WordPress software release.

Here’s what I recommend:

Step 1: Install and activate a protection plugin immediately.

By “protection plugin” I mean a plugin that blocks the new editor in WP 5.0 from being used, keeping your post/page editor working exactly the way it does right now.

My favorite plugin to do this is called Disable Gutenberg, authored by Jeff Starr (there is another plugin with the same name, which I haven’t used, which is why I’m specifying the author of the one I have used). Gutenberg is the code-name of the new editor, to distinguish it from the current editor which is being called the Classic Editor.

Another plugin that does the same thing is called Classic Editor Addon, by Pieter Bos and Greg Schoppe. When you install this plugin, it will prompt you to also install a plugin simply called Classic Editor, which you should definitely do.

Both of these options can be installed right from your WordPress Dashboard. Make sure to activate the plugin you choose when installation is finished.

The main reason I like Starr’s plugin is that it does the job with one plugin, with no configuration required, while the Classic Editor and Classic Editor Addon need to be combined to get the same result. Really, either way is fine, and there are also other plugins that do the same thing that are probably also fine but I haven’t personally tested them.

That’s it. You are now safe. When WordPress 5.0 comes out, you can go ahead and update, provided you follow standard best practices for a major update, including making a backup first, testing functionality after the update, and keeping an update log. My post on how to update WordPress shows the process, my free guide How to Upgrade Anything is still valid, and my free WordPress Update Checklist is also still valid.

Step 2: After WordPress 5.0 is released, decide when to update.

Normally I’m in favor of updating to the latest release of WordPress fairly soon after it’s released. That’s why I’m in favor of the built-in automatic updater (which, I should note, only updates minor releases, such as 4.9.7 to 4.9.8, so it will NOT update your site from 4.9.8 to 5.0).

In the special-snowflake case of WordPress 5.0, I think it might be better to wait until January 2019 to update, for a few reasons:

We’re in the middle of the holiday season, and you might have less time to debug and troubleshoot. Make time to do this in January after the holidays are over.
WordPress 5.0 isn’t fixing any critical security holes. Its main purpose is to bring the new editor to the world, so if you’re already proactively blocking the new editor, there’s less of a compelling reason to update.
Because of the large number of “open issues” (which means “problems” even if they aren’t technically “bugs”) that still exist in the 5.0 release, it is highly likely that one or two minor updates (such as 5.0.1, possibly even 5.1) will be released in the four to six weeks after 5.0 comes out. You can get all the benefits of these releases, without having to experience the pesky bugs, if you simply delay updating.

I’m not alone in advising website owners to wait to update. The authors of Yoast SEO, one of the most popular and powerful plugins in the world (and a plugin I like and recommend) say that if you can wait until January, you should.

Note that if some kind of critical security vulnerability arises in the next six weeks, it will become important to update WordPress to fix that problem, so it’s better to be safe and install a protection plugin, even if your current plan is to wait until January to do your WordPress updates.

Step 3: Make a plan for migration to the new editor.

In January, after WordPress 5.0 has been out in the real world for awhile and many issues will hopefully have been solved, you can take your time deciding how to migrate to the new editor.

If you have a relatively small number of pages, that plan might simply be to make a backup, then save each of your pages with the new editor, taking the time to rebuild or fix any formatting wonkiness that shows up.

If you have a larger site, you might decide to “freeze” most or all of your preexisting content (blog archives, for instance), which simply means deciding not to edit older posts, and using the new editor for new posts.

You might decide to migrate your pages to the new editor over a longer period of time. With the protection plugins I mention above, this should be possible.

Whatever road you take, the new editor is going to become a permanent part of WordPress, so you will need to learn to use it eventually. And it is extremely powerful, giving website owners control of in-page layout that they never had before.

And all that power and control will still be there in January, when you have time to explore it without the holidays bearing down on you.

So take control of your own update timeline, install a plugin to protect your site, and resume your holiday plans.

And if you’re part of my Peace of Mind Program, rest easy, you’re already protected, and I will handle the 5.0 update for you.

How to update WordPress

Are you seeing a message at the top of your WordPress dashboard, telling you that a new version of WordPress is available?

Complete with a command to “Please update now.”? The “please” softens it a bit, but it’s still a command.

This is WordPress’s way of helpfully notifying you that a new version is available. In this post, I’ll illustrate how easy it is to update WordPress, right from your dashboard.

You can also download my free 10-step WordPress Update Checklist for more pre- and post-update maintenance tasks that will keep your site in tip-top condition, or join my Peace of Mind Program to have me take care of all your WordPress updates for you.

Step 1: Back up your stuff.

Before you go clicking on the update link, it’s a really good idea to have a backup. Fortunately, plugins like BackupBuddy (paid, and that’s an affiliate link because I use BackupBuddy on every single site I manage and recommend it highly) or UpdraftPlus (free) make creating a backup straightforward and easy. Go back up your entire site before you read further. I’ll wait.

Step 2: Prepare your safety net.

That backup you just made? Download a copy to your computer. It won’t do you any good if it’s stashed on the same web server as your WordPress site and that site becomes inaccessible.

Also, have your FTP login credentials on hand. If you don’t know this info, you should log into your web hosting control panel to retrieve it.

You probably won’t need either of these, but a safety net is there for that once-in-a-blue-moon time that you do need them.

Ready to proceed? Good. Now you can click that handy “update” link.

Step 3: Click “Please update now.” at the top of your screen

You can also click on “Updates” in the left navigation menu.

Either way, you’ll be taken to a screen labeled “WordPress Updates”. There’s a note here about how it’s important to back up your database and files. Don’t you feel smart for already having that part taken care of?

Step 4: Click the button labeled “Update Now”.

I won’t bore you too much with old-fogy tales of how, back in the pre-WordPress 2.7 days, we file-wranglers had to download the new version files manually, unzip them, and use FTP to install them (you young whippersnappers don’t appreciate the troubles we faced in those days… we walked five miles to school in the snow! Uphill! Both ways!).

Let’s just say a big group Thank You to WordPress for giving us the magic “Update Now” button. Yes, it’s truly automatic. One click does it all.

Step 5: Wait until you see “WordPress upgraded successfully” and are redirected to the credits page.

This may take a moment or two. Don’t click on anything until you see “Welcome to WordPress” message at the top of your screen. That’s it! You’re now free to move about your dashboard (Ding! In just a few moments our flight attendants will be coming through the cabin with a complimentary beverage service.).

Just because an update becomes available, should I install it?

In general, yes. WordPress publishes updates for a reason, usually improved features, improved security, or both. And you probably want these things.

However, if you are using a lot of plugins, you may want to wait a few days to give the plugin developers time to test their plugins with the new WordPress release, and if needed, release plugin updates. Then, after you update WordPress, you’ll want to update any plugins that have new versions available.

Another reason to update (fairly) promptly is that you want to install each update as it’s available, instead of waiting through several versions and installing them all at once. If you do installations one step at a time, there are fewer chances for things to go wrong. Yes, you can wait and batch-upgrade, and I’ve seen it work just fine in the vast majority of cases. But why tempt fate?

Download my free 10-step WordPress Update Checklist for tips on pre- and post-update maintenance tasks that will keep your site in tip-top condition, or join my Peace of Mind Program to have me take care of all your WordPress updates for you.

How to sign up for a WordPress.com account

After you install Jetpack, you’ll see a message at the top of your WordPress dashboard telling you to “connect to WordPress.com.”

Wait, WordPress.com? Why would you use WordPress.com when you know you should avoid hosting a business site there?

Because many (though not all) of Jetpack’s features use the powerful servers at WordPress.com to do their work. And offloading server-intensive tasks to WordPress.com means your self-hosted site will load faster.

Here are just a few of the most useful Jetpack features that require a connection to WordPress.com:

WordPress.com Stats shows you statistics about your website visitors (a nice alternative to, or addition to, Google Analytics).
Subscriptions automatically emails new blog posts to subscribers, and gives you a sign-up widget for your sidebar.
Monitor checks your site every 5 minutes and emails you if your site goes down.
Publicize connects your blog with social media networks like Twitter and Facebook, so you can easily share your posts as they are published.
There are many more features, of course.

If you don’t have a WordPress.com account, you can sign up for free. Here’s the tricky part: Because you already have a self-hosted WordPress site, you don’t need to “create a website” on WordPress.com, and “create a website” is the only thing you can do on the WordPress.com homepage.

There is such a thing as a WordPress.com account that gives you access to things like Jetpack features without having a WordPress.com website attached to it. But it’s fiendishly difficult to find that option.

Here’s a shortcut!

The URL is: https://signup.wordpress.com/signup/?user=1

There are just three fields on the signup page: Email address, username, and password. Supply a valid email address, and pick your own username and password, and you’re good to go.

Below, I’ve documented how to find that signup page from the WordPress.com home page, since they make it so hard.

1. On the home page, don’t click the “Create Website” button right in the middle. Instead, click the “Log In” button at the top right corner:

2. On the login page, don’t login. Instead, click the gray “Register” link below the login form:

3. On the registration page, ignore the registration fields and click the tiny blue link in the bottom right corner that reads “sign up for just a username.”

4. Finally, you’ve reached a form you don’t need to ignore! This is the signup form that can be reached directly with the URL https://signup.wordpress.com/signup/?user=1 .

When you enter your email address and username, the form will immediately tell you if either of them is already in use (if you signed up for a WordPress.com account in the distant past, here’s where you’ll find out about it). Enter a password, and the “Sign up” button will light up as your cue to proceed.

Now you have a WordPress.com account that you can use to connect to Jetpack.

Troubleshooting WordPress automatic updates

If your website uses WordPress, you should definitely take advantage of the automatic updater.

If your site is set up correctly and using the automatic updater, it’s already updating itself, and sending you a confirmation email each time this happens. Check your inbox for an email from “WordPress” that has a subject line that looks like this:

[your-site-name] Your site has updated to WordPress 5.2.3

If you don’t have any of these confirmation emails, or you have received emails urging you to update instead of confirming that the update already occurred, log into your WordPress dashboard to check whether automatic updates are enabled.

Visit Dashboard –> Updates, and look for a line of text that reads “Future security updates will be applied automatically”. If, instead, you see a notification that future security updates will not be applied automatically, here’s how to find out why, and get your automatic updates back on track.

Why use automatic updates in the first place?

The WordPress automatic update process only applies to minor versions, which are the version numbers that contain two decimal points: 4.2 to 4.2.1, 4.2.1 to 4.2.2, and so on.

When a major version (a version containing only one decimal point, like 5.2 or 5.3) is released, sites will not update automatically, even if they have automatic updates enabled. Major releases still need to be done manually (back up first, please!).

WordPress automatic updates have been available since 2013, and are incredibly safe. They almost certainly won’t break your site, and in fact will keep your site safer by installing the latest security fixes.

I have automatic updates enabled on all of my sites and all of my client sites, and I have never once had a problem with an automatic update breaking a site, going back to version 3.7.1 when automatic updates were first introduced.

That’s not to say that automatic updates are guaranteed to be problem-free. Yes, there’s always a chance of a problem occurring. But the numbers (not just my sites, but reported by WordPress.org) give me confidence that the security and ease of the automatic update feature is worth that very slight risk.

Also, this is another reason to set up automatic backup schedules, so you never have to wonder if you have a recent-enough backup of your site.

What if WordPress automatic updates aren’t working on your site?

If automatic updates aren’t working on your site, you can install the Background Update Tester plugin .

The plugin hasn’t been updated since 2014, so you will see a warning that it hasn’t been tested with your version of WordPress. I don’t take these warnings lightly, but in this case, the plugin is so simple and lightweight that I believe it remains safe to use. Plus, you’re only going to use it for short-term testing — you don’t need to keep it activated and can safely delete it once you’ve tested your background updates.

Once the plugin is installed and activated, visit Dashboard –> Updates again. The plugin will automatically test your site and display the reason(s) automatic updates are failing.

If the stated reason is something you are comfortable fixing on your own, you can take care of the fix and re-run the test (simply visit Dashboard –> Updates again) to verify that it worked.

If you can’t perform the fix yourself, or you don’t even understand what the message means, the simplest thing to do is copy the plugin’s message and submit a ticket to your web host. Explain as briefly as possible that you want to take advantage of WordPress’s automatic updates, but the updates are not working on your site. Then paste the exact description/message that Background Update Tester provides. Your host will know what it means and what to do next. (If they don’t, consider a new host.)

If you see the following message for more than a few minutes:

Automatic background updates require a number of conditions to be met. Testing now…

Then either your WordPress version is too old to be compatible with the plugin (the plugin requires at least version 3.7), or there’s a much bigger problem with your site. In the unlikely event that this happens to you, I can diagnose the trouble with a Website Tune-Up.

The only legitimate reason to disable the automatic updater

I can’t think of a real-world case in which a self-hosted WordPress site should not use the automatic updater. Period.

If you are using a theme or a plugin that breaks or crashes your site when WordPress is updated, that theme or plugin is the problem, not WordPress. Theme and plugin developers have plenty of advance warning when a new version of WordPress is being tested and released, and it’s their job to test their own code with updated versions of WordPress.

Plugin conflicts are much thornier, because it’s impossible to test every combination of plugins out there. But well-coded plugins cause fewer conflicts, and good developers respond promptly when their plugin is reported to conflict with another one.

Here’s the only real-world case I can think of for not using the automatic updater: If you are hosted at a “managed WordPress host”, the hosting company may handle the automatic updates instead of letting WordPress update on its own. In fact, managed WordPress hosts will usually update major versions of WordPress as well, not just the minor versions.

If you’re not sure whether this applies to you, check with your web host. Look for something in your hosting plan description about WordPress updates, or ask them directly.

If you’re using a managed WordPress host, you’re in good hands, and you don’t need to worry about the WordPress automatic updater.