WordPress Automatic Updates: Pros and Cons

Yesterday the WordPress dev team announced the 3.8.2 Security Release.

Previously, when a WordPress update became available, I’d see the notification when I visited the dashboard of one of our websites. Sometimes, I might spot the announcement post (like the one I linked to above) in the RSS feed.

But all that has changed. For the first time, I found out about the availability of release because one of our sites automatically upgraded itself and emailed me a notice like this:

WordPress Automatically Upgraded Itself: Good News or Bad News?

I’ll admit, I’m somewhat on the fence about this. I love the fact that the WordPress devs have created this feature. Ultimately, the entire WordPress ecosystem will benefit from it in the long run. But for now, we’re probably going to have some hiccups.

The “Pros” for automatic upgrades are fairly obvious:

• outdated, unpatched websites are a security risk… and sometimes, even the most diligent site owners neglect updates (or even forget about a site. Sheesh.)
• even thoroughly updated sites can be attacked if an insecure site on the same server is exploited (the attack I linked to above affected 40-ish sites, most of which were completely up to date)
• sometimes a WordPress security release is fast-tracked to fix to a particularly nasty vulnerability, and if you don’t get to the update quickly enough, you can end up with a problem on your hands

…and so on.

Having WordPress update itself so that any vulnerabilities that exist in the core software are removed rectifies some (if not most) of the above situations.

But there can be a downside. Here are some “cons”:

• Often, the most serious vulnerabilities aren’t even in the WordPress core (TimThumb comes to mind… and actually, the attack I mentioned earlier came through an old, abandoned, plugin—although the WordPress core was badly out of date as well)
• In “live” (“production”) environments, updates to the WordPress core may break you site’s design or functionality because themes or plugins may not have been updated in preparation for the changes. (This is a little like pulling the foundation out from underneath your house and then setting the house back on a new one. Might work. Might not. Depends on how different the new foundation is.)
• Some site owners may not take action to update themes and plugins in which vulnerabilities and security risks are discovered, because they think the updates are happening automatically. The vast majority of plugins and themes currently do not automatically update themselves.

The Biggest Issue: Backups

By far, the most significant concern I have involves the availability of current backups.

In other words: what happens when something critical breaks as the result of an automatic upgrade? Do you, as the site owner, have a current backup to restore?

If it’s a simple cosmetic issue related to design, perhaps it’s no big deal. But if it’s a mission-critical function that affects your business, then a loss of functionality could have serious consequences.

Perhaps the worst-case scenario here is if something goes awry with the upgrade script itself. It hasn’t happened often, but once in a while something happens with upgrade scripts (yes, even with WordPress) where an anomaly will cause the upgrade to fail. This could leave your site completely down—perhaps non-responsive, stuck in “maintenance mode” or otherwise inaccessible.

Our Current Approach: Backup to Dropbox

There are multiple solutions to automated backups. Most reputable web hosting providers offer some sort of paid solution. Even Automattic (the parent company of the for-profit side of WordPress) offers VaultPress.

Depending upon your specific situation (the number of sites you’re maintaining, budget, hosting setup, etc.) one or more of those solutions may be a good fit.

But for many small businesses, a more cost-effective solution may be a better fit. That’s where the WordPress Backup to Dropbox plugin comes in.

It’s pretty simple. Once you install & activate the plugin, you connect it to your Dropbox account (on a one-time basis), and configure it. You can set it to backup your site automatically on a routine basis. It will get both the database and the files for your site—everything you need to restore, in other words.

Since it stores the backup in your Dropbox account, the backups are completely separate from the hosting account. That way, if your hosting provider has a massive failure, you don’t have to worry about your backup dying with it. And if you already have a paid Dropbox account (or if you don’t use much of the storage on your free account), chances are you’ll have plenty of room so that this doesn’t create any additional cost.

Right now, most of our sites are backing up on a weekly basis. If you update your site on a daily basis, you might consider something more frequent than that.

If there’s enough interest in it, we’ll put together a comprehensive set of instructions about how to implement the backup solution.

The Bottom Line

Ultimately, automated WordPress updates are a positive new feature for the world’s best content management system. However, we recommend that you put automated backups in place in order to protect your site against any of the potential pitfalls.