Update WordPress, plugins and themes

Every WordPress site gets its updates checked by wp-cli, which asks wordpress.org what is available. Hyperion applies minor and patch updates by itself every night when automatic updates are on, and leaves major updates for you. Before an update batch or a WordPress core update, it takes a full backup.

Before you start

WordPress is installed on the hosting and the hosting is active.
You hold the Manage WordPress (plugins, staging, …) permission to update or change the automatic update setting. The View WordPress vulnerability scans permission shows the results only.
For a core update, the node has room for a full backup of the site’s files and database.

Steps

Update one item or everything by hand

Open Hostings in the sidebar, click the hosting, and open the WordPress tab. The tab’s header link Update WordPress ↓ jumps to the updates.
In Updates & integrity, read the Updates row. It lists each outdated plugin, theme and WordPress core release with the version change, the kind of update (major, minor or patch) and what happens to it.
Click Scan again to check again right now.
For a plugin or theme, click Update on its row. A major update asks for confirmation first, because it can change how the site behaves. No backup is taken for a single plugin or theme update.
For WordPress core, click Update to <version> and confirm with Back up & update. Hyperion takes a full backup of files and database first. If the backup fails, nothing is updated. The update runs as a background job, so you can close the page.

You can also update from the Plugins and Themes groups. See Manage plugins and themes.

From a shell:

hctl wp vuln-scan example.com
hctl wp core-update example.com --version 6.7.1

hctl wp core-update accepts only a release that wp-cli offers the site at that moment, so a typo or an older version is refused before anything changes. A script can use POST /api/v1/hostings/<id>/wp/core-update with a JSON body { "version": "6.7.1" }. It answers 202 and starts the same job.

Set the automatic updates

At the bottom of the Updates row:

Auto-update on — minor and patch updates applied daily; majors wait for you means the nightly sweep applies updates. The row adds how many it applied in the last run. Click Turn off to stop it.
Auto-update off — nothing is updated without you means the sweep only reports. Click Apply minor & patch updates daily to switch it on.

Automatic updates are on for every site until someone switches them off. A care plan that includes Automatic WordPress updates keeps them on.

What the nightly sweep does

Each node sweeps its own sites once a night. The window opens at 02:00 server time and stays open for four hours. The node records that it started the sweep before it begins, so a restart or a deploy during the window does not run it twice. A node that is down for the whole window skips that night.

For each active WordPress site, including sites imported from another panel or uploaded by the customer, the sweep:

Scans plugins, themes and core.
With automatic updates on and an update waiting, takes one full backup (files and database) of the site. If the backup fails, the sweep applies no update to that site, tells the administrators “Updates skipped: backup before updating failed”, and tries again the next night.
Updates every plugin and theme whose update keeps the same major version, then updates core to the newest minor release. A plugin whose update failed twice in a row is paused for 30 days and the administrators are told. A failed core update tells them “WordPress core update failed”.
After applying updates, empties the site’s page cache and scans again.
Alerts the administrators once about each new major plugin or theme update (“WordPress major update available”) and leaves it for you.

Where the sweep’s results go is covered in See WordPress updates across all sites.

The backup taken before updates

The backup is local only and is never copied off-site. In the hosting’s Backups tab its state cell carries a before update label, with a second line that tells you what happens to it:

deleted <time>: every update went in cleanly, so the backup is kept for 24 hours after the updates and then deleted.
kept until replaced: the batch did not finish cleanly or is still running. The backup has no deletion time. The next pre-update backup of the site replaces it, or you delete it yourself.
cleared <time>: this backup itself failed, so the updates were skipped. The row disappears 24 hours after it started.

A site keeps one pre-update backup, plus its oldest held one, which a later clean batch replaces only after at least seven days. These backups are not counted among the site’s newest backups, so a nightly batch never pushes your scheduled backups past their retention floor. An expiry check runs every five minutes.

To roll a site back after a bad update, restore the backup from the Backups tab.

Check that it worked

The Updates row reads Everything up to date · WordPress <version> is the latest release · <n> plugins & themes checked, or lists what is left.
For a core update, the job page ends with WordPress updated from <old> to <new>. The backup taken before it is kept for 24 hours.
The Backups tab lists the backup labelled before update.

If it fails

“the backup before the update failed, so WordPress was NOT updated”: fix the backup problem shown in the message, then try again.
“WordPress <version> is not offered to this site”: the release is not offered to the site any more, or wp-cli’s answer could not be read. Nothing was changed. Click Scan again.
“WordPress <version> did not install”: the message adds wp-cli’s error and says the backup taken before it is kept. Restore it from the Backups tab if the site is broken.
“WordPress <version> was installed, but its database update (wp core update-db) failed”: the files are new but the database schema did not follow. Open wp-admin and run the database update, or restore the backup.
Couldn't read plugins and themes — not a clean result: wp-cli could not start WordPress. See Repair a broken WordPress site.
A plugin shows Auto-update paused: add the plugin’s license key, then click Resume on the Plugins row.