Free tools Windows power users keep installed
One-click scans. No signup required.
Configure WordPress updates around three safeguards: make a verified database-and-files backup, keep administration and downloads on HTTPS from WordPress.org, and update from Dashboard > Updates whenever possible. Enable plugin and theme automatic updates selectively, then use Site Health to confirm that WordPress can reach its update services and complete background tasks. If WordPress requests FTP credentials or an update fails, treat that as a filesystem or connectivity problem—not as a reason to enter credentials into an unknown prompt. Use encrypted SFTP for controlled manual repairs.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What a secure WordPress update process looks like
A secure process is repeatable rather than improvised. Before changing code, you need a rollback point that you have actually verified. During the update, WordPress should obtain packages over an encrypted connection from an official source and write them with the correct filesystem ownership. Afterward, you should verify the site, its background-update status and its HTTPS configuration.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- Back up the database and files. Keep a restorable copy before enabling automatic updates or starting a core upgrade.
- Use HTTPS and an official source. The administration area, hosting control panel and transfer client should use encrypted connections. Download WordPress only from https://wordpress.org; official releases are not distributed through unrelated download sites.
- Use the Dashboard > Updates screen first. It handles core, plugin, theme and translation updates and reports the result.
- Enable automation by item, not blindly. WordPress 5.5 and newer lets administrators turn automatic updates on for individual plugins and themes, with bulk controls for plugins.
- Check the result. Use Tools > Site Health, review the update screen and test the public site and administrator login.
This order matters: an update is only “secure” if you can recover from a bad package, a plugin conflict or an interrupted write.
Prepare a rollback before updating
Back up both database and files
The database contains posts, pages, settings, users and much of the site’s configuration. The files contain WordPress core, plugins, themes, media uploads and configuration files. A copy of only one is not a complete rollback. WordPress documentation explicitly advises backing up the database and files before upgrading.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Use your host’s backup system or a backup tool that can restore both components. Confirm that the backup completed, note where it is stored and, where your hosting plan permits, perform a test restore on a staging copy. Keep at least one copy outside the web server so a compromised or failed server cannot destroy the only rollback.
- Record the date and the WordPress, plugin and theme versions being changed.
- Confirm that the backup includes the database and the
wp-contentdirectory, including uploads. - Do not start an update while a backup job is still running.
- Know the restoration path before you enable unattended updates.
Put the site and administration on HTTPS
HTTPS encrypts the login session and the traffic used to obtain update packages. Make sure both the public URL and WordPress Address URL use https://, and resolve certificate warnings before updating. Site Health can flag an absent or misconfigured HTTPS setup.
Use a trusted package source
Download WordPress releases from WordPress.org. The WordPress Developer Resources guidance says never to download or install WordPress from any other website. Avoid packages supplied through unsolicited emails, unofficial mirrors or “nulled” plugin and theme sites; they can contain altered code and remove the integrity benefit of the normal update process.
Choose an update method
Different methods trade convenience for control. Pick one deliberately instead of switching methods mid-failure.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
| Method | Backup and rollback | Filesystem requirement | Transport security | Administrator control | Downtime and diagnosis |
|---|---|---|---|---|---|
| Dashboard automatic updates | Requires a verified backup made before automation | WordPress must be able to write as the web-server user | Uses the site’s HTTPS connection and WordPress update services | Lowest day-to-day effort; enable per plugin or theme | Usually brief; review notifications and Site Health afterward |
| Dashboard one-click update with credentials | Use the same backup requirement | WordPress cannot write directly and asks for connection details | Use encrypted SFTP rather than unencrypted FTP when offered | More interactive; you approve the connection and update | Moderate diagnostic effort; permissions are often the root cause |
| Manual SFTP update | Make and verify a backup first; you control the replacement files | You need SFTP access and a writable destination | SFTP encrypts the password and transferred data | Highest control over files and timing | Potentially more downtime; best for failed or blocked dashboard updates |
Automatic updates are convenient when the host’s ownership and backup arrangement are reliable. Manual SFTP is appropriate when permissions prevent a one-click update, a package was left half-installed or you need to inspect files directly.
Update WordPress core from the dashboard
Run the built-in update
- Sign in to the administrator area.
- Open Dashboard > Updates.
- Review the available core version and the listed plugin, theme and translation updates.
- Confirm that your latest backup is complete.
- Choose the automatic core upgrade when it is offered, then wait for the process to finish without closing the browser or starting another update.
During a normal core upgrade, WordPress downloads the package, unpacks it, verifies files, installs the new version and upgrades the database. The screen should report completion. If it remains in progress unusually long, do not repeatedly click the update button; inspect Site Health and your hosting control panel first.
Recommended Free Tools
Understand minor, security and major releases
WordPress 3.7 and later can apply minor and security releases in the background. These updates are intended to keep a site on its current branch without requiring an administrator to start every maintenance release. Major feature releases generally require an administrator to initiate the upgrade from the dashboard. A host, plugin, multisite policy or other configuration can disable or limit background updates, so the version number alone is not proof that automation is active.
Enable automatic plugin and theme updates safely
Plugin controls
Per-item plugin and theme automatic updates require WordPress 5.5 or newer. In Dashboard > Plugins > Installed Plugins, locate the plugin and use its automatic-update control. WordPress also provides bulk enable and disable controls for plugins, which is useful when applying a documented policy to a group of low-risk extensions.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Turn automation on selectively. A plugin that changes checkout, membership, caching, security rules or other high-impact behavior deserves a maintenance window and a tested rollback plan. An abandoned or heavily customized plugin should not be placed in an unattended update group merely because an update button exists.
Theme controls
Open Appearance > Themes, select the installed theme and use its automatic-update control when available. A child theme normally stores customizations separately, but you should still confirm how the parent theme update interacts with your design and any custom code before enabling automation.
Monitor what automation changes
Automatic updates reduce the time a vulnerable component remains installed, but they do not test your site’s business logic. After an automatic update notification:
- Check the front page, a representative post, forms, search and any logged-in workflow.
- Review the plugin or theme update result in the administrator area.
- Look for fatal-error, PHP warning or compatibility notices in the host’s logs.
- Keep the pre-update backup until the new version has been observed operating normally.
Why WordPress asks for FTP credentials
WordPress performs a one-click update by writing files to the installation directory. The web server runs PHP as a particular operating-system user. If that user does not own the WordPress files or lacks permission to write them, WordPress cannot safely replace the old files. It then asks for connection credentials instead of silently changing ownership or permissions.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
This prompt is usually a filesystem-ownership issue, not evidence that WordPress itself is broken. Common causes include files copied by a different hosting user, a migration performed as the root account, restrictive permissions, a host that isolates PHP processes, or a security policy that blocks direct writes.
What to do when the prompt appears
- Stop and confirm that the prompt is inside your genuine WordPress administrator session over HTTPS.
- Ask the host which user runs PHP and which user owns the WordPress files. Do not make broad permission changes without that information.
- Prefer the host’s documented SFTP method. SFTP encrypts the password and other data while it travels between your computer and the website.
- If the host supports a secure direct-update configuration, have support correct ownership so the web-server user can write only the required WordPress directories.
- Retry from Dashboard > Updates after the ownership or connection issue is resolved.
Never paste credentials into a prompt delivered by an unfamiliar plugin, an HTTP page or an unsolicited message. Do not “fix” the issue by making every file world-writable; that weakens the site’s security and can hide the real ownership problem.
Perform a manual update with SFTP
Use this route when the dashboard cannot write files, a download repeatedly fails or you need direct control after an interrupted upgrade. SFTP is preferable to plain FTP because it encrypts credentials and file transfers.
- Back up first. Save and verify the database and files, and record the current version.
- Obtain the package. Download the desired WordPress release from WordPress.org over HTTPS. Do not use an unofficial package.
- Pause conflicting work. Stop other update jobs and, if your host provides it, place the site in a maintenance window. Inform collaborators so nobody edits content during the file replacement.
- Connect with SFTP. Use the host’s server name, port and account details. Confirm the remote path that contains
wp-admin,wp-includesandwp-content. - Extract the package locally. Keep the downloaded archive until the update is verified.
- Replace core directories and files. Upload the new
wp-adminandwp-includesdirectories and the root WordPress files. Do not overwritewp-contentor yourwp-config.phpwith the package’s copies; those contain your site’s content and configuration. - Preserve custom files. Check for host-specific files or custom root files before replacing anything. If you are unsure, ask the host or developer rather than deleting them.
- Finish the database step. Sign in to the administrator area and follow any database-upgrade notice WordPress presents.
- Test and review. Load the public site, administrator area and important workflows, then inspect Tools > Site Health.
If the SFTP client reports permission errors, stop uploading and have the host correct ownership. Repeatedly forcing transfers with an account that does not own the destination can leave a mixed-version installation.
Troubleshoot a failed update
Start with Tools > Site Health
Open Tools > Site Health and read the tests rather than relying only on the update banner. Site Health can identify that WordPress cannot reach api.wordpress.org, background updates are not working, HTTPS is absent or automatic updates are disabled. A failed test narrows the repair: connectivity points to DNS, firewall or outbound-request rules; an HTTPS warning points to the certificate or URL configuration; an automation warning points to cron, host policy or a disabled filter.
Check connectivity to WordPress services
WordPress needs outbound access to its update services. If Site Health reports that it cannot reach api.wordpress.org, ask the host to check DNS resolution, firewall egress rules, proxy settings and TLS inspection. Security plugins can also block outbound requests. Retry only after the underlying connection works; repeated clicks do not repair a blocked network path.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check background-update and cron status
Background updates depend on scheduled tasks and host support. A disabled or stalled cron system can leave an eligible minor or security release unapplied. Review Site Health, the host’s scheduled-task settings and any policy that disables automatic updates. On multisite installations, network administration settings can also change which controls individual site administrators see.
Remove a stale maintenance file
During an update WordPress creates a temporary .maintenance file so visitors see a maintenance message. If a process stops at the wrong moment, that file can remain and make the site appear stuck in maintenance mode. After confirming that no update or backup is still running, use SFTP or the host’s file manager to remove the stale .maintenance file from the WordPress root, then retry the update. Do not remove it while an active upgrade is still writing files.
Separate a package failure from a permission failure
- Download or unpack error: verify the connection to WordPress services, available disk space and the host’s temporary-directory settings.
- Cannot create or replace files: inspect ownership and write permissions for the WordPress directories. Have the host correct them for the PHP/web-server user.
- Update completes but the site errors: restore the verified backup if necessary, then identify the incompatible plugin or theme in a staging copy before trying again.
- Only one plugin fails: leave unrelated updates alone, record the error and check that plugin’s compatibility and support guidance before forcing a replacement.
Retry without making the problem worse
Do not launch several updates simultaneously, repeatedly refresh a stalled screen or delete random core files. Capture the exact error, the version shown before and after the attempt, the time of failure and any relevant host log entry. With that information, support can distinguish a temporary service interruption from a local permissions or code problem.
Validate a completed installation
A success message confirms that the updater finished its routine; it does not prove that every visitor-facing feature works. Use a short validation pass:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →- Open the home page and a representative content page in a private browser window.
- Sign in and visit Dashboard > Updates to confirm no intended update remains pending.
- Open Tools > Site Health and address critical tests, especially HTTPS, WordPress.org connectivity, background updates and automatic-update status.
- Submit a low-risk form, test search and check media loading if those functions are important to the site.
- Review server and PHP logs for new fatal errors or repeated warnings.
- Keep the backup until the site has passed its normal observation period.
Install new plugins and themes with the same controls
Secure installation begins before a plugin or theme is activated. Use the administrator’s Add New screen or a package obtained from a trusted, identifiable source. Keep HTTPS enabled, read the extension’s requirements and check that it is maintained for your WordPress version. Uploading a ZIP through the dashboard is safer than unpacking unknown files directly on the server because the administrator workflow keeps the installation within WordPress’s normal permission model.
Before activation, make a backup if the extension changes the database, authentication, payments, caching or other site-critical behavior. Activate one substantial extension at a time, test the site, and record what changed. Do not enable automatic updates for an extension you have modified locally unless you have a documented way to merge or restore those changes.
Quick Recap
An ongoing secure-update checklist
- Maintain a verified database-and-files backup and know how to restore it.
- Keep the site, login and administrative transfers on HTTPS.
- Use WordPress.org for official WordPress packages.
- Review Dashboard > Updates on a schedule even when background updates are enabled.
- Use WordPress 5.5-or-newer per-plugin and per-theme controls selectively.
- Remember that WordPress 3.7-and-newer background updates cover minor and security releases; major feature releases normally need an administrator’s action.
- Monitor Tools > Site Health for API connectivity, HTTPS, cron/background-update and automatic-update warnings.
- Resolve ownership and write permissions instead of applying broad, insecure permissions.
- Use SFTP for manual file work and never send credentials through unencrypted FTP.
- After every update, test important visitor and administrator workflows and retain the rollback copy until the result is known to be stable.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
