How-to · Beginner · 15 minutes weekly
How to Keep Site Software Updated
Everything you need to a routine that closes holes in your software before anybody gets round to using them — the steps in order, the snag to watch, and the tip our support desk gives everybody.
Straight answer first
In a line: a routine that closes holes in your software before anybody gets round to using them — a beginner-level task that takes 15 minutes weekly.
Below you get the exact steps, the classic snag, and a tip from the support desk. Where our platform handles a step for you, the guide says so rather than making you do the robot's work.
Written by the Hosting Seller staff · Checked 1 August 2026
Beginner
Difficulty level
Quick
Time to allow
5
Stages
24/7
Help at any hour
This guide assumes no expertise at all — just a hosting account, a browser and 15 minutes weekly of attention. Every instruction works on our platform exactly as written, and carries over to any standard cPanel host.
One promise before you start: nothing in this guide is irreversible. Where a step could bite, we say so and give you the undo.
The whole job at a glance
The job breaks into a few clear stages: write down everything that updates, automate the safe ones, book fifteen minutes a week, let the toolkit take the risk and drop what you keep postponing.
Each stage is a few minutes of steady clicking — the time it takes depends mostly on how familiar the control panel already feels. The detailed steps sit further down this page; skim the whole route once before you begin.
The mistake nearly everyone makes
The 'if it works, do not touch it' school of thought. In connected software, untouched means unpatched, and unpatched WordPress components are the biggest single cause of compromised sites. Leaving it alone is the riskiest setting available.
Forewarned really is forearmed here. This one mistake accounts for most of the frustration the subject produces, and it is entirely avoidable once somebody names it.
One habit that makes this easy for good
Automate everything that can safely automate itself, let the weekly quarter-hour cover the rest, and stop reading security newsletters. Updating should be a calendar habit, not a news-watching job.
Small habits like this are the real difference between people who find hosting easy and people who find it stressful. The tools are identical; the working method is not.
The parts we have already done for you
Several steps in this guide exist only because hosting historically made you do them. On our plans SSL issues itself, backups run daily without being asked, and one-click installers replace the manual setup entirely. What is left is the part that is genuinely yours.
Stuck halfway through at an odd hour? That is exactly what round-the-clock human support is for — tell us where you are in this guide and we will pick it up from there.
A good platform makes every guide shorter
Tutorials age badly when they are written against imaginary hosting. These are written against ours: the same panel, the same installer and the same defaults you will meet.
Real people answer the counter at any hour, including the awkward questions other hosts wave off as out of scope.
- Step by step, tested exactly as printed
- The snag flagged before you reach it
- The dull steps are already automated
- People on hand at any hour if you stall
Why Hosting Seller
On every plan, as standard
The undo is always named
Where a step could bite, the guide says so and tells you how to put it back again.
The snag, named early
The classic mistake for this exact job is flagged before step one, so 15 minutes weekly stays 15 minutes weekly.
Help on the counter
Stuck on step three at midnight? Support answers at any hour, mid-guide included.
Automation where it belongs
SSL, backups and installs run themselves here, so the guide covers only what is genuinely yours to do.
No jargon toll
Terms are explained where they appear or linked to the glossary — nothing assumes you already know.
Works exactly as written
Every step tested on the platform we run — no 'your host may differ' hand-waving anywhere.
First Steps
From choosing to live
- 1
Write down everything that updates
Core platform, plugins, themes and the PHP version. The whole list, because attackers go looking for precisely the component you forgot you were running.
- 2
Automate the safe ones
Minor core releases and plugins you trust can update themselves. The security fixes that matter most arrive through exactly that channel, usually while you are asleep.
- 3
Book fifteen minutes a week
Back up, update, click through. A rhythm beats heroics, and small batches make any problem easy to pin on the change that caused it.
- 4
Let the toolkit take the risk
WordPress Toolkit's staged updates clone the site, update the copy, compare screenshots and then apply. It automates the caution, whether you run one site or fifty.
- 5
Drop what you keep postponing
The plugin whose update you keep deferring is telling you something. Abandoned or troublesome components want replacing, not a standing exemption from maintenance.
In the Box
Packed with every plan
- A free SSL certificate on every plan, reissued before it lapses
- Mailboxes that carry your own domain name
- Spam and virus filtering fitted to every mailbox
- Staging copies so changes get tested before they go live
- A backup taken daily, with restores you run yourself
- Webmail in the browser plus IMAP, POP and SMTP for your own client
- cPanel, the panel the rest of the trade already knows
- NVMe SSD storage on every shelf, not just the top one
- Real people on the counter, every hour of every day
- One-click installs for WordPress and 400+ other applications
Across the Counter
The questions we get asked most
What happens when an update breaks the site?
The pre-update backup — automatic on our plans, plus whatever snapshot you took yourself — makes it a five-minute rollback, and the fix then happens on a staging copy. The occasional broken update costs far less than standing still with a known hole.
Which updates cannot wait for the weekly slot?
Security releases. Core security point-releases, and patches for plugin holes already being exploited, deserve same-day attention. Feature updates can wait for the weekly ritual — the security ones are the reason the ritual exists at all.
Can I test changes somewhere safe first?
Yes — plans with staging let you clone the live site, work on the copy, then push it across when you are satisfied. It is the difference between hoping an update behaves and knowing that it does before any customer meets it.
Who actually runs the company?
Hosting Seller is a trading name of Bohzo Ltd, a company registered in England and Wales — a real business with a public record and terms published under English law. Looking that up is worth doing about any host before you hand over your domain.
What happens to my files if I leave?
The site and the files stay yours. Pull a full backup from the panel whenever you like, before or during cancellation. Domains remain registered in your name for the term you paid for and can move to any registrar once the standard 60-day window has passed.
Do you shift an existing site across at no charge?
We do. Open a ticket with the login details for your current host and the whole lot comes over: files, databases, mailboxes and configuration. You check the copy before DNS changes hands, and the old site keeps serving customers until the new one takes the traffic, so nobody ever sees a gap.
What if the site outgrows the plan I bought?
You move up in place. Plan changes are made from the client area with no migration and no downtime, and the range runs from small shared accounts through VPS to whole dedicated servers. Growing becomes a line change on your account rather than a hunt for a new host.
Read next
How to Set Up Domain Forwarding
Send everyone who types one domain straight through to another one — beginner level, about 5 minutes.
How to Create a WordPress Child Theme
Customise a theme in a way that survives the next update intact — intermediate level, about 30 minutes.
Web Hosting
cPanel hosting on NVMe disks, with SSL, migration and year-one domain included.
VPS Hosting
KVM virtual servers with root access, DDoS filtering and one flat price.
Packing up and moving host? Take our checklist.
A plain running order for a move nobody notices: what to copy first, how to carry email across without dropping a single message, when to point DNS, and the two slips behind nearly every hour of downtime we get called about.
Do the launch properly this time.
Free SSL, a free move in, renewals charged at the order price, and human support around the clock. That is the whole offer.
See the plans