---
title: "Updating WordPress"
date: "2015-01-23"
category: "wordpress"
slug: "updating-wordpress"
---

## Overview

WordPress and its plugins receive periodic updates that introduce new features, fix performance issues, and patch [security vulnerabilities](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=wordpress). Keeping WordPress up to date is essential to prevent your site from being compromised.

## One-Click Update (Control Panel)

The simplest way to update WordPress:

1. Go to **Web** > **Web Apps** within the [[logging-into-the-control-panel]]
2. Select the hostname from the dropdown list
    - If WordPress is in a subdirectory, click the dropdown and select _Edit Subdir_, then select the folder.

        ![Edit Subdir indicator in Web > Web Apps](kb-image:edit-subdir-indicator.png)
*Edit Subdir indicator in Web > Web Apps*
3. Under **App Meta**, click **Update** in the Version heading
    - If the application has not been previously detected, click **Detect** first
4. WordPress and its plugins will be updated automatically

## Manual Update via FTP

1. Log in to your WordPress admin portal at `wp-admin/` (e.g. `http://example.com/wp-admin`)
2. Look for **Updates** under **Dashboard**. A count badge indicates available updates.

    ![Logging into the WordPress administrative portal when updates are present](kb-image:wordpress-updates-present.png)
*Logging into the WordPress administrative portal when updates are present*
3. Click **Updates**, then select **Update Now** for core updates and/or **Update Plugins** for plugin updates
4. Enter your FTP credentials when prompted:
    - Set **Hostname** to `localhost` (keeps traffic local on the server)
    - See [[accessing-ftp-server]] for your FTP details
    - See [[resetting-your-password]] if you need to reset your account password
5. WordPress will download and install the updates automatically
6. On completion, a confirmation page is displayed and the update badge disappears

    ![Confirmation splash page once WordPress has been updated.](kb-image:wordpress-update-completed.png)
*Confirmation splash page once WordPress has been updated.*

## If Something Goes Wrong

Open a support ticket within the [[logging-into-the-control-panel]] under **Help** > **Trouble Tickets**. Database and filesystem backups can be restored as needed. Update failures are rare unless WordPress core files have been manually modified via the [[accessing-terminal]].

## Why FTP Is Required

ApisCP's security model separates the web server user from your account user. The web server has read-only access to critical WordPress files and can only [[enabling-write-access]] in designated directories like `wp-content/uploads/`. Updates to core files require FTP authentication, which means:

- Your FTP password is not stored on the server
- If your site is compromised, attackers cannot modify core WordPress files
- Damage is limited to directories with explicit write access

The trade-off is entering your FTP password each time you update. For automatic updates without manual intervention, see [[storing-ftp-credentials-for-automatic-updates]].
