WP Toolkit makes it easy to keep your WordPress sites up to date and secure. Outdated WordPress installations are a common target for hackers, so regular updates and security hardening are essential. This guide covers updating and securing WordPress through WP Toolkit.

### Updating WordPress Manually

1. Log in to **Plesk**.
2. Go to **WordPress**.
3. If an update is available, you will see a notification next to the installation (e.g., "Install plugin updates", "Update WordPress").
4. Click the notification to view available updates.
5. Select the updates you want to install. Keep the **Restore Point** checkbox selected to create a backup before updating.
6. Click **Update**.
7. Wait for the update to complete. Your site will be briefly unavailable during the process.

### Configuring Automatic Updates

1. Go to **WordPress** and click on your WordPress installation.
2. Click **Autoupdate settings**.
3. Choose your preferences:
   - **Update WordPress automatically:** Select "Yes, but only minor (security) updates" for production sites, or "Yes, all" for staging sites.
   - **Update plugins automatically:** Select "Defined individually, but security updates are autoinstalled" for the best balance of security and stability.
   - **Update themes automatically:** Same recommendation as plugins.
4. Click **OK**.

### Securing Your WordPress Installation

1. Go to **WordPress**.
2. If security issues are detected, you will see a warning message (e.g., "Fix security" or "Check security").
3. Click the security message.
4. Review the list of available security measures:
   - **Critical measures:** Turn off XML-RPC pingbacks, set secure file permissions, prevent directory listing, and more.
   - **Recommended measures:** Additional hardening steps for improved security.
5. Select the measures you want to apply.
6. Click **Secure**.

You can also secure multiple installations at once by clicking **Security** at the top of the WordPress page.

### Important Notes

- Always create a **restore point** before updating WordPress core.
- Security measures applied by WP Toolkit can sometimes affect plugin functionality. If something breaks, use **Revert** to undo specific measures.
- Automatic updates for plugins and themes can be configured individually — go to the **Plugins** or **Themes** tab on the installation card.

### Troubleshooting

**Website breaks after an update:**

- Go to **WordPress** → click **Back up / Restore** on the installation card.
- Restore the backup that was created before the update.

**Security measures broke a plugin:**

- Go to **WordPress** → click the security status message → select the problematic measure → click **Revert**.

### Related Guides

- [Install WordPress first](/hc/help/en/articles/how-to-install-wordpress-using-wp-toolkit-in-plesk)
- [Set a supported PHP version](/hc/help/en/articles/how-to-change-the-php-version-for-a-domain-in-plesk)
- [Clone before big changes](/hc/help/en/articles/how-to-clone-your-website-in-plesk)