The WordPress Update That Stopped Updates

What happened this week

On Monday, WordPress released version 4.9.3, a routine maintenance release with a long list of small fixes.

Most WordPress sites install releases like this by themselves, in the background, without anybody logging in. Many picked up 4.9.3 within a day.

It turned out to contain a bug in the very part of WordPress that installs updates. A site running 4.9.3 runs into an error when it tries to update itself to anything newer.

On Tuesday, WordPress released 4.9.4 to fix it. But the sites that need the fix are exactly the ones that can no longer install it on their own.

Which sites are affected

Whether your site needs attention depends on what it did between Monday and Tuesday.

• Sites now on 4.9.3 are stuck until somebody updates them by hand.
• Sites still on 4.9.2 should move straight to 4.9.4 by themselves.
• Sites with hosts that manage WordPress may already have been updated.
• Sites with automatic updates switched off were never updating at all.
• Sites on an older major version have bigger questions than this one.

The fourth is the group that should worry most, because it is invisible. Automatic updates can be switched off during a build, or by a plugin, and stay off for years without anyone knowing.

Checking which version you are on

Log in to the WordPress dashboard. The version number appears at the bottom right of most admin screens, and on the Updates screen.

If it says 4.9.3, a notice at the top will also be asking you to update. Take a backup, then update from the Updates screen.

If it says 4.9.4, nothing needs doing. If it shows something older than 4.9, the site is not on the current major version at all, which deserves a closer look than this week's bug.

And if you cannot log in, or do not know who can, sort that out before anything else.

What automatic updates cover

WordPress has updated itself automatically since version 3.7, in 2013. It is one of the best things about it.

By default, though, it only installs minor releases: maintenance and security fixes such as 4.9.3 and 4.9.4. Major versions, such as the move from 4.8 to 4.9, wait for someone to click.

Plugins and themes do not update themselves by default either, and out-of-date plugins are a common way into a WordPress site.

So even a site whose automatic updates work perfectly still depends on a person for most of its updates.

Why automation needs a person

This week's bug is a neat illustration. The system meant to keep sites current broke itself, and the clearest sign was a notice inside the dashboard.

A notice inside the dashboard is only seen by somebody who logs in. On plenty of small business sites, nobody has logged in for months.

WordPress does email the site's administration address about automatic updates. On many sites, that address belongs to whoever built the site, or a mailbox nobody reads.

Automation handles the routine. It cannot notice when it has stopped working, which is the one thing a person checking once a month would catch.

A worked example

A notary office with two locations had a WordPress site built in 2015, and everyone assumed it kept itself up to date.

This week a staff member read about the 4.9.3 problem and asked whether the office's site was affected. Someone logged in to check, for the first time in well over a year.

The site was not on 4.9.3. It was still on the version it had been built with, nearly three years behind, along with most of its plugins.

During the build, the developer had switched off automatic updates in the site's configuration file so they would not interfere with testing. Nobody ever switched them back on.

The dashboard had been showing update notices the whole time, to nobody.

The site was backed up, copied to a test location, and brought up to date in stages, with the appointment request form checked after each step. Automatic updates went back on, and a monthly check went into the calendar.

What a monthly check involves

It does not need to be elaborate. Once a month, someone logs in and looks.

Confirm that WordPress is on the current version, that plugins and the theme are up to date, that none has been abandoned by its author, and that last month's backups ran.

Then load the site as a visitor would, try the contact form with a test enquiry, and make sure it lands.

Fifteen minutes when nothing is wrong. When something is, it is found within weeks rather than years.

Who receives the notices

WordPress sends its update emails to the administration email address in the general settings.

Check what that address is. If it belongs to a developer who has moved on, or an inbox nobody opens, change it to one that somebody actually reads.

Do the same with user accounts. Remove administrator logins belonging to people who have left, and make sure at least two current people can sign in.

Updating by hand, safely

For a site stuck on 4.9.3, the update itself is small and low risk: one click on the Updates screen.

Take a backup first anyway. The habit costs a minute on a small update and saves the site on a large one.

For bigger jumps, such as a major version or years of catching up, test on a copy of the site before touching the live one.

And look at the site after every update, the pages and the forms, rather than assuming success because the screen said so.

The counter-case

For many sites, nothing went wrong this week. Sites on hosts that manage WordPress were probably handled already, and sites still on 4.9.2 will move to 4.9.4 by themselves.

Bugs like this are rare. Automatic updates have worked quietly for years, and switching them off in response would be the wrong lesson.

A small, simple site with few plugins needs less checking than a shop or a booking site, though it still needs someone to look.

Keep automatic updates on, and have a person confirm they are working.

This week

1. Log in to your WordPress dashboard.
2. Read the version number at the bottom right.
3. Take a backup before changing anything.
4. Update to 4.9.4 if the site is on 4.9.3.
5. Check the administration email in the settings.
6. Remove administrator accounts nobody recognises.
7. Book a monthly check with whoever maintains the site.

Step seven matters most. This week's bug will not be the last time automation fails quietly, and a person looking once a month turns a silent failure into a short delay.

Fewer plugins also means fewer updates to watch, which is the subject of the plugin that does one small thing.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.