Update software on your WordPress instance

Amazon Web Services (AWS) and Lightsail do not update or patch the operating system or applications on your instance after you create it. WordPress does install some updates on its own. By default, it installs minor core releases that contain security and maintenance fixes. It doesn't install major core releases automatically. Plugin and theme updates are also manual until you turn on automatic updates for them. Under the AWS Shared Responsibility Model, you are responsible for keeping the WordPress software on your instance up to date.

WordPress software updates regularly include security fixes. Running outdated versions of WordPress core, themes, or plugins is one of the most common causes of compromised websites.

This guide shows you which updates WordPress installs automatically, how to update the WordPress software manually, and how to turn on automatic updates for plugins and themes.

Understand WordPress update types

WordPress software updates fall into the following categories. Each has a different risk profile and update mechanism.

Since WordPress 3.7, WordPress automatically installs minor core releases that contain security and maintenance fixes. This is the default behavior unless you have disabled it. This means a running WordPress instance already receives critical security patches for its current branch. However, when a release branch stops receiving security backports, you must update to a newer major version to keep receiving fixes. For more information, see Updating WordPress in the WordPress documentation.

Prerequisites

Step 1: Back up your instance with a snapshot

Before you update any software, create a backup of your instance. If an update fails or is incompatible with your themes or plugins, you can restore your website from the snapshot.

For more information, see Back up Linux/Unix Lightsail instances with snapshots and Configure automatic snapshots.

Step 2: Update WordPress

Option 1: Update WordPress from the administration dashboard

The simplest way to update WordPress core, themes, and plugins is the one-click update in the WordPress administration dashboard.

Option 2: Update WordPress from the command line

You can also update WordPress from within your instance by using WP-CLI, the command line interface for WordPress. This is useful for scripting updates or when you can't access the administration dashboard. For more information, see the WP-CLI website.

On the WordPress blueprint, the WordPress installation directory is /var/www/html, and WP-CLI is preinstalled and preconfigured with this path, so you don't need to pass a --path parameter. The WordPress files are owned by the admin user.

Step 3: Enable automatic updates

When you enable automatic updates, your website spends less time running software with known vulnerabilities.

WordPress core

Your WordPress instance installs maintenance and security releases automatically. It doesn't install major releases automatically. To move to a new major release, update WordPress manually as described in Step 2. We recommend that you create a snapshot first, and that you test the update on an instance created from that snapshot.

Plugins and themes

Automatic updates from the command line

You can also turn on automatic plugin and theme updates with WP-CLI instead of the administration dashboard. Connect to your instance, and then run the following commands as the admin user.

Step 4: Keep the operating system up to date

Updating the WordPress application alone is not enough to keep your instance secure. The underlying operating system, web server, PHP runtime, and database also receive security patches. The WordPress blueprint runs on Debian, which uses the APT package manager.

Troubleshooting

Your website is stuck in maintenance mode

If an update is interrupted, your website might continue to display "Briefly unavailable for scheduled maintenance." To resolve this, connect to your instance by using SSH and delete the maintenance flag file from the WordPress installation directory:

rm /var/www/html/.maintenance

An update broke your website

Restore your instance from the snapshot that you created in Step 1. For more information, see Create Lightsail instances from snapshots. Then identify the incompatible theme or plugin by testing the update on a non-production copy of your instance.

Plugin or theme updates fail with "Could not move the old version to the upgrade-temp-backup directory"

Before installing an update, WordPress moves the old version to wp-content/upgrade-temp-backup so that it can restore it if the update fails. If you see this warning, update the directory's ownership and permissions, and then retry the update:

sudo chown -R admin:www-data /var/www/html/wp-content/upgrade-temp-backup
sudo find /var/www/html/wp-content/upgrade-temp-backup -type d -exec chmod 2775 {} \;
sudo find /var/www/html/wp-content/upgrade-temp-backup -type f -exec chmod 0664 {} \;

The update fails safely: your website continues to run the old plugin or theme version until the update succeeds.

The one-click update fails with a file permissions error

The dashboard update runs as the web server user, which requires group write access to the WordPress files. This typically happens after you upload plugin, theme, or other files manually over SSH or SFTP, which creates files without group write permission. Connect to your instance by using SSH and restore the ownership and permissions that the blueprint uses:

sudo chown -R admin:www-data /var/www/html/wp-content
sudo find /var/www/html/wp-content -type d -exec chmod 2775 {} \;
sudo find /var/www/html/wp-content -type f -exec chmod 0664 {} \;