WordPress updates and security in Enhance

Before you start

• The website must appear in the website's “Apps” tab in Enhance (“Websites”, then your website). If you installed WordPress another way, for example manually or moved from another host, click “Scan”: Enhance looks for WordPress installations in the website's folder and adds them to the list.
• The page with all the WordPress tools opens when you click, in the “Apps” tab, the website's card or the “Toolkit” button on the card. Steps B to D start from this page.
• Before major updates (a new WordPress version, a theme or a page builder), make a backup of the website. The steps are below, under A.
• Separately, we back up the whole server every night. We restore from a copy from the last 7 days free of charge: just write to us and we'll do it.
• The names in this guide are the ones from the English Enhance interface. If Enhance opens in another language, you can switch it to English from the top right: your photo or initials » “My account” » “Language”.

The steps

A. Make a backup of the website

1. On the website page in Enhance, open the “Backups” tab. If you don't see it, it's in the “Advanced” menu at the end of the row of tabs.
2. Click “Create backup” (with the language set to “English (US)”, the button is called “Backup now”). In the “Backup website” window you can write a note, for example “before update”, then click “Backup now”.
3. Wait for the backup to appear in the list. It includes the website's files, databases and email. You'll find how to restore it in the guide “Backup and restore in Enhance”.

B. Update now

4. In the “Apps” tab, open the website's WordPress page.
5. Under “General”, below “WordPress version”, you see the installed version. If a new one is available, it's shown underneath, with “Patch update”, “Minor update” or “Major update”. Click “Update now” on its row.
6. Under “Plugins”, plugins with a new version show the message “A new version of … is available”. Click “Update now” on each one. If the list doesn't look up to date, click the refresh button (“Refresh table”).
7. Themes have no update button in Enhance. You update them from WordPress, under Dashboard » Updates, with Update Themes, or you turn on automatic updates for them (step 11).
8. Open the website and check the important pages: the home page, the contact form and, if you have an online store, the cart.

C. Set up automatic updates

9. Under “General”, next to the text “Update only to minor versions”, click the pencil. The “WordPress update schedule” window opens, with two options:

   • “Update only to minor versions”, marked “Recommended”. This is the setting every installation starts with, and the one we recommend too: versions like 7.1.3 install on their own, while major ones, like 7.2, you install yourself, after a backup;
   • “Always update to the latest available version”: for simple websites you don't want to keep an eye on.

   Choose and click “Save”.

10. Under “Plugins”, click “Enable auto-updates” on each plugin you want updated automatically, then confirm with “Enable”. After each automatic update, WordPress sends an email to the administrator's address. Plugins installed from outside WordPress.org, for example purchased ones, don't follow this setting and are updated by hand.
11. Under “Themes”, click “Enable auto-updates” on the theme you use and confirm with “Enable”.

D. Restrict access to the WordPress dashboard

12. Under “Security”, turn on “Restrict admin access”. From then on, the WordPress login page opens only from the IP addresses you add. This stops password-guessing attempts.
13. In the “IP address” box, enter the IP address you work from and click “Allow”. Add one for each place you log in to WordPress from.

Use it only if you have a fixed IP address, for example at the office. With many home and mobile connections, the address changes from time to time, and then you can't get in either.

Other useful options on the WordPress page

• “Maintenance mode”, under “General”: visitors see a page saying the website is being worked on while you make changes.
• “WordPress users”: add other administrators or change their password, with “Change password”.
• “Single sign on”: choose which user the “Login to admin” button logs you in to WordPress as.
• “Debug”: turn on WP_DEBUG and WP_DEBUG_LOG only while you're looking for an error, then turn them off. WP_DEBUG_DISPLAY shows errors right on the page, so any visitor can see them too.
• Search engine indexing isn't set in Enhance, but in WordPress, under Settings » Reading. If you turned it off while building the website, don't forget to turn it back on at launch.
• Enhance doesn't check plugins for known vulnerabilities. Keep them up to date and delete the ones you don't use, with “Delete”.

If something doesn't work

• After an update, the website shows “There has been a critical error on this website” or a blank page. Deactivate the plugin you updated last directly from Enhance, with “Deactivate” under “Plugins”: you don't need to log in to WordPress. If it still doesn't work, restore the backup from step A in the “Backups” tab, with “Restore”. You can also write to us: we restore from the daily backup free of charge.
• A paid plugin won't update. Premium plugins require an active license in WordPress. Update it from the WordPress dashboard or from the developer's website.
• After turning on “Restrict admin access”, you can't log in to WordPress. Your IP address has changed. In Enhance, under “Security”, add the new address or turn off “Restrict admin access”.
• The update or backup fails. Check your free space (the guide “How much space you use and what takes it up”). If there's enough, write to us.
• The website doesn't appear in the “Apps” tab, even after “Scan”. The message “No new application installations have been found” appears when Enhance can't find a working WordPress installation in the website's folder. Write to us and we'll take a look.