Keep WordPress updated

Out-of-date plugins are how most WordPress sites get compromised, and updating them is the chore nobody schedules. strackt keeps track of what's installed, tells you which updates actually matter, and applies them behind a restore point so a bad update is something you undo rather than something you recover from.

What strackt knows about your site

Every managed WordPress site is inventoried automatically, about once an hour: every plugin, every theme, the WordPress version, which of them have updates waiting, and where those updates come from.

That inventory is checked against published vulnerability intelligence, so strackt can tell the difference between "there's a newer version" and "the version you're running has a known security hole."

Updates are sorted by what they're for

On the application page, pending updates are grouped into three kinds:

Security — a known vulnerability affects the version you're running, and this update fixes it. These are pre-selected.

Safe — an ordinary update with no known security issue attached. Also pre-selected.

Needs care — strackt isn't confident enough to apply this one for you. It's shown, never hidden, but it isn't pre-selected. An update lands here when the vulnerability matching it isn't resolved by the available update, or when strackt can't confirm where the update is coming from.

You can always change the selection. The grouping is a recommendation, not a lock.

What the vulnerability notes mean

Where a known issue matches your site, the update sheet says which — and it's careful about what it claims:

• "Fixes CVE-…" — a fix exists and the update in front of you reaches it.
• "Known issue — CVE-…" — the vulnerability affects your version, and this update does not resolve it. Updating is still worth doing; it just isn't the answer to this one.
• "Known issue, no fix available — CVE-…" — the vulnerability has been published with no patched version anywhere. This usually means an abandoned plugin. No update will clear it, so the real fix is to replace or remove the plugin.

That last case is why the notice never disappears on its own, and why it doesn't block your other updates.

When an update can't be applied

Some updates are visible but not installable, and strackt tells you why rather than just refusing:

• The new version needs a newer PHP than the site runs
• It needs a newer WordPress than the site runs
• No download is available — commonly a paid plugin whose licence has lapsed

Each of these names what the site would need. If the answer isn't something you can do from your side — a lapsed licence is between you and the plugin vendor — that's worth knowing before you spend time on it.

Applying updates

You can run updates for one site from its application page, or for every WordPress site in your workspace from Settings → Maintenance.

Either way the same protected sequence runs:

1. If the site is a WooCommerce store, it goes into maintenance mode first, so no order lands mid-update.
2. A restore point is taken — database and files together — and confirmed before anything is changed. If that step fails, nothing is updated.
3. Updates apply in order, and caches are cleared.
4. Maintenance mode lifts, and strackt checks the site is actually up: it signs in locally and loads the homepage from outside.

If something goes wrong, strackt does not roll back on its own. It surfaces the restore point it took at step 2, and you restore in one click. That's deliberate — an automatic rollback after a partly-applied update can lose the orders or posts that arrived in between, so the decision stays yours.

Your dashboard shows a roll-up of everything pending across your sites, with a notice when security updates are waiting.

Updates apply when you approve them — strackt doesn't install them on your behalf.

The rest of the safety net

Restore points before anything risky. Beyond updates, WooCommerce stores get an automatic restore point every hour, because a store loses real money for every hour it can't be rewound to.

A way into wp-admin. The application page can open a one-time signed link straight into your WordPress admin, so you don't need to keep a separate password for it.

Your site, downloadable. From the Protection page you can download a restore point as a complete site archive. It's the same format the import wizard accepts, so it works as a backup, as a way to move a site, and as a way to leave. Your database credentials aren't included in the download. The link is good for an hour, and the file is cleaned up after a day.

From here

• Restore points — how they're taken and how to restore one
• Maintenance windows — control when work happens
• Add a WordPress site