Skip to content

Website Maintenance Updates

This guide explains how to check for, apply, test and deploy WordPress plugin/theme updates when a site is managed through Git, Composer, and GitHub Actions.

This process applies to most of our WordPress projects where the repository is the source of truth for managed code.

Core Idea

Plugin and theme updates should be tracked in Git.

WARNING

Do not update managed plugins or themes directly in WordPress Admin, on the server, or with wp plugin update as the normal process.

Updates MUST be made through composer. View example below.

  1. Check for available updates with Composer.
  2. Create an update/ branch in git.
  3. Update composer.json and composer.lock.
  4. Test locally.
  5. Open a pull request into dev.
  6. Merge into dev to deploy to the dev server.
  7. Promote to staging and production through the normal branch workflow.

Check Updates with Composer

From the project root:

ddev composer install
ddev composer outdated --direct

To check only non-dev dependencies:

ddev composer outdated --direct --no-dev

This will show packages that have newer versions available.

Choosing What to Update

Prefer small, reviewable updates in your commits.

Update Contact Form 7 to 6.1.7
Update Kadence Blocks to 3.6.8

Update all plugins and themes

For routine maintenance, update one or a small group of related packages at a time.

Update Workflow

1. Start from the latest dev

git checkout dev
git pull origin dev

2. Create an update branch

Use a clear branch name:

git checkout -b update/plugins

git checkout -b update/themes

3. Install current dependencies

ddev composer install

This ensures the working copy matches composer.lock before updates are made.

4. Review available updates

ddev composer outdated --direct

5. Update a specific plugin or theme

We use exact version pins, so the update process needs to be very intentional. Let's look at a plugin example and a theme example below:

ddev composer require wpackagist-plugin/contact-form-7:6.1.7 --no-update
ddev composer update wpackagist-plugin/contact-form-7 --with-dependencies

ddev composer require wpackagist-theme/kadence:1.5.0 --no-update
ddev composer update wpackagist-theme/kadence --with-dependencies

Protip

The --no-update step changes the requested version in composer.json first.
The composer update step updates composer.lock and installs the selected package version locally.

We use this same process for all composer-managed plugin and theme updates.

6. Commit the update

Use a clear commit message.

Example:

git add composer.json composer.lock
git commit -m "Update Contact Form 7 to 6.1.7"

Then push to the update/ branch:

git push origin update/plugins

Make a pull request into the dev branch. After review/approval, merge into dev and the changes will automatically be deployed to the dev server.

From there, continue PRs, reviews and deployments like any other update.