Safe Updates

A safe update is a run of small steps. Each step is recorded in the run report, and a run can be resumed if a request is cut short.

1. Preflight. Checks that the site can request its own pages, that WordPress may change files, that the filesystem is writable, and that at least 200 MB is free. If one fails, the run is skipped and nothing is changed.
2. Risk. Reads the update before touching anything. An update that needs a newer PHP or WordPress than you run is blocked.
3. Snapshot. Copies the folder and records a SHA-256 hash for every file, plus the options and tables the item owns.
4. Baseline. Fetches each key page twice. Whatever differs (a clock, a nonce) is ignored later.
5. Update. Installs with WordPress’s own upgrader.
6. Settle. Waits a few seconds (five at most) so PHP workers stop serving old code.
7. Verify. Fetches the key pages again and compares them with the baseline.
8. Restore and re-verify. Only if verify fails.
9. Diagnose. Only after a restore, a failed restore, or a failure left in place.
10. Propose. Queues suggested actions for your approval.

Start a run with Safe update on the Dashboard, or with wp update-doctor update. If WordPress is in maintenance mode, Update Doctor waits and never reads a maintenance page as a broken site.

A finished run has one of these statuses:

Status	Meaning
passed	The checks found no differences
warned	Only warnings
restored	The checks failed, the files were restored and the restore was verified
restore_failed	The checks failed and the restore could not be verified. You get a critical notice
regressed	The checks failed and nothing was restored, because you chose “Ask me first” (or it is core)
aborted	The update did not install, so there was nothing to check or restore
skipped	The run did not start (preflight failed, the item is held, or the release is inside the cooldown)
error	The run hit a problem, such as a snapshot that could not be written. Nothing was updated