Start with an inventory
List your theme, plugins and active accounts. Keep necessary extensions with verifiable update sources. Check dependencies before removing a plugin.
Update and recover
Prepare a backup before changes and test important functions after updating. An HTTP 200 response does not prove that forms and orders work.
Use least privilege
Use individual accounts, appropriate roles and additional authentication where available. Revoke access that is no longer needed and monitor relevant security alerts.
