WordPress Manual Update Plugin: 3 Easy Ways

Why You Need a WordPress Manual Update Plugin Strategy

To manually update a WordPress plugin, use these methods:

WordPress Dashboard Upload: First, download the plugin’s ZIP file from its trusted source (like WordPress.org). In your WordPress admin, go to Plugins > Add New, click ‘Upload Plugin’, select the downloaded ZIP, and then choose ‘Replace current with uploaded’ when prompted.
SFTP/FTP: Download and unzip the plugin file on your computer. Connect to your website using an SFTP/FTP client (like FileZilla). Navigate to the wp-content/plugins/ directory on your server. Rename the existing plugin’s folder (for example, change plugin-name to plugin-name-old). Finally, upload the new, unzipped plugin folder to the plugins directory.

Have you ever tried to update a plugin automatically, only to see that frustrating “Plugin upgrade Failed” message? Don’t panic; it happens more often than you might think. While WordPress’s automatic updates are fantastic for minor and security releases, sometimes you need to take matters into your own hands. This is where understanding the wordpress manual update plugin process becomes a crucial skill for any site owner.

Whether it’s a premium plugin without auto-updates, a server configuration issue, or a failed automatic update, knowing how to manually update a plugin ensures your site stays secure and functional. Ignoring updates can leave your site vulnerable; for example, a 2019 Sucuri report found that 52% of hacked WordPress sites were not up-to-date. This guide will walk you through the essential methods and best practices to keep your plugins current, safe, and running smoothly.

I’m Kevin Gallagher. With over fifteen years of experience and having managed hundreds of WordPress websites, I’ve seen the importance of mastering the wordpress manual update plugin process. My goal is to help you confidently maintain your site, ensuring it remains robust and secure.

Know your wordpress manual update plugin terms:

Why You Need a WordPress Manual Update Plugin Strategy

Automatic updates are the “easy button” of the WordPress world. Since WordPress 3.7, we have enjoyed automatic background updates for minor core releases, and version 5.5 extended this to plugins and themes. However, “automatic” does not mean “invincible.” In a complex ecosystem with over 60,000 plugins available in the official repository alone, the interaction between server environments, PHP versions, and database configurations can lead to unexpected failures.

There are several scenarios where a manual approach is not just a backup plan, but a necessity for maintaining site integrity and uptime:

Security Patches and Hacked Sites

As mentioned in the intro, 52% of WordPress sites were hacked when they were not up to date. Hackers love outdated code because the vulnerabilities are well-documented in public databases like the WPScan Vulnerability Database. If your automatic update fails due to a script timeout and you ignore it, you are essentially leaving your front door unlocked. A manual update ensures that even if the automated system glitches, your security patches are applied correctly. This is especially critical for “Zero Day” vulnerabilities where every hour of exposure increases the risk of a data breach.

Server Timeouts and Configuration Errors

Sometimes, your server is just having a bad day. If a plugin file is large (some page builders or e-commerce extensions can exceed 20MB) or the WordPress.org repository is experiencing heavy traffic, the connection might time out. You might see an error like “Connection timed out” or “Briefly unavailable for scheduled maintenance” that persists longer than a few seconds. In these cases, your server’s PHP memory limit or the max_execution_time directive might be too low to handle the automatic download, extraction, and file replacement process. Manual updates bypass these specific PHP script limitations by using external protocols like SFTP.

Premium Plugins and Third-Party Repositories

Many premium plugins—the ones you buy from independent marketplaces or directly from developers—don’t always play nice with the standard WordPress update notification system. If a developer hasn’t integrated their own update API or if your license key has expired/glitched, you won’t see that little red notification bubble. In these instances, the only way to stay current is to visit the developer’s portal, download the latest stable release, and perform a manual update. This is common with high-end tools like Advanced Custom Fields Pro or specialized WooCommerce extensions.

File Permission Errors

If your hosting environment has restrictive file permissions (often seen in highly secure or improperly configured shared hosting), WordPress might not have the “authority” to overwrite existing files in the wp-content/plugins/ directory. This results in a “Could not create directory” or “Update failed” error. When this happens, the dashboard update will fail every time, requiring you to step in via SFTP to swap the files manually using your administrative server credentials.

Version Rollbacks and Compatibility Testing

Sometimes, the newest version of a plugin is the problem. If an update breaks your site’s layout or causes a conflict with another tool, you may need to manually “update” to an older, stable version (a process known as a rollback) while you wait for a developer fix. Manual management gives you total control over exactly which version of the code is running on your server, allowing for precise troubleshooting and version pinning.

Essential Prerequisites Before Attempting a Manual Update

Before we start moving files around, we need to talk about safety. In our work at wpOncall, we never touch a site without a safety net. Manual updates involve deleting and replacing core files; if something goes wrong mid-transfer—such as a lost internet connection or a server crash—your site could go offline or display the dreaded “White Screen of Death.”

1. Full Site Backup (Files and Database)

This is non-negotiable. You need a complete copy of your database and your files. While a plugin update primarily affects the files in wp-content/plugins/, many plugins also run database migration scripts upon activation. If the file update succeeds but the database migration fails, you need a way to restore your backup immediately. We recommend using a combination of a cloud-based backup (like UpdraftPlus or BlogVault) and a local copy downloaded to your hard drive before you begin any manual file manipulation.

2. Staging Environments

If your website is the lifeblood of your business (like an e-commerce store or a high-traffic lead generation site), you should never test updates on the live site first. A staging site is a clone of your live website hosted on a private URL where you can break things without anyone noticing. Perform the wordpress manual update plugin process on staging first. Check for console errors, layout shifts, and functional breaks. If it works there, you can proceed to the live site with total confidence. Most modern managed WordPress hosts offer one-click staging environments.

3. Check System Requirements

Is your server ready for the new version? Sometimes a plugin update requires a newer version of PHP or a specific MySQL version. For instance, many modern plugins are moving toward requiring PHP 8.0 or 8.1. Check the system requirements to ensure your hosting environment matches what the plugin developer recommends. You can check your current environment by going to Tools > Site Health > Info in your WordPress dashboard. Currently, WordPress officially recommends PHP 7.4 or higher, but for security and speed, PHP 8.1+ is the industry standard.

4. Admin and SFTP Access

Ensure you have your login credentials ready before you start. You will need:

WordPress Administrator credentials: To access the dashboard and verify plugin status.
SFTP/FTP host address: Usually your site’s IP address or a hostname like sftp.yourdomain.com.
Username and Password: These are different from your WordPress login; they are provided by your web host.
Port Number: Usually 22 for SFTP or 21 for standard FTP.
Access to Hosting Control Panel: (cPanel, Plesk, or a custom dashboard) just in case you need to access a web-based File Manager if your SFTP client fails.

Method 1: Updating via the WordPress Dashboard

Since the release of WordPress 5.5, the dashboard method has become the preferred “manual” way for most users. It is significantly faster than using FTP and doesn’t require any extra software. This method is ideal for users who have the ZIP file of a plugin but want to avoid the technical overhead of server-side file transfers.

ZIP File Handling and Browser Quirks

When you download a plugin from the official plugin repository, it comes as a compressed .zip file. It is vital that you do not unzip this file if you plan to use the Dashboard method. WordPress’s internal installer is designed to handle the decompression and placement of files automatically.

The Safari Warning: If you are using the Safari browser on a Mac, it might be configured to “Open ‘safe’ files after downloading,” which automatically unzips the file. If this happens, you’ll see a folder instead of a ZIP file in your Downloads. To fix this, you must right-click that folder and select “Compress [folder-name]” to turn it back into a ZIP file before WordPress will accept it. Alternatively, disable this setting in Safari Preferences under the ‘General’ tab.

Step-by-Step WordPress Manual Update Plugin Upload via Dashboard

Download the Plugin: Visit the WordPress.org repository or your premium plugin provider’s account page and download the latest version to your local machine.
Navigate to Plugins: Log into your admin area and go to Plugins > Add New in the left-hand sidebar.
Upload: Click the “Upload Plugin” button located at the top of the screen.
Choose File: Click “Choose File” and select the ZIP file from your computer. Ensure the file name looks like plugin-name.zip.
Install Now: Click the “Install Now” button. WordPress will upload the file to a temporary directory on your server.
The Comparison Screen: This is the most important step. WordPress will detect that the plugin is already installed. It will present a table comparing the “Current” version (what is on your server) and the “Uploaded” version (what you just uploaded). It will show the version numbers, author names, and requirements.
Replace Current with Uploaded: If the uploaded version is newer (or even if it is the same and you are trying to fix a corruption), click the blue button that says “Replace current with uploaded.”
Success and Activation: WordPress will delete the old folder, extract the new files, and provide a success message. Click “Activate Plugin” to ensure the new code is initialized. Always visit your site’s front end immediately after to ensure no visual errors have occurred.

Troubleshooting Dashboard Uploads

If you receive a “Link you followed has expired” or “File exceeds uploadmaxfilesize” error, this means your server’s PHP settings are too restrictive. You may need to increase the upload_max_filesize and post_max_size in your php.ini file or contact your host to have them increased to at least 32MB or 64MB.

Method 2: Updating via SFTP or FTP

If the Dashboard method fails due to file size limits, server timeouts, or if you simply prefer a more “hands-on” approach to file management, SFTP (Secure File Transfer Protocol) is your most reliable tool. It allows you to move files directly onto your server’s file system, bypassing the WordPress application layer entirely.

Why Use SFTP Instead of FTP?

At wpOncall, we always advocate for SFTP. While standard FTP (File Transfer Protocol) sends your login credentials in plain text—making them vulnerable to “man-in-the-middle” attacks—SFTP encrypts both the commands and the data being transferred. Most modern, reputable hosts provide SFTP access by default via port 22. If your host only offers FTP, consider it a security red flag.

Tools of the Trade

You will need a dedicated FTP client. We recommend the following industry standards:

FileZilla: A free, open-source client that is highly customizable and works on Windows, Mac, and Linux. Download FileZilla here.
Cyberduck: An excellent, user-friendly option for Mac and Windows users that integrates well with cloud storage as well.
Transmit: A premium, high-performance client for Mac users who want the fastest possible transfer speeds.

Executing a WordPress Manual Update Plugin Transfer via SFTP

Connect to Your Server: Open your client (e.g., FileZilla) and enter your host, username, password, and port. Click “Quickconnect.” You should see your local files on the left and your server files on the right.
Locate the Plugins Folder: In the “Remote Site” window, navigate to the root of your WordPress installation. This is usually public_html, www, or named after your domain. From there, go to wp-content/plugins/.
The Renaming Safety Net: Find the folder of the plugin you want to update. Right-click it and rename it to plugin-name-old. This is a professional safeguard. If the new version you upload is buggy or causes a crash, you can simply delete the new folder and rename the old one back to its original name to restore your site instantly. This is much faster than restoring a full backup.
Prepare the New Version: On your local computer (the left window), unzip the new plugin file you downloaded. You should see a folder containing the plugin’s PHP files and subdirectories.
Upload: Drag the unzipped plugin folder from your computer to the plugins directory on the server. Ensure you are dragging the folder itself, not the ZIP file.
Verify the Transfer: Once the transfer is complete (check the “Successful transfers” tab in FileZilla), log into your WordPress Dashboard. Go to Plugins > Installed Plugins. Ensure the plugin is active and showing the correct new version number in the description.
Cleanup: After you have thoroughly tested the site—checking both the admin area and the public-facing pages—go back to your SFTP client and delete the plugin-name-old folder. Keeping old, inactive code on your server is a security risk and wastes disk space.

Advanced Methods and Troubleshooting Common Issues

For developers, system administrators, and power users, sometimes the graphical interface isn’t the most efficient route. Using command-line tools can save hours of work when managing multiple sites.

WP-CLI: The Command Line Approach

If you have SSH (Secure Shell) access to your server, using WP-CLI (WordPress Command Line Interface) is the fastest way to handle updates. It bypasses the web server and PHP’s web-based limitations entirely. To update a plugin via WP-CLI, use the following command:

wp plugin update plugin-slug

Replace plugin-slug with the name of the plugin’s folder (e.g., akismet or woocommerce). You can also update all plugins at once with wp plugin update --all. This method is immune to dashboard-related errors and is the preferred method for bulk management. You can find more details in the official WP-CLI plugin documentation.

Removing the .maintenance File

During an update, WordPress creates a temporary file called .maintenance in your site’s root directory. This file tells the system to display a “Scheduled Maintenance” message to visitors. If an update fails halfway through—perhaps due to a server crash—this file might not be deleted automatically. Your site will be stuck in maintenance mode. To fix this, connect via SFTP, go to your root directory (where wp-config.php lives), and delete the .maintenance file. Your site will come back online immediately.

Handling the White Screen of Death (WSOD)

If a manual update causes your site to go completely blank, it is likely a PHP fatal error caused by a code conflict. Since you cannot access the dashboard, use SFTP to navigate to wp-content/plugins/ and rename the newly uploaded plugin folder to something like plugin-name-error. This “force-deactivates” the plugin, allowing you to regain access to your dashboard to investigate the error logs.

Method Comparison Table

Method	Skill Level	Best For	Pros	Cons
Dashboard ZIP	Beginner	Quick updates, WordPress.org plugins	No extra software needed, very fast	Can fail on large files or low server limits
SFTP/FTP	Intermediate	Failed updates, large plugins, premium tools	Highly reliable, allows for easy rollbacks	Requires FTP client and server credentials
WP-CLI	Advanced	Bulk updates, developers, automation	Lightning fast, scriptable, bypasses web limits	Requires SSH access and command line knowledge
Hosting File Manager	Beginner/Int	Users without FTP clients	Browser-based, no software to install	Often slower and clunkier than SFTP

Best Practices for Testing and Maintaining Site Stability

Updating is only half the battle; ensuring the site stays functional and performant is the other half. At wpOncall, we follow a strict protocol to ensure that every update—manual or automatic—contributes to site health rather than detracting from it.

The Golden Update Order

Don’t just click “Update All” and hope for the best. There is a logical sequence that minimizes the risk of catastrophic failure. Follow this order:

Plugins First: Update your plugins one by one or in small, related groups (e.g., update all WooCommerce-related plugins together). This allows you to isolate which plugin caused a problem if one arises.
Themes Second: Once plugins are stable, update your theme. Themes often rely on plugin functionality, so having the plugins updated first ensures compatibility.
WordPress Core Last: Finally, update the WordPress core. Developers usually test their plugins and themes against the current and upcoming core versions, so updating core last ensures your “environment” is ready for the new engine.

Deactivate Caching and CDNs

Before performing a manual update, clear and temporarily deactivate any caching plugins (like WP Rocket, W3 Total Cache, or LiteSpeed Cache). Caching can sometimes “serve” the old version of a JavaScript or CSS file even after you’ve replaced the plugin files on the server. This leads to confusing “broken” layouts where the functionality is updated but the styling is not. If you use a CDN like Cloudflare, consider putting it into “Development Mode” during the update process.

Visual Regression Testing

After a manual update, don’t just look at the homepage. A “visual regression” is when a small CSS change in a plugin update breaks the layout of a specific, deep-linked page. Check your:

Contact Forms: Ensure they still send emails.
Checkout Pages: Ensure the payment gateway still initializes.
Mobile View: Ensure the update didn’t break responsiveness.
Search Functionality: Ensure the database queries are still performing correctly.

Use Child Themes for Customizations

If you have made manual customizations to your site’s look or feel, never make them directly in the parent theme’s files. If you manually update a parent theme without a child theme, all your custom code will be overwritten and lost forever. Always use a child theme to house your custom CSS and functions.php snippets. This ensures that when you update the parent theme files, your customizations remain untouched in their separate directory.

Frequently Asked Questions about Manual Plugin Updates

Will I lose my plugin settings if I update manually?

In 99% of cases, no. WordPress plugins are designed to be modular. They generally store their settings, configurations, and user data in the WordPress database (wp_options table), not in the plugin files themselves. When you delete the old plugin folder and upload a new one, the new files will simply call the existing settings from the database upon activation. However, always take a full database backup just in case a specific, poorly coded plugin handles data differently.

What should I do if the “Replace current with uploaded” option does not appear?

This option was introduced in WordPress 5.5. If you do not see this option, it means you are running a dangerously outdated version of WordPress (pre-5.5). In this case, you must use the SFTP method or manually deactivate and delete the plugin from the Plugins screen before uploading the new ZIP file. We strongly recommend updating your WordPress core immediately if this is the case.

How do I handle updates for premium plugins not in the WordPress repository?

You must log into the “Member Area” or “Account” page of the website where you purchased the plugin. Download the latest ZIP file from there. Since these aren’t in the official repository, they won’t benefit from the one-click automatic updates unless the developer has built a custom update engine. You will almost always use the Dashboard Upload or SFTP method to keep these tools current.

Can I manually update a plugin that is currently active?

Yes. When you use the Dashboard “Replace current with uploaded” method, WordPress handles the deactivation and reactivation for you. If you are using SFTP, it is technically safer to deactivate the plugin first, but renaming the folder (as described in Method 2) effectively deactivates it as far as WordPress is concerned, making it safe to swap the files.

What if the plugin update requires a database migration?

Some large plugins, like WooCommerce or LearnDash, will display a notice in your dashboard after the file update saying “Database Update Required.” Always click this button and let the process finish before navigating away. This ensures the data structure in your database matches the requirements of the new code you just uploaded.

Conclusion

Mastering the wordpress manual update plugin process is like knowing how to change a tire on your car. You might not need to do it every day, but when you’re stuck on the side of the road with a “Plugin upgrade Failed” message or a security vulnerability that needs immediate patching, you’ll be glad you have the skills. Whether you choose the simplicity of the Dashboard ZIP upload or the precision of SFTP, the goal remains the same: a secure, fast, and functional website.

Remember the core tenets of WordPress maintenance: always back up your data, test on staging environments whenever possible, and follow a systematic update order to prevent conflicts. By taking control of your plugin updates, you reduce the risk of hacks, improve site performance, and ensure that your digital presence remains professional and reliable.

If the thought of managing these technical details feels overwhelming, or if you simply have more important things to do than troubleshooting SFTP connections and PHP version requirements, we are here to help. At wpOncall, we specialize in taking the stress out of WordPress management. From our base in Santa Rosa, CA, our team provides proactive security monitoring, daily updates, and the expert support you need to keep your site running perfectly 24/7.

More info about WordPress maintenance and support services

Let us handle the technical heavy lifting so you can focus on growing your business. Stay updated, stay secure, and happy blogging!