--- title: "WordPress security updates for real estate websites" description: "Define security patch priority, approvals, update evidence, inquiry checks, and escalation for a real estate WordPress website's written care policy." canonical: "https://scalewithsearch.com/articles/agent-wordpress-security-update-care-policy" --- ## Site navigation - [Scale With Search](https://scalewithsearch.com/) - Services - Services - [AI systems](https://scalewithsearch.com/ai-systems) - [Site build](https://scalewithsearch.com/work#site-build) - [Whole website fix](https://scalewithsearch.com/work#whole-website-fix) - [Content library with SEO](https://scalewithsearch.com/work#content-library) - [Working session](https://scalewithsearch.com/audit) - Start here - [Send your brief](https://scalewithsearch.com/work#send-your-brief) - [Example scope](https://scalewithsearch.com/work#review-the-example-scope) - [Prices and terms](https://scalewithsearch.com/work#prices-and-terms) - Industries - Real estate - [Real estate agents and teams](https://scalewithsearch.com/for/real-estate) - [Platforms, ownership, and IDX](https://scalewithsearch.com/for/real-estate/real-estate-website-platforms-ownership-idx) - [Search, content, and AI](https://scalewithsearch.com/for/real-estate/real-estate-search-content-ai) - [Inquiries, campaigns, and handoffs](https://scalewithsearch.com/for/real-estate/real-estate-website-inquiries-campaigns-handoffs) - [Buyer, seller, and local pages](https://scalewithsearch.com/for/real-estate/real-estate-buyer-seller-local-resources) - [Rules, privacy, and trust](https://scalewithsearch.com/for/real-estate/real-estate-website-rules-privacy-trust) - Browse by business - [Trades and home services](https://scalewithsearch.com/for/#group-trades) - [Health, wellness, and animal care](https://scalewithsearch.com/for/#group-practices) - [Law, finance, and IT](https://scalewithsearch.com/for/#group-professional) - [Marketing and SEO agencies](https://scalewithsearch.com/for/#group-agencies) - [Shops and manufacturers](https://scalewithsearch.com/for/#group-manufacturing) - [Restaurants, shops, studios, and nonprofits](https://scalewithsearch.com/for/#group-local-services) - Chiropractic practices - [Chiropractic and wellness practices](https://scalewithsearch.com/for/chiropractic-and-wellness-practices) - [Chiropractic and physical therapy clinics](https://scalewithsearch.com/for/chiropractic-and-physical-therapy-clinics) - [All industries](https://scalewithsearch.com/for/) - Resources - Free tools - [AI readiness check](https://scalewithsearch.com/check) - [Free tools](https://scalewithsearch.com/tools/) - [Free Starter Kit](https://scalewithsearch.com/kit/business-memory-starter-kit.zip) - Guides - [AI-native library](https://scalewithsearch.com/ai-native) - [Industry intelligence](https://scalewithsearch.com/intelligence) - [Office job guides](https://scalewithsearch.com/guides/) - [Business memory](https://scalewithsearch.com/articles/business-memory-for-ai-agents-guide) - [Agent governance](https://scalewithsearch.com/articles/ai-agent-governance-guide-small-business) - [Migration and ownership](https://scalewithsearch.com/articles/leaving-vendor-ai-memory-guide) - Articles - [All articles](https://scalewithsearch.com/articles/) - [What changed](https://scalewithsearch.com/changes/) - About - Evidence - [Proof](https://scalewithsearch.com/proof) - Scale With Search - [About](https://scalewithsearch.com/about) - [How it works](https://scalewithsearch.com/how-it-works) # WordPress security updates: a care policy for real estate websites Put security updates into a written care policy. Name who reviews a notice, who may act, and which website tasks must pass afterward. Require an explanation for any deferred patch. WordPress recommends keeping its software current and obtaining it from official sources. Its hardening guide describes security as reducing risk. A care policy should make that continuing work visible without promising a hack-proof website. [WordPress security guidance, fetched 2026.10.22](https://developer.wordpress.org/advanced-administration/security/hardening/). The priorities and checks below are editorial recommendations for a real estate agent's website. Agree on them with the maintainer. They are not universal vendor deadlines or a legal standard. ## What should a WordPress security-update policy cover? Cover the installed software, security notices, approval path, installation, verification, and failed-update escalation. Include the inquiry path in the acceptance criteria. Identify hosting-runtime work separately so the policy does not silently omit it. ## Which software belongs in the update inventory? Ask for WordPress core, active and inactive plugins, themes, custom code, and connected services. Record installed versions and update sources. Require the maintainer to identify any component whose supplier or update entitlement cannot be confirmed. ## Why distinguish application updates from host security? Because responsibility depends on what each party operates. WordPress's hardening guide separates hosting infrastructure from website applications. Request a written owner for each area rather than relying on the phrase managed hosting. [Host and application responsibilities, fetched 2026.10.22](https://developer.wordpress.org/advanced-administration/security/hardening/). ## Where should the maintainer obtain WordPress updates? Require official WordPress release sources. The hardening guide warns against downloading WordPress releases from other websites. Ask for the component supplier and download route when a paid plugin uses its own update service. [Trusted update sources, fetched 2026.10.22](https://developer.wordpress.org/advanced-administration/security/hardening/). ## What should trigger urgent review? Use a confirmed supplier security notice affecting an installed component as the trigger for urgent review. Ask the maintainer to explain affected versions and exposure. A rumor or generic scanner score should remain a lead for investigation until verified. ## How should urgent work differ from routine updates? Give urgent work a named escalation route and a decision owner. Put routine improvements into a planned maintenance window. Agree on the handling time in the actual care arrangement. No universal response-time promise is made here. ## Does a security notice authorize any website change? Define authorization before an incident. State which update classes the maintainer may install under standing instructions and which need contact first. Include a fallback when the normal approver is unavailable. Keep unrelated redesign and content changes outside that authority. ## Should every automatic update be disabled? Do not make blanket disabling the default response to uncertainty. WordPress strongly discourages disabling its minor background updates. Ask the maintainer to explain the current configuration and a supported alternative for any exception. [Background-update configuration, fetched 2026.10.22](https://developer.wordpress.org/advanced-administration/upgrade/upgrading/). ## Can plugin and theme auto-updates be configured separately? Yes. WordPress documents controls for individual plugins and themes, plus bulk plugin selection. Ask the maintainer to record the chosen setting for each component and who reviews the resulting notifications. [Plugin and theme update controls, fetched 2026.10.22](https://wordpress.org/documentation/article/plugins-themes-auto-updates/). ## Does an enabled auto-update prove the update ran? Require the installed version after the attempt. WordPress documents troubleshooting for unavailable or nonworking automatic updates. Ask the maintainer to investigate failures and retain the result rather than treating a setting as completed work. [Auto-update troubleshooting, fetched 2026.10.22](https://wordpress.org/documentation/article/plugins-themes-auto-updates/). ## Who should receive update notifications? Name a monitored destination and its backup owner. WordPress documents email after successful and failed plugin or theme update attempts. Include those messages in the care record, then require the website checks that follow installation. [Update-attempt emails, fetched 2026.10.22](https://wordpress.org/documentation/article/plugins-themes-auto-updates/). ## What evidence should be retained before installation? Keep the supplier notice, affected component, installed version, proposed replacement, and approval. Add the backup reference and the test plan. WordPress's upgrade instructions recommend backing up before updating and verifying usable backups. [Pre-update backup checks, fetched 2026.10.22](https://developer.wordpress.org/advanced-administration/upgrade/upgrading/). ## When should staging be used? Ask the maintainer to explain the test route for the affected component. For changes requiring a copy, use the staging care brief to protect current inquiries. Require the urgent-update path to account for both exposure and testing time. ## Which visitor tasks should pass after a patch? Require the affected task, seller inquiry route, navigation, and content rendering to pass. Include property search only when the update can affect it. Keep the test route and result specific enough for another maintainer to repeat. ## What proves a form still delivers inquiries? Require a matching controlled message at the intended destination. WordPress's mail documentation says a successful function result does not establish receipt. Compare the question and reply information before closing the update. [Mail receipt limitation, fetched 2026.10.22](https://developer.wordpress.org/reference/functions/wp_mail/). ## What happens when an update breaks a page? Record the failure and invoke the agreed recovery or containment procedure. WordPress warns that reverting to older software can reintroduce security risk. Require the maintainer to explain the remaining exposure and the forward repair. [Rollback cautions, fetched 2026.10.22](https://developer.wordpress.org/advanced-administration/upgrade/upgrading/). ## Can the maintainer defer a security patch? Require a written reason, interim action, owner, and next review point. Keep the supplier's affected-version notice with that decision. An unsupported compatibility claim should remain unresolved until the maintainer produces evidence. ## What if a plugin no longer has a reliable update source? Request a replacement or removal assessment. List the pages and integrations that depend on it. Ask what the substitute must preserve before approving a change. Keep functionality and retained inquiry records in the acceptance scope. ## Does patching resolve a suspected compromise? Treat suspected compromise as separate incident work. WordPress's hardening guidance includes monitoring and backups alongside software maintenance. Ask a qualified responder to assess the actual evidence and the recovery scope. Do not close an incident because an update installed. [Security controls beyond patching, fetched 2026.10.22](https://developer.wordpress.org/advanced-administration/security/hardening/). ## What should the completed update record contain? Keep old and new versions, update source, authorization, installation result, and visitor-task evidence. Identify deferred components and failures. Make the record understandable without a screenshot of an unexplained dashboard score. ## How does this differ from a PHP upgrade? This policy covers application patch decisions. WordPress lists PHP as a hosting requirement. [WordPress hosting requirements, checked 2026.10.22](https://wordpress.org/about/requirements/). Request a separate compatibility plan for a PHP upgrade. Ask the maintainer to identify runtime work as a separate item rather than marking it complete with a WordPress update. ## What should a real estate agent request from the maintainer? Request the inventory, monitored notice route, agreed urgency handling, approval boundaries, and a sample completion record. Use the [website ownership checklist](/articles/own-your-site) for account control. Accept a care policy only after its responsibilities and evidence are clear. Bring the approved requirements and acceptance checks to the [real estate website brief](/for/real-estate). - [Website maintenance contract checks for real estate agents](/articles/agent-website-maintenance-agreement-checks) - [PHP upgrades for real estate WordPress websites: define the scope](/articles/agent-wordpress-php-upgrade-scope) - [Shared hosting vs VPS for a real estate website](/articles/shared-hosting-vs-vps-agent-website) ## Related: Real estate - [Website maintenance contract checks for real estate agents](/articles/agent-website-maintenance-agreement-checks) - [PHP upgrades for real estate WordPress websites: define the scope](/articles/agent-wordpress-php-upgrade-scope) - [Shared hosting vs VPS for a real estate website](/articles/shared-hosting-vs-vps-agent-website) ---- ```text .|########||. .|########||. .|########||. |##||. .||##|. |##||. .||##|. |##||. .||##|. |#|. .|#|. |#|. .|#|. |#|. .|#|. |#| |#| |#| |#| |#| |#| .#| |#. .#| |#. .#| |#. .#. .#| .#. .#| .#. .#| |#. .#| |#. .#| |#. .#| |# ...... #| |# ...... #| |# ...... #| .# ||#########| #| .# ||#########| #| .# ||#########| #| .#. |######||######|. .#. .#. |######||######|. .#. .#. |######||######|. .#. #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# # .||####|###########################|. # # .||####|###########################|. # # .||####|###########################|. # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || #. .######|#|#########| .# #. .######|#|#########| .# #. .######|#|#########| .# .#. |#####||||#####| .#. .#. |#####||||#####| .#. .#. |#####||||#####| .#. |# ||########|| #. |# ||########|| #. |# ||########|| #. |# ...... #| |# ...... #| |# ...... #| |#. .#| |#. .#| |#. .#| |#. .#. |#. .#. |#. .#. .#| |#. .#| |#. .#| |#. |#| |#| |#| |#| |#| |#| .|#|. .|#|. .|#|. .|#|. .|#|. .|#|. |##||. .||##| |##||. .||##| |##||. .||##| .||########||. .||########||. .||########||. Scale With Search 2026 [scalewithsearch.com](https://scalewithsearch.com) ```