Auto-Update Apocalypse: What Can WordPress Learn from the CrowdStrike Outage

You may well be wondering how the CrowdStrike outage is relevant to WordPress. While it reportedly took down 8.5 million devices worldwide, yours may not have been one of them. 

There is one major reason why the CrowdStrike outage is relevant to WordPress: auto-updates. 

Flights grounded, online banking offline, healthcare inaccessible, retail screeching to a halt. All of the mayhem was caused because of a faulty auto-update. 

WordPress updates are already fraught 

We in the WordPress community are already skittish about updates. And for good reason! 

Take page builders for instance; they’re not for the faint of heart. Elementor themselves have several warnings about applying their latest updates. 

Savvy WordPress people opt out of automatic updates. Who knows when a faulty update can take out a site? You may not even find out till days later; unless you have monitoring installed.

Multiply all that hassle if you are managing several sites with the same plugin stack. One faulty auto-update, and it’s lights out on all of them.

So do we just not do WordPress updates?

By no stretch of imagination are we suggesting you forego updates. Updates are important for security. We’d be the first to tell you that. 

Nor are we saying update sites manually. Manual updates take time, and no one can dedicate their lives to WordPress updates because of the risks. 

We simply recommend putting up guardrails. We’ve solved WordPress updates by devising a multi-layered safety net. But the best part? It requires even less effort from you. 

Disable auto updates

First things first. Go into your dashboard, and turn off auto updates completely. We get it; it is very convenient to have small updates run automatically, but there’s a risk with every update, small or big. Don’t worry though, we have a mechanism to automate some of these. 

Schedule automatic backups

Backups are your insurance policy. At the bare minimum, your site should be backed up daily. Changes can happen overnight, and you want to have the flexibility of restoring your site at your fingertips. 

Set up visual monitoring for key pages

Homepage, pricing page, contact forms, and any business critical page should have a visual regression monitor set up. 

Visual regression monitoring compares before and after screenshots of key pages to look for discrepancies. The slightest shift in design or text, and you should get an alarm. Very handy when you are updating multiple sites at once, and cannot spare the resources to check 3-4 critical pages on each one. 

Check the UpdateLens score

UpdateLens uses several parameters to rank updates on their likelihood of success. Every update on our dashboard has a score out of 100. The lower the score, the higher the risk. 

Test, test, test, and test some more

Let’s start with the riskiest updates. The page builders, ecommerce plugins, learning management systems, and other plugins that cause sites to come crashing down with the smallest of changes. Either there is a plugin conflict or a php error, and it is curtains. You must test these out away from your live site. 

The easiest way is to perform the update on a staging site. Staging sites are exact replicas of your live sites, and were historically difficult to create. Not anymore. On your dashboard, you can set up a staging site in seconds from a backup.

Sandbox updates

The safest way to update your WordPress site directly is to use our sandbox updates feature. 

The sandbox update mode first creates a staging site and automatically applies the update there. Then it runs a visual regression test for any differences. If differences are found, you can then visit the staging site and troubleshoot accordingly. 

If all looks good, approve the update and your live site gets the update. No harm, no foul. 

Safe auto-updates

For the smaller plugins, you can still use auto-updates albeit with a BlogVault-ian twist. 

You can set up schedules to check for updates regularly, and have them be applied automatically after your site is backed up. 

These backups are entirely separate from the daily backups you scheduled a few paragraphs ago, and are more akin to the on-demand ones you would usually have before a manual update. 

Set up as many or as few schedules as you like, grouping together low-risk plugins, for example. See? We promised there would be an automated solution to updates. 

Delayed updates

Finally, if the UpdateLens score is low, the update breaks your staging site, and there is no solution in sight? Delay the update by a week. 

In the interim, reach out to the plugin developer for solutions, or spend some time evaluating a replacement. Other users will also have tried and tested the update, and there may be solutions forthcoming from the community. 

Whatever the way forward is, we will send you a reminder to retry the update. 

Parting thoughts

Every user has the right to opt out of an auto-update, and update on their own terms. Updates are critically important, especially from a security perspective. But because updates often bring about chaos, they must be applied mindfully. 

Our aim is to take away the risk, without compromise. Stay tuned as we refine our features to make this, and other site maintenance processes, effortless.