Updates done for you, tried on a copy first.
Safe updates means we keep your website's software up to date, and we try updates on a private copy of your site first. We check your pages, forms and bookings on that copy, and only then update the real site. Anything risky waits, and we tell you why.
In one sentence: we keep the software behind your website up to date, test updates on a copy before your customers see them, and hold back anything that looks likely to break a page, a form or a booking.
What actually gets updated on a website?
Most small business websites are built from three layers of software. Each one gets new versions from its makers, and each one can break the others.
- The core. This is the main system your site runs on, for example WordPress. Its makers release security fixes several times a year and bigger new versions less often.
- The theme. This controls how your site looks: fonts, colours, the menu, the layout of each page.
- Plugins. These are small add-ons that do one job each: your contact form, your booking calendar, your photo gallery, your cookie banner. Most sites have several, and each one is made by a different company, on its own schedule.
There's a fourth layer most owners never hear about: the server software your website runs on, such as PHP (the programming language most of these sites are written in). When that gets old, it stops getting security fixes, and newer plugins stop working with it.
What can go wrong with updates?
Updates go wrong in two ways: when they're done carelessly, and when they're not done at all. These three examples are typical of what goes wrong on small business websites.
- The booking button that moved off the screen. A booking add-on updates itself overnight. On desktops it looks fine. On phones, the new version pushes the "Book now" button below the footer. Nobody notices for two weeks, because the owner only checks the site on a laptop.
- The theme update that wiped years of changes. A past developer edited the theme's files directly to add a special banner and a custom menu. The owner clicks "Update theme", and every one of those changes disappears, because they lived inside the files that were replaced.
- The site nobody updated for two years. The owner was afraid to press Update after a bad experience. Meanwhile, an old form add-on had a published security hole. Automated bots found it, and the site started sending visitors to a fake pharmacy shop.
The first two are why updates need testing. The third is why they can't be skipped. Safe updates exist to avoid both.
Why can't I just turn on automatic updates?
You can, and for some small add-ons it's fine. The trouble is that nobody checks afterwards. Automatic updates put a change straight onto your live site, at a time you didn't pick, with no copy tested first and no one looking at your forms the morning after.
Four steps, in this order.
A "staging copy" is a private copy of your website that customers can't see. It's where we try updates first, so any mistake happens somewhere safe.
Back up first
We take a fresh full backup of your site just before any update, on top of your regular ones. If anything goes wrong later, we can put things back as they were.
Before updatingUpdate the copy
We copy your live site to the private staging copy and apply the updates there, one group at a time, so we know which update caused any problem.
On the staging copyCheck what matters
We compare your key pages before and after, on a phone and a desktop. We send a test through each form and open the booking path. If anything looks or works differently, that update waits.
Phone and desktopUpdate the real site
Updates that passed go onto your live site, at a quiet time for your business. Then we check the live pages and forms again, because a live site is never quite the same as a copy.
At a quiet timeThe update routine, at a glance.
It's a routine, not something left to memory. Here's what it covers.
| What we do | When | Why it matters to you |
|---|---|---|
| Check which updates are waiting | Automatic checks, read by a person | We hear about security fixes for your site soon after they're released. |
| Serious security fixes | Applied quickly, tested first | These jump the queue. If a fix needs more testing, your firewall helps block attacks on that hole in the meantime. |
| Routine add-on and theme updates | Regularly, in tested batches | Small, regular updates are safer than one giant catch-up every year. |
| Big new versions of the core | When the first follow-up fix is out | Brand new versions sometimes have teething problems. We let others find them first, unless it's a security release. |
| Remove add-ons nobody uses | During regular reviews | Each add-on is something that can break or be attacked. Fewer is safer and often faster. |
| Check for abandoned add-ons | During regular reviews | When a maker stops looking after an add-on, it stops getting fixes. We plan a safe replacement with you. |
| Server software (PHP) version | Checked regularly, upgrade planned | Old versions stop getting security fixes. We test your site on the newer version before switching. |
| Paid licence expiry dates | Watched for you | Paid add-ons stop receiving updates when their licence lapses. We warn you before that happens. |
Sometimes the safest update is "not yet".
Holding an update back is a decision, not a delay. Each one goes in your note with the reason and when we'll try again.
During your busiest week
We don't change your booking or payment add-ons the week before a big event, a season opening or a term start, unless it's a security fix. Those go in with extra testing. Selling on Black Friday? Our Black Friday website checklist suggests when to stop updating.
When the copy looked wrong
If a page, form or booking behaved differently on the staging copy, the update waits. We look for a fix from the maker, a setting change, or a safer alternative.
When others report problems
If a new version is causing trouble on other websites, we wait for the maker's next release instead of finding out the hard way on yours.
When it needs newer server software
Some updates need a newer version of PHP. We move your server software first, test it, and then apply the update, in that order.
When custom changes are at risk
If someone edited your theme directly, an update could erase their work. We move those changes somewhere safe first, so updates don't wipe them.
When a licence has lapsed
A paid add-on with an expired licence can't get updates. We tell you what it costs to renew, or suggest a free option that does the same job.
Monday, 8:00
Hi Maria, a quiet week. Four updates done, one held back.
- 4 updates tried on a copy first, then made live on Tuesday night
- Enquiry form and date picker checked after, on phone and desktop
- Held back: the gallery update made photos load blurry on phones. We'll retry when the maker releases a fix.
- Online all week, backups up to date
- Retry the gallery update once it's fixed
Two lines, not a technical log.
Every Monday, the Protect part of your note says how many updates we made, that we checked your forms and bookings afterwards, and anything we held back with the reason in simple words.
- What was updated, without version numbers
- What we held back, why, and when we'll retry
- Anything that needs a decision from you, like a paid licence
Your monthly page keeps a running list, so you can see how up to date your site is.
See the weekly note and monthly page
Names and numbers changed for illustration.
Most security holes are in add-ons, not the core.
WordPress runs 40.1% of all websites (W3Techs, 2026), including a great many small business sites. Every year, a security company counts the holes found in it and its add-ons.
new security holes were found in WordPress software in 2025, up 42% on the year before
of those new holes were in plugins. Another 9% were in themes. Only 6 reports were about the core itself
had no fix from the maker in time for public disclosure, so updating alone isn't always enough
Safe updates are in every plan.
They're part of Protect, so you get them on Keep, Grow and Full Care. No setup fee, month to month.
Keep
$100 / month
Protect in full: safe updates, backups, security, form tests and keys in your name.
- Updates tested on a copy first
- Your enquiries, by name
- Weekly note and monthly page
Grow Recommended
$250 / month
Everything in Keep, plus fixes that help more visitors call or book.
- Everything in Keep
- Fixes where visitors give up
- Review replies and listings care
Full Care
$500 / month
Everything in Grow, plus the small things that add up over time.
- Everything in Grow
- New pages and answers
- Trend lines and handover file
What's not included?
Safe updates keep the site you have healthy. A few things sit outside the monthly plan, and we'll say so before doing any work:
- Rebuilding a site that can't be updated. Some very old sites are so far behind that updating means rebuilding. We'll explain your options. A full redesign isn't part of the monthly plan.
- Paid licence fees. If an add-on needs a paid licence, it should be bought in your name so it stays yours. We remind you before it lapses.
- New features. Updating keeps what you have working. Adding a shop, a members area or a new booking system is a separate project.
- Your practice or booking software. If your bookings run on outside software your office already uses, its maker updates it. We check that it still shows up and works on your website.
Do it yourself, a freelancer, or Penguina?
All three can work. What matters is whether someone tests first, checks after, and writes it down.
| What you get | Do it yourself | A freelancer | Penguina |
|---|---|---|---|
| Updates tried on a copy first | Rarely | Some do | Yes |
| Fresh backup just before updating | If you remember | Usually | Yes |
| Forms and bookings checked after | Rarely | Sometimes | Phone and desktop |
| Someone decides what to hold back | No | Yes | Yes, with the reason |
| Covered when they're busy or away | No | Depends | Yes |
| A simple record of changes | No | Sometimes | Weekly note |
| Cost | Your time | Varies by person | In every plan, from $100 a month |
What safe updates mean in your trade.
Different businesses rely on different add-ons, and have different weeks when nothing can break.
Wedding venues
Venue sites lean on big photo galleries and enquiry forms with date pickers, two of the add-ons most likely to change after an update. We test both on a phone, and keep updates away from open-day weekends.
Dental practices
Online booking often lives in the practice's own software, shown inside the website. We don't change that software, but we check it still loads properly after theme or core updates.
Music teachers and schools
Term starts bring a rush of sign-ups and lesson bookings. We avoid changing payment and booking add-ons that week unless it's a security fix, and then only after extra testing.
Questions about website updates.
Something else? Ask in the chat, email hello@penguina.website or WhatsApp us.
Will updates change how my website looks?
They shouldn't, and that's what the staging copy is for. We compare your main pages before and after each update. If something looks different, like a moved button or a changed font, that update waits until we've fixed the cause.
What if an update breaks something anyway?
Occasionally a problem only shows up on the live site. Because we take a fresh backup just before updating and check the live pages straight after, we can roll back to the version before. Then we tell you what happened in your next note, and what we'll do differently.
My site is on Wix or Squarespace. Do I need this?
Hosted builders like these update their own core software for you, so there's much less to do. We still check your forms, bookings and any apps you've added after the platform changes something, and we tell you about anything that needs your attention.
A past developer customised my theme. Will updates wipe their work?
They can, if the changes were made inside the theme's own files. Before we update a customised theme, we move those changes into a safe place (often called a child theme: a small layer that sits on top and survives updates). Then the theme can be updated without losing anything.
How quickly do security fixes go in?
Serious security fixes skip the queue. We test them and apply them quickly. If a fix isn't ready, or needs longer testing, we use the firewall to help block attacks on that hole in the meantime. That's called virtual patching, and it's explained on our security page.
Do you update add-ons I paid for?
Yes, as long as the licence is active. Paid add-ons only receive updates while their licence is current. We watch the dates and remind you before one lapses, so you can decide whether to renew it or switch to something else.
Will updates make my site faster?
Sometimes, especially when we move you to newer server software or remove add-ons nobody uses. We check your page speed regularly and tell you if anything gets slower.
Sources for the figures on this page
- Patchstack, State of WordPress Security in 2026 and W3Techs, October 2026. That last number is why updates work alongside a firewall and quick security fixes
Not sure where to start? Send us your website.
We look at it the way a customer would, find up to 3 real problems, and fix one of them free. No call needed.