Website technical maintenance and updates to meet new legal standards can sound boring, but it can help save you time, money, and headaches from when something goes wrong.

Recently, two of my clients had issues with their website.

1. One client had not received any plug-in or WordPress core updates for some years, and their website was hijacked, and instead of showing their normal content, an Asian gambling site was there. Naturally, this was very confusing for their guests, and it was interrupting the SEO of the website. I was able to rescue the website, but with some preventative measures, they could have avoided the confusion all together. Read below.
2. For another client working at his day job, the company he worked for was served with a lawsuit for $100,000. The party wanted compensation for cookies placed on their device without consent. The company ended up settling for $10,000, but even that is too expensive for my blood read. I know I don’t have $10,000 laying around. That being said, having a solid cookie policy and annoying cookie consent pop-up on the website could save you money too. More about that further below.

You can avoid these pitfalls and other emerging issues by addressing these issues before they erupt.

Update Your WordPress Core

You actually might not be able to update all of your plug-ins, until the WordPress core is up to date, so this is a good place to start.

You may want to make a backup of your files and database before starting, incase something goes wrong. You can do that manually, or ask your web host to do it. You can also just cowboy-commit to the update and troubleshooting, if something does go awry staying up until you can fix the issue.

Depending on your web host, they might do forced WordPress updates on your website, which I think is annoying, but your website might be up-to-date already because of that. Those forced updates happen late night and without a human to check if it went okay and the new WP core is compatible with theme/plugins; it can put the website at risk of being down until a web visitors tells you about it.

Audit Your WordPress Plug-ins

Look at your list of plug-ins, and if you are very confident, delete any plug-ins you don’t need anymore. Maybe you used to have ticket sales, but you don’t sell tickets anymore; delete the plug-in, save server space, relieve yourself of the chore of keeping that plug-in updated. You can also copy/paste a list of the plug-ins into Notepad, save the list, and reference it later if it turns out you deleted a plug-in that was actually still performing a useful function.

If you are not sure, don’t delete anything. You can also simply deactivate plug-ins too, if you know you aren’t keeping up with a part of your website, but want to keep the data available for the future.

Update Your WordPress Plug-ins

I would guess about 94% of the time, WordPress plug-in updates can occur without a hitch. You click the update button, wait, and then it is updated. The risk of issues may be higher if a plug-in has not been updated in some time, but generally the risk is worth it, for the security benefits.

Here is my advice on how to update your plug-ins by yourself:

1. Login to your website, and go to the Plugins page.
2. On the plug-ins page, click on the Update Available filter.
3. Copy and paste the list of plug-ins that require an update into Notepad on your desktop. You’ll need this is something goes wrong; the list states the list of plug-ins you are about to update and the respective plug-in versions.
4. Update the plug-ins:
   1. Option Cowboy – Update the plug-ins all at once. If you are brave or impatient, you can update all of the plug-ins at once.
      1. Hit the Select All, and check all the plug-ins on the page, then in the drop-down selector, choose the update option and apply button. The plug-ins will update all at once.
      2. If you have an issue with a plug-in, you’ll have to turn off all your plugins and turn them on one at a time until you can figure out which plug-in is the troublemaker.  Generally, you know you have an issue if a red error is displayed on the web page, or the website entirely goes down.
      3. Troubleshooting – Change the “plug-ins” folder to “pluginsX,” via FTP or cPanel/FileManager) then go back into WordPress, refresh the plug-ins page, and see if all the plug-ins deactivate. I then restore the plug-in folder name to normal, and then look at the error log. It could be that the newer plug-in is not compatible with your current WordPress core version, or server’s PHP version. One-by-one, turn on each plug-in, until you can re-create the error; once the error is recreated, you’ll know the plug-in to troubleshoot. Individual troubleshooting may need to happen to that plug-in. You can also look at your notepad, and look at the plug-in version that was functional, and download that version of the plug-in for WordPress.org, and install that version back into your website until your figure out the problem later.
   2. Recommended Option for Newbies – Update the plug-ins one-by-one. This method seems slower at face value, but it saves you time and headaches from trying to divine which of your 50 plug-ins that you just updated caused a website error.
      1. Click the update button for one plug-in, let that complete, and then click on the update button for the next plug-in, and let that run and complete. Continue this until all the plug-ins are updated. By updating the plug-ins on at a time, if there is a big issue, you’ll see the issue occur in real time: the plug-in updater may spin around, and then you may see a red error, or the whole WordPress website may freeze up and say an error has occurred. Fear not though, because you’ll know which plug-in you just updated, so you know which plug-in to troubleshoot. 
      2. Troubleshooting – You’ll probably have to login to your cPanel or through FTP, change the folder name for the trouble-plug-in (for instance, a plugin folder named “kittenspopup,” you change to “kittenpopupX”), then go back into WordPress, refresh the plug-ins page, and see if the trouble plug-in auto deactivates. I then restore the plug-in folder name to normal, and then look at the error log on the server. It could be that the newer plug-in is not compatible with your current WordPress core version, or server’s PHP version. Individual troubleshooting may need to happen. You can also look at your notepad, and look at the plug-in version that was functional, and download that version of the plug-in for WordPress.org, and install that version back into your website until your figure out the problem later.
5. If you are lucky, when you update the plug-ins, everything is successful, the page tints green, and you are simply done with the chore. This is more typically the case for plug-in updates, but not guaranteed.

Note – if you have premium plug-ins, you might need to renew licensing with that provider before you can update the plug-in. Sometimes NextGen galleries “lose” the  license number, and I have to hunt it down in an old receipt and put it back into WordPress, so be prepared for hiccups like that. I used to have real trouble updating Ninja Forms plug-ins, as I would have to deactivate each license and put it back in each time I needed to update, but I think whatever glitch they had has finally been ironed out (I did complain to them about it for years).

Update Your Server’s PHP Version

This part can be a bit more risky, but again, think of your security risk of not doing it.

Sometimes a theme may not be compatible with a newer version of PHP. I know I had a common snippet of code I would put in my themes, and I took it out because it was too outdated to work with the new PHP standards. That is out from my current coding snippets, but there can be legacy snippets like that floating around on old websites. Generally, the best way to figure this out is to update to the latest PHP version on the web server, see the website is having an error, look at the error log, and then troubleshoot based on the error log’s findings.

Sometimes a plug-in may not be compatible with newer PHP. When the plug-in was written, the bar was lower, and the PHP was satisfactory with standards of the time. Newer versions of PHP may have modern, more strict, standards. If you update your server’s PHP version, and then the error log tells you to look at a plug-in, the fastest solution to get your website running again is to deactivate the plug-in. (See plug-in troubleshooting above.) You might be able to abandon the plug-in altogether, find a similar one to replace it with, or report the problem to the plug-in developer, who might fix the issue (sometimes you get lucky!). A plug-in that I used quiet often in the past, Better Recent Posts, I have been replacing with a similar plug-in, because time-after-time, if does not work with the newer PHP environments.

Those above recommendations will keep your website technically running, but these changes will keep your business running.

Update your Privacy Policy / Cookie Policy

Modern versions of WordPress come out-of-the-box with a Privacy policy, but websites deployed before the current standard, did not. You’ll need to create a privacy policy page. WordPress does offer some starter verbiage to help with this chore.

Basically, you need to explain what you do with user data, how long you keep it, if you have cookies, and if you allow minors on the website.

If you want to be hyper vigilant, you can also have an IT lawyer draft a Privacy Policy, which may be appropriate for you depending on the nature of your business (a Saas company might need this more than someone who sells used clothes).

You can always start off with the WordPress starter Privacy Policy as your safety net, until you can hire a lawyer to draft something more robust.

Add a Cookie Consent Banner – Critical

Within the European Union and California, there are the GDPR and CalOPPA laws, that require a user give consent before any cookie is placed on a user’s device. Unless you are actively blocking these regions, you’ll want to add a cookie consent pop-up.

There are essential cookies, like ones that are required for functionality of a website, and there are non-essential cookies, such as Google Analytics. If a user could visit your website, perform their task, and achieve their goal without a cookie, then that is an optional cookie. For instance, if your user logs onto your website and submits a payment, a cookie might be required to track their login session, but an analytics cookies is not essential to them sending you money. An analytics cookie is optional, and for the benefit of the website owner, not the user, so they may not want it.

You might remember the time you web searched for dog food, and then every website for the next 3 weeks had dog food ads. That is likely because a cookie was placed on your device. It becomes more egregious when a cookie is placed on a user’s device, without consent, and then the website owner profits off the cookie by selling the data for ad revenue to third parties, but even just keeping the cookie data for internal profit is not allowed unless that cookie was authorized by the user.

My other metaphorical example of this would be going to a bar, asking someone to dance, and the person not answering, or saying no, and you still trying to dance with them. Unless they said an explicit yes, take it as a no buddy.

If you have a WordPress website, the best solution I would recommend is installing the WP Consent plug-in. I’ve tried the Cookie Yes one before, but it did not actually hold back cookies and only threw up a pop-up that was for-show. The core WP Consent plug-in is free, has some customization, and it works… mostly. This will probably solve the problem and cover your legal protections for most people. The plug-in automatically detects common cookies for common website setups.

I have one website that I manage that WP Consent does not gate the HubSpot cookies before consent. I have tried to contact these people to get support. I even asked if I bought the premium version of the plug-in, if that would gate the HubSpot cookies, but my message went into a void.  I mean, paying the annual price seemed a lot cheaper than the legal risk of a $100,00 lawsuit, but it is still not clear to me if the premium version would actually solve the problem. I know the sales/marketing people for that company like the analytics they are gathering, but I am about to pull the cookies off until I can figure out how to have them in a legally compliant manner.

It may vary by your web browser, but you can right-click on a page, go to Inspect, and normally there is a Storage > Cookies section, where you can see if there are cookies load from the website. Alternatively, normally when you click on the lock icon near the beginning of a website URL, you can find cookies in there and delete them too. If will vary by browser and device, so you can web search for how to find cookies for your device + browser. I do recommend using a computer, as that is better for business/developer productivity than a phone.

Update to WCAG 2.2 AA Standards – Important

When was your website built? Standards change, and your website might have been perfectly fine back then, but it may need some tune-ups now.

The WCAG, the Worldwide Consortium of Accessibility Guidelines, is a global standard for making a website accessible to people of all body types. In overly simplistic terms, it is like putting a wheelchair ramp to your store, but in this case, for your website.

In the United States, we have the Americans with Disabilities Act, which requires equal access to all people, including on a website. Without congress specifying web rules, courts have deferred to the WCAG as the best standard rules to adhere to, so here we are.

The good thing is, as you make your website more accessible to users with disabilities, the website experience improves for all users.

I have a detailed blog post about WCAG here: https://conceptincarnate.com/blog/how-to-get-started-to-make-your-website-wcag-2-1-compliant/

WCAG should be taken seriously. Dominos got into some real legal heat for their website not being accessible. There are also lawyers that go around looking for low-hanging fruit to harvest, so make sure to keep your garden tended to!

We are currently at WCAG 2.2 per the W3C as the standard, which is slightly more strict than 2.1.

In all likelihood, you won’t be able to harden-up your website’s accessibility alone. You’ll need a web designer to help you with this. That being said, learning the concepts is helpful, and will allow you to keep up with WCAG compliant accessibility of content updates on your website.

Note, not all WordPress themes are WCAG compliant. Websites built in some DIY builder are less likely to meet WCAG. It really depends on the foundation of your website, if it can be improved, or if it needs to be bulldozed.

If you have a stock theme, you can try updating to the latest version of that theme. This ‘could’ solve the WCAG issues immediately. I would wager though, if you bought a $50 theme, that developer probably won’t care enough to make WCAG updates to the theme.

If you have a theme that I made for you, I will have to update it manually since it is a custom theme.

(I can audit and or update your website for WCAG, even if I did not make your theme.)

You might also read about “508 compliance” which has some legal definitions of accessibility of PDFs. If you want to be lazy, don’t include a PDF on your website. If you do need to have PDFs, in all likelihood, your PDFs will need to be tuned up before placing onto your website. PDF remediation is a very laborious task. After learning how to do it, frankly, I have no interest in that… it is mind numbing. I do have a blog article on a different website explaining PDF remediation in depth here: https://www.hpsglobal.net/2026/05/22/accessible-electronic-document-community-of-practice-aed-cop-testing-and-remediation-of-pdfs-in-adobe-acrobat/. Good luck with that.

Add Dark Mode

This is not required by WCAG, but it does follow the spirit of WCAG. Let your website visitors see your website in a way that they prefer, and they might stay longer. Some people don’t like a blinding white screen when trying to read a website at night. Some people with older eyes might prefer the white screen for high visibility when having visual impairments. Either way, the user probably knows what they want and have a device preference set. Adjust the colour scheme of your website to deliver to your users what they want!

Audit Your Website Administrator Logins

Login to your WordPress website, and check the users who have Admin privileges at the very least. You may want to check the Editor users too, but for sure the Administrators need to be reviewed, as a Admin can create and destroy the website entirely.

Check to make sure the authorized users are current company employees. If someone quit or was fired, downgrade the account to a Subscriber so they can keep their authorship attributions on blog posts, but not be able to make any website changes anymore.

If you had various web designers, SEO gurus, or other temporary contractors, you may also want to downgrade their permissions to Subscriber as well, if you are not actively contracting with them.

Browse Your Server Files, Throw Out the Trash

Not too long ago, I was not able to upload a single image to my website within the WordPress UI. I had just downgraded my server package to save money, so I naturally thought the problem was involving the server change. I was wrong. I got on a support chat with my web host, and the tech found there was a 5-something-gigabit sized error log that was huge and hogging up space, so he deleted it. 

That got me wondering with all my hosted websites, how many of them might have garbage error logs, so I went looking around. It was really only that one website with an insanely big error log, but there were also many files named something like, “core465874,” and “core45454.” Apparently sometimes when WordPress does an auto-update, sometimes those automated files fail to self-delete, and there were like 20 or 30 of these files in that one folder. Once I deleted the files, my cPanel showed my storage usage drop by 25GB; that is a lot of space!

So, that being said, particularly if you are maxing out on your server space, look around for any troublemaker files and delete them.

It is perfectly safe to delete an error log file. The server will generate a new error log file upon the next error happening. In fact, if the error log file is something like 1GB, you are better off deleting it, and then downloading the next file that is automatically generated, which should be very small, and checking out the most current error logs. If you have the time and knowledge, try to fix the errors too. (Imagine, throwing out a smoke detector, but not extinguishing the fire.) When you read the error log, it normally tells you what to fix, like it will say there is a problem with a specific plug-in, or a piece of code on file something.php on line 123. You can also copy/paste the error log message into your chat AI, which might help you figure out the problem, if it is not obvious to you immediately.

Backup Your Website

With your website cleaned up and updated, make sure to back-up your website for good measure. Your web host may to automatic backups, but if they don’t, having a backup of a clean working version of your website can’t hurt.

Conclusion

These maintenance tasks should keep your website humming along nicely.

Repeat these WordPress Core updates, WordPress plug-ins updates, server PHP updates, admin user audit, file audit at least twice a year, if not once a few months. WCAG audits should be continuous after compliance is met, or particularly when you make a website change, or a new version of WCAG is released; if you rarely update your site, then you don’t need to audit a website that is already compliant.

This article was written entirely by a human.