The dashboard says five plugins have updates waiting. There is a tick box to select them all and an Update button right beside it, and most weeks that works fine. Then one week a form stops sending, or a page layout shifts, and you wonder whether anything could have warned you.
Usually something did. Every decent plugin publishes a changelog: a running list of what changed in each version. Learning to read a plugin changelog before updating takes a couple of minutes per plugin, and it tells you which updates are routine, which are urgent, and which deserve a backup and a careful test first. It is one of the routines in our WordPress site owner’s handbook.
Where to find a plugin’s changelog
There are three usual places, and you rarely need to leave your dashboard for the first two.
From the update notice
When a plugin has an update, its row on Plugins → Installed Plugins shows a notice saying a new version is available, with a link to view that version’s details. The same link appears on Dashboard → Updates. On the Updates screen the link opens straight at the Changelog tab; from the Plugins screen you may need to click that tab yourself.
From View details
For any plugin that came from the WordPress.org directory, the View details link under its name opens the same window at any time, even when no update is waiting. It is a handy way to see what changed in the version you already have.
On the developer’s side
The plugin’s page in the WordPress.org directory carries the full changelog too, usually in the Development section. Premium plugins keep theirs on the developer’s website, often on a page called “Changelog” or “Release notes”, or inside the plugin’s own settings. If the developer’s update notice in your dashboard does not link to it, search the developer’s site for the plugin name plus “changelog”.
Some long-running plugins only show recent versions in the readme and keep older entries in a separate changelog file or web page. That matters if you are several versions behind.
How to read a plugin changelog before updating
Most changelogs follow a similar pattern. Each version gets a heading with its number, sometimes a release date, and a short list of changes beneath it. The list items often start with a label such as Fix, New, Tweak, Improvement, Security or Dev.
A few habits keep the reading quick:
- Note your current version first. It is shown in the plugin’s row on the Installed Plugins screen.
- Read every entry between your version and the new one, not just the top one. If you are jumping from version 3.1 to 3.6, the important change might be hiding in 3.3.
- Skim for a handful of words. You do not need to understand every line. Lines labelled “Dev” are usually notes for other developers and can be skipped.
The words that matter in a WordPress plugin changelog
| If you see | It usually means | What to do |
|---|---|---|
| Security fix, security hardening, fixed a vulnerability | A flaw was found and closed | Update soon, after a quick backup |
| Breaking change, removed, no longer supported, deprecated | Something you rely on may behave differently or disappear | Read the details, test on a copy first |
| Requires PHP or requires WordPress with a version | The plugin now needs a newer server or core version | Check your versions before updating |
| Database update, data migration | The plugin will change how it stores data | Full backup first; expect a prompt after updating |
| New major version, rewritten, new interface | Large internal changes | Wait a few days and test before going live |
| Template files updated | Layout files have changed | Matters if your theme overrides that plugin’s templates |
| Fix, tweak, compatibility with latest WordPress | Routine maintenance | Normally safe to update as part of your usual routine |
To check your server versions, go to Tools → Site Health, open the Info tab and expand the Server section, which lists the PHP version. The WordPress section of the same tab shows your WordPress version. If a plugin now needs a newer PHP version than your host runs, that is a hosting change to plan first; our post on updating PHP for WordPress explains what is involved.
What version numbers can tell you
Many developers number versions in three parts, such as 4.2.1. Broadly, a change in the last number means small fixes, a change in the middle number means new features, and a change in the first number means a major release with bigger changes underneath. Going from 4.2.1 to 4.2.2 is usually quiet. Going from 4.9 to 5.0 deserves your attention.
Not every developer follows this pattern, so treat it as a hint rather than a rule. The words in the changelog matter more than the numbers.
Decide: update now, update soon, or wait
Once you know what an update contains, the decision is usually simple.
- Update now when the changelog mentions a security fix, especially for a plugin that handles forms, logins, uploads or payments. Take a backup and update the same day. Our explainer on how plugin vulnerabilities work shows why the days after a fix is published are the riskiest.
- Update as part of your routine when the entries are small fixes and tweaks. These can be grouped together.
- Wait and test when you see a major version, a database change, removed features or new requirements. Give it a few days, look at the plugin’s support forum for reports from people who updated early, and, where a staging site exists, run the update there before the live site.
Waiting is a judgement call, not a reason to skip an update for months. If the major release also carries a security fix, test quickly and move on.
When the changelog says almost nothing
Some developers write “bug fixes and improvements” and nothing more. In that case, fall back on what the plugin does for you. A small plugin that adds a widget can be updated with the routine batch. A plugin that runs your shop, forms or page layouts should be updated on its own, with a backup, and checked straight afterwards. A developer who never explains their changes is also worth noting next time you review your plugins.
Automatic updates and changelogs
If you have switched on automatic updates for a plugin, it updates without you seeing the changelog first. That trade-off is sensible for small, low-risk plugins. For the plugins your business depends on, many owners prefer to keep updates manual so they can read first. WordPress can email the site admin address about automatic plugin updates, so keep an eye out for those messages and read the changelog afterwards if something looks different.
If an update still goes wrong
Even after careful reading, some problems only show up on your particular mix of theme and plugins. If a page breaks right after an update, you can roll the plugin back to its previous version while you find out more. If two plugins start fighting, our page on plugin conflicts explains how to narrow it down.
Keeping a short update log helps here: the date, the plugin, the old and new version, and anything odd you noticed. When something breaks a week later, that log points straight at the likely cause.
Reading changelogs is one small part of looking after plugins over their whole life on your site, which our guide to WordPress plugins sets out step by step.
Frequently asked questions
What should I do if a plugin has no changelog at all?
Treat every update as unknown. Take a backup, update that plugin on its own rather than in a batch, and check the pages it affects straight away. You can also ask in the plugin’s support forum what changed. A developer who never documents changes is a reason to consider a better-maintained alternative.
Do I really need to read the changelog for every small update?
No. For small, low-risk plugins, a quick glance for the word security is enough. Spend your attention on the plugins that run important parts of the site: forms, the shop, the page builder, caching and security. Those are the updates where a few minutes of reading can save a broken afternoon.
Why do some changelogs mention a security fix without any details?
That is usually deliberate. Describing the flaw in detail before most sites have updated would help attackers find sites that have not. Developers often add more detail later, once the fix has been out for a while. The short mention is still your signal to update promptly.
Can I skip a version and wait for the next one?
You can, and when you do update, WordPress installs the latest version, so you pass through everything in between at once. That is fine for routine fixes. Just do not skip a version that contains a security fix, and read all the entries you jumped over before you finally update.
Reading changelogs is a habit worth keeping even if someone else runs your updates, because you will know what to ask. Where you would like that work taken on regularly, plugin updates are part of our monthly WordPress maintenance plan, alongside backups and security checks.
Next in this series: Essential WordPress Plugins for Business, Sorted by Job
