How can I easily verify a core or plugin update has not broken anything?

In your specific case, I don’t think the answer is a technical one (see my comment on the question for more details).

For everyone else, the answer to “How can I easily verify a core or plugin update has not broken anything?” is automated testing. That’s the whole purpose of automated testing, because it’s unreasonable to think you can test everything in a non-automated fashion.

Here’s a great getting started guide on automated testing with WordPress: http://make.wordpress.org/core/handbook/automated-testing/

If you’re not willing to go down that road, at the absolute least, my suggestion would be to have your clients list the 3 most important things about their site, and include in the contract that you will test those 3 things with every update. It doesn’t guarantee that something won’t break, but at least you’re resting easy knowing that what matters most to them (by their own admission), like contact forms, didn’t break.

Related Posts:

  1. Why does WordPress need my private ssh key to update?
  2. Is WP vulnerable when updating plugins or themes?
  3. Will there be security updates for WordPress 4.9.9
  4. Why my plugins are updating automatically?
  5. Are major WordPress updates mandatory for security?
  6. Background Updates Not Happening
  7. what is a auth_user_file.txt?
  8. How to view PHP on live site
  9. Can an attacker use inspect element harmfully?
  10. Is moving wp-config outside the web root really beneficial?
  11. Hide the fact a site is using WordPress?
  12. Verifying that I have fully removed a WordPress hack?
  13. Can I Prevent Enumeration of Usernames?
  14. Best way to eliminate xmlrpc.php?
  15. If a hacker changed the blog_charset to UTF-7 does that make WordPress vulnerable to further attacks?
  16. Should I remove install.php and install-helper.php?
  17. Are Nonces Useless?
  18. What is the difference between esc_html filter vs attribute_escape filter?
  19. How do I technically prove that WordPress is secure?
  20. Which KSES should be used and when?
  21. How do WordPress Nonces Work?
  22. Vanilla WordPress install, what can/should I put in disable_functions?
  23. wp.getUsersBlogs XMLRPC Brute Force Attack/Vulnerability
  24. Secure my “add_settings_field” translation?
  25. Is there a security risk giving someone temporary access to my blog’s code?
  26. How to properly sanitize/secure a WP Query coming from the front end
  27. WordPress Logout Only If User Click Logout or If User Delete Browser History
  28. How brute-forcer knows that the password is cracked for target username?
  29. wp_insert_post disable HTML filter
  30. Upgrading WordPress 4.0 asks for FTP password
  31. Can someone (Support of my themeprovider) get access to my server If I send them my admin login?
  32. Completely remove the author url
  33. Restricting access to content
  34. About WordPress site security
  35. Relative security of different releases of WordPress
  36. How can we deal with unmaintained plugins with vulnerabilities?
  37. Is there any point setting the keys and salts in wp-config.php?
  38. Where to store OAuth 2.0 client id and secret?
  39. How can I safely use $_SERVER[‘REQUEST_URI’] to avoid XSS?
  40. Using HTACCESS for Secret Access
  41. Definitive wordpress directory ownership and permissions on linux
  42. Dangers to allowing Access-Control-Allow-Origin: * for Feeds only?
  43. Changing Table Prefixes – once done, am I good to go going forward?
  44. wordpress website host price and security [closed]
  45. Are there security risks in working directly in the themes folder that builds into a theme folder?
  46. Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?
  47. Secure WordPress: Change admin
  48. Changing the default header name
  49. how much information can we hide when using wordpress cms?
  50. Is it safe to use a global wp nonce per user instead of a nonce per action?
  51. Wordfence detects change in wp-admin/includes/upgrade.php
  52. Basic password protection without using users and roles
  53. System setting changed by system user
  54. Does meta-data need to be sanitized?
  55. Can a WordPress administrator see other users’ passwords?
  56. Any known bugs that could cause disappearance of the wp_users table?
  57. On new server, site got hacked, permissions a bit strange? Please help
  58. Privilege escalation bugs in 2.9?
  59. 404/500 error on content images if Referer header is from another domain [closed]
  60. Are SVG image files safe to upload? Why WP defines them as a security risk? [duplicate]
  61. Restrict Access without Creating Users
  62. Switching between security plugins is a risk?
  63. How to obfuscate wp-config.php or code
  64. Security issue with ‘paged’ and ‘posts_per_page’ parameters taken directly from a POST request?
  65. How to prevent to direct access of my custom plugin folder/files
  66. Checking for origin of a xmlrpc request
  67. RESTRICT EDIT of PHP files?
  68. wp-content – permissions for files/folders created by apache
  69. How can I restrict access to specific parts of a page, not just the page itself?
  70. User generated content and security
  71. i moved wp-config.php outside of public html and this broke my website
  72. Monitor wordpress all external calls
  73. Is it safe to use the basic administration with reduced rights for private member space
  74. Securing WordPress running on Azure platform
  75. Verifying that I have fully removed a WordPress hack?
  76. Spam Registrations
  77. How can I have more confidence that WP plugins aren’t getting and storing user data?
  78. Standard Method for Securing a WordPress Site
  79. wordpress security (only one part of the site)
  80. A SINGLE Post Giving an “Under Maintenance” Message
  81. Avoid ‘uploads’ 777 permissions: Potential threat or clean solution?
  82. Any way to disable /wp-login.php redirecting to the site folder?
  83. Folder Permissions + Security Concerns
  84. Malware/Permission bug removal?
  85. Could a user account with a stolen password compromised entire WP site?
  86. Step by Step Instructions for Making Media/Uploads Private to Only Logged-In Users
  87. Secure a WordPress website in 2019: one plugin or a combinations of them?
  88. What are the different types of firewall protections available for a WordPress website?
  89. Run a security scan on WordPress site that has .htaccess password [closed]
  90. Is this a WordPress security bug?
  91. Competitor is somehow accessing MetaData on a hidden WordPress site
  92. WordPress Hacks/Defacing [closed]
  93. Directory to store secure file
  94. How can I give someone server access to only duplicate and modify a site?
  95. WP-JSON: Cross Origin Resource Sharing Vulnerability?
  96. How can I implement ansible with per-host passwords, securely?
  97. Why should I firewall servers?
  98. Does drilling a hole into a hard drive suffice to make its data unrecoverable?
  99. Can you alter the default wordpress strong password requirements?
  100. how to sanitizing $_POST with the correct way?

Leave a Comment