Moatline

WordPress update failed: how to fix it safely

A failed update is annoying, but the real risk is what it leaves behind: a site stuck in maintenance mode, a half-replaced plugin, or an old version with a known security hole. Here is what each error means, how to fix it, and how to tell when the failure is a sign of something worse.

By the Moatline team at Next Nova Technologies · Published 9 November 2026 · 8 min read

Worried the failed update is something worse?See what your visitors and Google see right now. Free, no sign-up, about 20 seconds.
Check my site free

Short answer

  • Read the error: most failures are file permissions, a full disk or an inactive premium license.
  • Stuck in maintenance? Delete the .maintenance file in the WordPress folder.
  • Fix it the same day if the update was a security fix. Only use zips from WordPress.org or the developer.

First: is the site still up?

Open your site in a private browser window, then open /wp-admin. What you see decides where to start:

Before you change anything, take a backup of files and database if you can. If the next fix goes wrong, you can always get back to where you are now.

Error messages and what they mean

ErrorWhat it usually meansFix
Could not create directoryWordPress can’t write to its own folders, or the disk is full.Check disk usage in your hosting panel. Folders should be 755 and files 644, owned by the website’s user. Ask your host to reset ownership if you’re not sure.
Could not copy file / Could not remove the old pluginSame causes: permissions, ownership or no space left.As above. Also check that no file in the plugin’s folder was made read-only (444).
Download failed. UnauthorizedA premium plugin or theme whose license isn’t active on this site, or has expired.Activate or renew the license, or download the latest version from your account on the developer’s site and upload it.
Download failed (other reasons) / Incompatible archiveThe server couldn’t fetch the update, or the download was cut off.Try again in a few minutes. If it keeps failing, ask your host whether a firewall blocks downloads from WordPress.org.
Requires PHP version …The new version needs a newer PHP than your server runs.Switch to a newer PHP version in your hosting panel first (test the site after), then update.
Another update is currently in progressAn earlier update was interrupted and left a lock behind.See below.

WordPress also emails the site’s admin address when an automatic update fails. That email names the plugin or theme and the error, so check it before you start guessing.

Stuck in maintenance mode

While it updates, WordPress puts a file called .maintenance in the main WordPress folder (where wp-config.php is) and shows visitors “Briefly unavailable for scheduled maintenance”. If the update is interrupted, the file stays.

  1. Open your host’s File Manager or connect over SFTP. Files starting with a dot can be hidden, so turn on “show hidden files”.
  2. Delete .maintenance. WordPress also ignores the file once it’s more than 10 minutes old, but deleting it is quicker and certain.
  3. Log in and check Dashboard → Updates. The update that was interrupted may be half-installed, so run it again.

If a core update failed halfway, reinstall WordPress itself: Dashboard → Updates → Re-install version, or over SSH wp core download --skip-content --force. That replaces wp-admin and wp-includes and leaves your content, plugins and wp-config.php alone.

“Another update is currently in progress”

WordPress sets a lock while it updates so two updates can’t run at once. If an update dies, the lock stays for up to 15 minutes. Wait 15 minutes and try again. If it still appears:

  • Over SSH: wp option delete core_updater.lock
  • Or in phpMyAdmin: open the wp_options table (the prefix may differ), find the row named core_updater.lock and delete that one row only.

Critical error after an update

The update installed, but the new version clashes with something: another plugin, your theme or your PHP version.

  1. Check the admin email. WordPress sends a “Your site is experiencing a technical issue” message with a recovery-mode link. Log in through it, and WordPress tells you which plugin or theme caused the error and pauses it.
  2. No email? In File Manager or SFTP, rename the plugin’s folder in wp-content/plugins (for example add -off to the name). That switches it off. Log in, and rename it back once you have a fix.
  3. Go back a version if you need the plugin today: download the previous version from the plugin’s WordPress.org page (Advanced View → Previous versions) or the developer’s account page, and upload it. Then tell the developer, and update again when they ship a fix.

Since WordPress 6.6, automatic plugin updates check the site afterwards. If the new version causes a fatal error, WordPress puts the old one back on its own and emails you.

Update by hand when the button won’t work

  1. Get the new version from WordPress.org or from your account on the developer’s site. Nowhere else.
  2. Go to Plugins → Add New → Upload Plugin (or Appearance → Themes → Add New → Upload Theme), choose the zip and confirm Replace current with uploaded. Settings are kept.
  3. With SSH access, wp plugin update plugin-name or wp plugin update --all does the same and often shows a clearer error.
Never fix a failed update with a zip from a download site, a “GPL club” or a nulled-plugin site. In our cleanups these are one of the most common ways malware gets in, often as a fake plugin that looks like the real one.

When a failed update is a security problem

Most failed updates are just permissions or disk space. But check these:

  • You’re still on the old version. If the update was a security fix, the hole is still open. Check our list of plugins under active attack and the monthly security updates you shouldn’t skip, and fix the update the same day if your plugin is on either.
  • Files are read-only and you didn’t do it. Some malware sets its own files, or index.php and .htaccess, to 444 so they can’t be replaced or deleted. That’s a reason to scan the site before you go further.
  • Plugins you don’t recognise, or folders in wp-content/plugins that don’t appear on the Plugins screen. A plugin that hides is never legitimate.
  • A failed core update left files behind. WordPress unpacks core updates in wp-content/upgrade. On WordPress before 7.1.4 that folder was attacked during updates (CVE-2026-119977), so block web access to it. In the free Moatline Malware Scanner it’s one click under Protect → Files & code.
  • Visitors see an “update your browser” or “verify you are human” box on your site. That isn’t a WordPress update. It’s malware aimed at your visitors: see fake verification boxes on websites.

To check WordPress core against the official copy after a messy update, run wp core verify-checksums over SSH, or a Moatline scan, which compares core files with WordPress.org and also checks plugins, uploads and the database. If it finds something, follow how to remove malware from WordPress.

“Updating failed” in the editor is a different problem

If you see “Updating failed. The response is not a valid JSON response” or “Publishing failed” when you save a post or page, nothing is wrong with your plugin updates. The editor saves through the WordPress REST API, and something blocked that request. Common causes:

  • A firewall or security plugin blocking the REST API. Check its log for blocked requests to /wp-json/.
  • The WordPress Address and Site Address in Settings → General don’t match, for example one is http and the other https.
  • Broken permalinks: open Settings → Permalinks and click Save Changes without changing anything.

Tools → Site Health shows REST API errors. “Could not update post in the database” is different again: usually a damaged database table or a full disk, which your host can repair.

Don’t want to do this yourself? Our team cleans hacked WordPress sites every week: WordPress malware removal service, from $45, usually done within 24 hours.

Frequently asked questions

Why does WordPress keep saying the update failed?
Usually one of four things: WordPress can’t write to its own folders (file permissions or ownership), the hosting account is out of disk space, the server can’t download the update, or a premium plugin’s license isn’t active. The exact error message tells you which one, so read it before trying fixes at random.
Will a failed update delete my content?
No. Posts, pages, products and settings live in the database, and plugin and theme updates only replace files. Since WordPress 6.3, if a manual plugin or theme update fails, WordPress puts the old version back automatically. Since 6.6 it does the same when an automatic plugin update breaks the site.
Is it safe to update a plugin by uploading the zip myself?
Yes, if the zip comes from WordPress.org or from your account on the developer’s own website. Go to Plugins → Add New → Upload Plugin and choose “Replace current with uploaded”. Never use a copy from a download site, a “GPL club” or a nulled-plugin site: these are one of the most common ways malware gets onto WordPress sites.
Should I turn off automatic updates after one failed?
No. Fix the cause instead, because a site that stops updating soon falls behind on security fixes. Keep daily backups so you can roll back if an update ever breaks something.
Can malware stop WordPress from updating?
Yes. Some malware makes its files, or WordPress’s own files, read-only so they can’t be replaced or deleted, and some fake plugins break the update process on purpose. If permissions changed and you or your host didn’t change them, scan the site before you do anything else.

Scan your site for free

Moatline checks files, the database and page-builder content. Nothing changes unless you click a button.

Get it free on WordPress.org

More guides

All guides →