Safe WordPress plugin updates with rollback, with selected checks and conditional file recovery.

wppilot/safe-update detects failures covered by its selected checks and attempts to restore the copied files. Before and after the update it probes the home page and up to four recently edited pages logged out, the REST index and an admin-ajax heartbeat, and checks the error log. A new HTTP failure, PHP fatal, critical-error page or missing response can trigger file rollback and another probe. Recovery can fail: inspect the terminal outcome and keep an out-of-band restore route.

Before Pro 1.12.3, an update on a LiteSpeed or OpenLiteSpeed server running LiteSpeed Cache and Elementor set off a full cache purge, and that purge resets OPcache. PHP then kept OPcache off for the whole site while the safe update was still checking pages, every page needed far more memory, and on a 128 MB limit they all failed with a critical error, so even an inactive theme was rolled back. Pro 1.12.3 runs that purge once the update is finished. If a rollback reason still says the site ran out of memory, raise PHP's memory limit; the update itself may have been fine.

It is checked again eight seconds later. If every page and check answers normally then, the update is kept and the result says "recovered on recheck" with what failed first. A failure that persists triggers a restore of the copied files: the outcome is rolled_back when the old version is back, or rollback_failed when the restore did not complete, in which case the copy is kept for wppilot/rollback-change or a manual restore. With GoBuildWP 1.18.5 the reason names the PHP error, the file and line, and the plugin it came from.

By default, yes: it refuses to update unless UpdraftPlus, Duplicator, BackWPup or All-in-One WP Migration reports a successful backup from the last 24 hours, and says how to make one. You can pass require_backup false for one call, which is recorded in the result and the history, but a rollback copy of the plugin is not a backup of your database.

For seven days. A kept update carries a change id, and wppilot/rollback-change or the Changes screen restores the zipped copy of the previous version and its active state. The undo is refused once the copy has expired, or if the plugin was updated again since, because that would silently discard the newer update.

A screenshot needs a browser, and GoBuildWP's captures are taken by a signed-in wp-admin tab, which cannot run inside the request that holds the update open. The result points to capture-page and compare-captures instead, so a visual check can follow the update as a separate step.

No. Core, GoBuildWP and GoBuildWP Pro are refused, because a failed update of the code running the rollback could not be rolled back by it. Single-file plugins are refused too, since there is no directory to copy. Core stays with WordPress's own updater.

WordPress keeps a temporary copy during an update and restores it if the update itself fails, then deletes that copy right after a successful update and weekly. Safe updates keep their own copy for seven days, check the pages after the update rather than only the update process, and record the result so it can be undone later.