NoyaCare: Safe WordPress Updates With a Backup, a Real Check and Automatic Rollback

Every WordPress site owner knows the feeling. There are 18 plugin updates waiting. Leave them, and the site is a little more exposed to hackers every week. Press “Update all”, and there is a real chance the shop, the checkout or a landing page breaks, and you hear about it from an unhappy client. NoyaCare is the plugin I built to end that choice.

NoyaCare installs your updates one at a time. It saves a restore point before each one, checks the real website after each one, and undoes an update automatically if it broke something. When it is done, it writes a clear report you can send to your client. The plugin is free on WordPress.org, and NoyaCare Pro adds monitoring, branded reports, Google Drive backups and more for freelancers and agencies.

NoyaCare took me three months of work, and it went through three rounds of the WordPress.org plugin review before it was approved. That review is strict about security and privacy, and the plugin is better for it. This post covers why updates break sites, exactly what NoyaCare does about it, what the free plugin and Pro include, how to get started and, just as important, what NoyaCare does not do.

Why WordPress updates break sites

Most hacked WordPress sites were running an outdated plugin with a known security hole, so updates are not optional. But every update is new code running next to dozens of other plugins and a theme it was never tested with. Three things usually go wrong:

• A fatal error takes down a page, the checkout or the whole site (“There has been a critical error on this website”).
• A broken page still loads, but blank, half-rendered or with its layout gone.
• A plugin needed another one updated first, so the order of the updates mattered.

WordPress’s own automatic updates install everything they are allowed to and hope for the best. Bulk updates make it impossible to tell which update caused a problem. NoyaCare does the opposite: one update at a time, each one checked from the outside, each one reversible.

What NoyaCare does for every single update

1. Restore point. Before anything changes, NoyaCare saves the plugin or theme folder and the settings it owns. Since version 1.10 every restore point is encrypted.
2. Install. The update goes in through WordPress’s own updater. For an active plugin, visitors see WordPress’s short maintenance notice for the few seconds the files are swapped, never a half-copied plugin.
3. Real check. NoyaCare loads your important pages over the internet, exactly like a visitor, and compares them with how they looked before the update.
4. Keep or roll back. If the site works, the update stays and NoyaCare moves on to the next one. If a visitor would notice a problem, the restore point goes back automatically, the site is checked again, and that version is held so it is not installed again until you release it.
5. Report. At the end, a report goes out by e-mail with a PDF copy, ready for your client.

A real check from the outside, not a guess

Checking a site from inside the same PHP request that installed an update only tests the old code that was already loaded. NoyaCare checks with fresh requests to the live site: the home page, the shop, the cart, the checkout and any page you add in the settings. It rolls back only for a problem a visitor would actually see:

• a PHP fatal error on a page, or a new fatal error from the updated plugin in PHP’s error log
• a page that now returns a server error (5xx) or “not found” (4xx), or no longer answers
• a white screen (a page that suddenly lost most of its content) or a page that stops half-way

Smaller things, such as a page that got slower or a new PHP warning, are reported in the run and in the client report, but they never roll anything back. An unnecessary rollback is a false alarm, and false alarms make people stop trusting the process. Errors that another plugin or a visitor causes during the check are kept apart too, so an update is never blamed for someone else’s problem.

Everything about a run in one place

Every maintenance run gets a reference such as NC-20261017-001, and every update in it a number of its own, so a client can quote it months later and you can show exactly what happened. The run screen shows what was updated, what was held back and why, the client report, a final check of the whole site and the full log.

In the run above, two plugins were updated and verified, and Contact Form 7 was held back because 5.9 to 6.2 is a big version jump that deserves a look first. The Final check card, new in version 1.10.1, says what the check of the whole site after the last update found: here, every page loaded normally. When it finds minor things, such as a new PHP warning or a slower page, they are listed as notes and the run still counts as completed. “Completed with issues” is kept for things that need you, such as an update that had to be rolled back.

The dashboard: what is waiting, and what NoyaCare will do with it

The dashboard shows which protections are on, the most recent run, and every pending update with its version jump and its risk. Your update policy decides what happens to each one:

• Major version jumps (for example 3.x to 4.0) can be held for your review instead of being installed automatically.
• Brand-new releases can wait a few days, so others find the early bugs first.
• Updates your server cannot run, such as one that needs a newer PHP version, are never installed.
• Security fixes can be recognised through the optional WPScan or Patchstack vulnerability services.
• A second try: if an update failed because it needed a companion plugin that was updated later in the same run, NoyaCare tries it once more at the end.

When you do want a held update, tick “Ignore hold rules and install everything selected”. It still gets its restore point, its check and the automatic rollback.

Encrypted restore points, even on Nginx and Cloudways

NoyaCare does not just trust a random folder name: every day it tests whether its backup folder can be opened from the web. Many Nginx hosts, Cloudways among them, ignore the .htaccess file that normally closes it. Since version 1.10, every restore point is encrypted with AES-256-GCM, using a key kept in the site’s database and never in the folder. Even if someone downloaded a file, they could not read it, so updates go ahead safely. NoyaCare also explains how to close the folder and gives you a ready-made message for your host, with a Copy button.

Any single update can be undone later from Restore points. Only that plugin’s files and the settings rows that changed are put back. Orders, posts and everything else your site wrote in the meantime are left alone.

Client reports you are happy to send

After every run NoyaCare writes a report in plain language: what was updated, what was held back and why, the safety checks, the restore points and the next scheduled maintenance. It goes out by e-mail with a PDF copy. You choose whether it is sent right after each run, only when something needs attention, or after your review. In review mode you can preview it, fix small things, retest the speed and send the final report with one click. It is built at the moment you send it, so it always shows the latest results.

Speed tests

NoyaCare includes built-in server and page checks, plus speed tests through Google PageSpeed Insights on mobile and desktop. A free API key from Google keeps the tests reliable. Results can go into the client report, and after you fix something, a retest shows “before” and “after” side by side. Speed is reported, never a reason to roll back. If the numbers are not what you hoped for, here is how to speed up a WordPress website.

Safe by default, and you stay in control

• A new install runs nothing on its own: automatic runs are off until you choose a schedule.
• You choose which administrators manage NoyaCare, and only users who may update plugins can change the update rules.
• Nothing outside your site can install or update code through NoyaCare. There is no remote control.
• Restore points, database backups and stored reports are private files, and a full database backup is only kept in a folder that is closed to the web.
• For developers there are WP-CLI commands: wp noyacare run, status, restore and more.

NoyaCare Pro, for freelancers and agencies

The free plugin is complete: no trial, no locked buttons, no upsell nags. NoyaCare Pro is a separate add-on for people who look after many client sites:

Feature	Free	Pro
One-at-a-time updates with a restore point, a real check and an automatic rollback	Yes	Yes
Encrypted restore points and one-click restore	Yes	Yes
Client report by e-mail with a PDF, and review before sending	Yes	Yes
Update rules: hold major versions and new releases, never install what the server cannot run	Yes	Yes
PageSpeed tests and built-in speed checks	Yes	Yes
Uptime and site monitoring, with alerts for blank or broken pages	–	Yes
AI analysis: Claude or ChatGPT, with your own key, explains what went wrong and writes a note for the client	–	Yes
Your name, logo, colour, footer and sender address on every report (white label)	–	Yes
Restore points kept in your own Google Drive	–	Yes
Speed tests on a schedule, GTmetrix tests, and a Website speed section in every report	–	Yes
Smart scheduling: security fixes as soon as they are found, and no runs on dates you choose, such as a sale week	–	Yes
Smart recovery: a held update is tried again once the plugin it was waiting for has changed	–	Yes
Media cleanup: find unused images, back them up and remove them safely	–	Yes

You can try NoyaCare Pro in your browser without installing anything: the NoyaCare page has a live preview.

Get started in five minutes

1. In your WordPress admin, go to Plugins → Add New, search for NoyaCare, then install and activate it.
2. Open NoyaCare → Settings. Under Verification, add the pages that earn you money: shop, cart, checkout, booking form. Under Client reports, add the recipients.
3. Go to the Dashboard, look at the pending updates and press Run maintenance now. Keep the run screen open while it works.
4. When the run has finished, preview the report and send it.
5. Happy with it? Choose a schedule, and maintenance runs weekly or monthly on its own.

What NoyaCare does not do

• It is not a full backup plugin. NoyaCare saves restore points for the updates it installs, so it can undo them. Keep a complete backup of your files and database with a backup plugin or your host as well.
• It cannot see pages it does not load. A problem that only shows on a page you did not add to the checks (an account page, the admin, a form’s confirmation) is not caught by the check. That is why the pages that earn you money belong in the list.
• It does not speed up your site by itself. It measures speed and reports it; making the site faster is a separate job.

Frequently asked questions

Does NoyaCare work with WooCommerce and Elementor?

Yes. NoyaCare runs on live WooCommerce stores with Elementor, JetEngine, FunnelKit, payment gateways and dozens of other plugins. Add your cart and checkout to the pages to check, and a broken checkout is caught and rolled back.

Will it slow down my website?

No. NoyaCare adds nothing to your public pages. It only works during maintenance runs, speed tests and its daily folder check.

What happens when an update breaks the site?

NoyaCare puts the restore point back, checks the site again, marks the update as rolled back and holds that version so it is not installed again until you release it. The report says what happened and which update caused it.

My host runs Nginx, for example Cloudways. Is that a problem?

No. Since version 1.10 restore points are encrypted, so updates go ahead even when the backup folder can be opened from the web. Closing the folder is still worth it, because it also enables full database backups and stored PDF reports, and NoyaCare gives you the message to send your host.

Is the free version limited?

No. Everything in the free plugin works without a licence, a trial or nags. Pro is a separate plugin with extra features for agencies.

NoyaCare is the update tool I wanted for my own client sites: a restore point, a real check and an automatic undo for every update, and a report that shows the client the work behind it. Download NoyaCare free from WordPress.org, have a look at NoyaCare Pro, or, if you would like me to look after your WordPress sites, tell me about them.