---
title: "Update WordPress core, a plugin or a theme (a pre-update backup is taken by default)"
method: POST
path: "/projects/{projectId}/wordpress/update"
tags: ["WordPress"]
---

# Update WordPress core, a plugin or a theme (a pre-update backup is taken by default)

`POST /projects/{projectId}/wordpress/update`

## Request

- Base URL: `https://hostingsurge.com/api/v1`
- URL: `https://hostingsurge.com/api/v1/projects/{projectId}/wordpress/update`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-hs_session`

## Path parameters

- `projectId` string, uuid, required

## Request body

- object
  - `target` 'core' | 'plugin' | 'theme', required
  - `slug` string: required for target plugin/theme
  - `version` string: omit to update to the latest version
  - `backupFirst` boolean: take an on-demand backup before updating (strongly recommended)

## Response `200`

Update finished

- object
  - `status` 'success' | 'failed', required
  - `output` string, required
  - `backupId` string, uuid, nullable, required

## Other responses

- `400`: Invalid request (code invalid_request)
- `401`: Missing or invalid session/token (code unauthorized)
- `403`: Authenticated but not permitted (code forbidden)
- `404`: Not found or not visible to the caller (code not_found)
- `409`: Conflicting state (code conflict)
- `429`: Too many requests (code rate_limited); see Retry-After
- `503`: Hosting engine unavailable (code provider_unavailable)

---

[API](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api.md) · [All operations](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/revisions/4d08337cdff1?raw)