13.5. Updating the Core Software

Last updated on

11 January 2024

Goal

Update the core software, either through the administrative interface or by using Drush.

Site prerequisites

If you want to use Drush, Drush must be installed. See Section 3.2, “Concept: Additional Tools”.
If your site is live, you should test this process in a development environment before running it on your production site. See Section 11.8, “Making a Development Site”.

Steps

Make a complete backup of your site. Refer to Section 12.3, “Concept: Data Backups”.
Open settings.php (/sites/default/settings.php) in any plain text editor. Find the line with the $settings[update_free_access] variable. By default, it is set to "FALSE" due to security reasons. Change the setting to "TRUE":
```
$settings['update_free_access'] = TRUE;
```
Disable any caching technique (memcache, varnish, and so on) your application might be using.
Put your site in maintenance mode. See Section 11.2, “Enabling and Disabling Maintenance Mode”.
If you are using Composer to manage dependencies, skip the next six steps, and instead see Section 3.5, “Using Composer to Download and Update Files” for instructions on downloading updated files. Continue with the update.php step.
Download the tar.gz or zip file archive for the latest version of Drupal core for the branch you are currently using (such as 8.x or 9.x) from Drupal.org Drupal Core Downloads. See Section 3.4, “Preparing to Install” for more details on how to find the latest version.
Upload the archive file to your web hosting server.
Extract the archive file to a temporary directory on your server (should be outside the directory where the site is hosted). Your hosting control panel’s file manager should provide a way to extract the files. Or, if you have terminal access to your hosting server (running Linux), you can use a command like:
```
tar -xzf drupal-8.3.2.tar.gz
```
In your site hosting directory, delete the core and vendor directories, and all files that are not in a subdirectory, including .htaccess, composer.json, and autoload.php. Don’t delete custom and customized files because you may end up losing the custom functionality stored in them.
Copy the core and vendor directories and the non-custom/non-customized files that you deleted in the preceding step from the temporary directory to your site directory.
Run the update.php script using either of the following:
- Visit http://www.example.com/update.php in your browser (where www.example.com is your site’s URL). Click Continue in the first screen to run the updates and successfully complete the script.
- Run the following Drush command: drush updatedb
If you get any error or warning, re-run the update.php script again till all the updates have been completed successfully.
Open settings.php (/sites/default/settings.php) in a text editor. Find the line with the $settings[update_free_access] variable and update it to "FALSE":
```
$settings['update_free_access'] = FALSE;
```
Click Administration pages to return to the administration section of your site.
Take your site out of maintenance mode. See Section 11.2, “Enabling and Disabling Maintenance Mode”.
Clear the cache. See Section 12.2, “Clearing the Cache”.
Re-enable any caching technique you disabled at Step 3.
You should have the updated version running. You can verify the current version of your software by checking the Status report (see Section 12.5, “Concept: Status Report”).

Attributions

Written and edited by Surendra Mohan, Boris Doesborgh, and Jojy Alphonso at Red Crackle.

This page is generated from AsciiDoc source from the User Guide. To propose a change, edit the source and attach the file to a new issue in the User Guide project. PDF and e-book formats are available on the User Guide project page.

Source file: security-update-core.asciidoc