[[security-update-core]]

=== Updating the Core Software

[role="summary"]
How to update the core software using the administrative interface or Drush.

(((Core software,updating)))
(((Drush tool,using to update the core software)))
(((Administrative interface,using to update the core software)))

==== Goal

Update the core software, either through the administrative interface or by
using Drush.

//==== Prerequisite knowledge

==== Site prerequisites

* If you want to use Drush, Drush must be installed. See <<install-tools>>.

* If your site is live, you should test this process in a development
environment before running it on your production site. See
<<install-dev-making>>.

==== Steps

. Make a complete backup of your site. Refer to <<prevent-backups>>.

. Open _settings.php_ (_/sites/default/settings.php_) in any plain text
editor. Find the line with the _$settings['update_free_access']_ variable. By
default, it is set to "FALSE" due to security reasons. Change the setting to
"TRUE":
+
----
$settings['update_free_access'] = TRUE;
----

. Disable any caching technique (memcache, varnish, and so on) your application
might be using.

. Put your site in maintenance mode. See <<extend-maintenance>>.

. If you are using Composer to manage dependencies, skip the next six steps, and
instead see <<install-composer>> for instructions on downloading updated
files. Continue with the _update.php_ step.

. Download the tar.gz or zip file archive for the latest version of Drupal
8.x core from https://www.drupal.org/project/drupal[_Drupal.org_ Drupal Core
Downloads]. See <<install-prepare>> for more details on how to find the latest
version.

. Upload the archive file to your web hosting server.

. Extract the archive file to a temporary directory on your server (should be
outside the directory where the site is hosted). Your hosting control panel's
file manager should provide a way to extract the files. Or, if you have
terminal access to your hosting server (running Linux), you can use a command
like:
+
----
tar -xzf drupal-8.3.2.tar.gz
----

. In your site hosting directory, delete the _core_ and _vendor_ directories,
and all files that are not in a subdirectory, including _.htaccess_,
_composer.json_, and _autoload.php_. Don't delete custom and customized files
because you may end up losing the custom functionality stored in them.

. Copy the _core_ and _vendor_ directories and the non-custom/non-customized
files that you deleted in the preceding step from the temporary directory to
your site directory.

. Run the _update.php_ script using either of the following:
+
  * Visit _http://www.example.com/update.php_ in your browser (where
  _www.example.com_ is your site's URL). Click _Continue_ in the first screen
  to run the updates and successfully complete the script.
  * Run the following Drush command: `drush updatedb`

. If you get any error or warning, re-run the _update.php_ script
again till all the updates have been completed successfully.

. Open _settings.php_ (_/sites/default/settings.php_) in a text editor. Find the
line with the _$settings['update_free_access']_ variable and update it to
"FALSE":
+
----
$settings['update_free_access'] = FALSE;
----

. Click _Administration pages_ to return to the administration section of your
site.

. Take your site out of maintenance mode. See <<extend-maintenance>>.

. Clear the cache. See <<prevent-cache-clear>>.

. Re-enable any caching technique you disabled at Step 3.

. You should have the updated version running. You can verify the current
version of your software by checking the _Status report_ (see
<<prevent-status>>).

==== Expand your understanding

* <<install-tools>>
* <<install-dev-making>>
* <<prevent-backups>>

==== Related concepts

<<prevent-status>>

==== Videos

// Video from Drupalize.Me.
video::https://www.youtube-nocookie.com/embed/eLzAD83a9BY[title="Updating the Core Software"]

==== Additional resources

* https://www.drupal.org/project/drupal["Drupal Core Downloads" page on _Drupal.org_]
* https://www.drupal.org/project/registry_rebuild["Registry Rebuild" page on _Drupal.org_]
* The file _/core/UPDATE.txt_ within your installation.


*Attributions*

Written and edited by https://www.drupal.org/u/surendramohan[Surendra Mohan],
https://www.drupal.org/u/batigolix[Boris Doesborgh], and
https://www.drupal.org/u/jojyja[Jojy Alphonso] at
http://redcrackle.com[Red Crackle].
