So Outside Technology Security CMS
AnQiCMS
Online Demonstration

It is more stable to upgrade on which day of the week when updating the description only includes security fixes.

📅 2026-11-01 👁️ 0

Update description should only mention when to upgrade on which day for safety repairs? Do not schedule it on Friday or before holidays, choose a working day morning with someone on duty for safety, Tuesday or Wednesday is usually the most appropriate: There is a whole day to deal with problems, the day can be rolled back, and there is also room for review. The update description for 'safety repair' and regular feature update scheduling logic is different, the risk window of the safety version starts from the announcement release.

Functional version and security version are not the same thing

Function versions have a predictable release date. The Joomla official has written in the release news that “Joomla! 6.2 (general availability) will be released on or about 13th October 2026.“, such dates allow operation and maintenance staff to schedule them into the plan schedule.The secure version is often opposite: Drupal's official security alert states, 'PHP has announced a critical PHP security release for Wednesday, October 21, 2026, at 14:00 UTC. Reserve time to update PHP as soon as the release is available.' The tone is to reserve time and update PHP as soon as the version is available.

The consequences of mixing the two are very specific: placing security fixes in the regular releases at the end of the quarter is equivalent to leaving a gap between the announcement and actual handling, during which the exposure period is public.

Which time period should the window be placed?

When scheduling, filter time periods according to four constraints:

  • Avoid Friday and before holidays: the cost of fault handling spanning the rest period is the highest.
  • Choose off-peak business hours but have someone on duty: although the traffic is low at midnight, the rollback is slower when there is no one on duty.
  • Avoid backup tasks: when the upgrade window collides with automatic backup, the recovery point may be in a semi-updated state.
  • Leave time for review: No other changes are scheduled on the upgrade day to facilitate locating the anomaly from which change.

Following these four points, the morning of weekdays is the most common landing point; if the announcement gives a clear deadline for high-risk patches in the operating environment, the preparation actions should be completed in advance by reversing the execution time of the announcement.

Preparation before upgrade

Three things must be done before the window: a complete backup, a clear rollback point, and an executable verification checklist. The backup covers the database and static files, the rollback point records the current version number and configuration location, and the verification checklist at least includes the rendering of the homepage and list page, article page and illustration, in-site search, message and form submission, background login and permission.

AnQiCMS backup and recovery supports data and static files to be processed together, in conjunction with scheduled publishing and pending publishing status, which can hold new content during the upgrade period first, to avoid simultaneous content changes in the update window. It is also recommended to confirm the current version of the site during the preparation phase to avoid missing intermediate configuration changes when upgrading across multiple old versions.

Verification and record after upgrade

After the upgrade is completed, verify items one by one according to the list, and then do three more things:

  1. Review the configuration related to security has not been temporarily changed, including authentication methods, captcha, and content review switches.
  2. Sample the external visible page, confirm there are no abnormal jumps or implanted content.
  3. Record the date, target version, executor, and verification results in the version ledger.

The repair of credential-related issues, the final actions are not just to supplement the version. AnQiCMS v3.6.6 (2026-10-08) fixed two high-risk issues of list sorting parameter injection and the site switching login credentials being forgeable, the upgrade instructions also suggest rotating the site signature key and changing the administrator password; such a requirement of 'repair and rotate the key' should be written into the change log of this time, otherwise, no one will remember after a week.

Common questions

Is it necessary to upgrade the security repair on the same day?Check the urgency of the announcement and the exposure surface of the site. Provide a clear deadline or handle the announced exploitation as soon as possible; for those without a deadline, they should also be completed within the same work week and not delayed to the end of the month.

What should you do if there is no test environment?Create a copy in an isolated environment using the backup, run the verification list first, and then go to production; this step is much cheaper than rolling back on the production site.

Can we combine the security upgrade and feature upgrade into one?Yes, but you need to confirm that the functional changes will not interfere with the judgment of the security verification. It will be more difficult to locate exceptions after merging, and the verification list needs to cover two types of changes.

Related articles

How to supplement the missing content in the package when migrating from another content system

When migrating sites, the exported files usually only cover the main content and some metadata. The body of attachments and custom content types generated by plugins are often missing. The method to make up for this is to first move the media directory separately, then use the content model and custom fields to take over the missing fields, and finally use batch import to fill in the content by category, use 301 redirect rules to converge historical addresses, and avoid the appearance of a large number of invalid pages.

2026-11-01

How to split the index file when the site map entries reach the upper limit.

When the site map entries reach the limit, the approach is to divide the addresses into multiple slice files by category or time, and then list them with an index file. According to the information checked on the day, the limit for a single file is 50,000 addresses and an uncompressed volume of 50MB, and it needs to be split if exceeded. The index file only assumes the responsibility of the directory, does not directly list the page addresses, and new content after splitting still needs to be actively pushed to accelerate discovery.

2026-11-01

When the website cannot be opened, which part of the background troubleshooting ability should be checked first

When the website cannot be opened, which part of the background troubleshooting ability should be checked? Determine which layer the request is broken at first according to the process and port, reverse proxy and certificate, data and file three segments, and then configure. The AI Chat intelligent dialogue on AnQiCMS backend can locate the link in a question-and-answer manner, covering the skills of site health check and fault exclusion, which can list the items that can be checked into a list; a recoverable point should be left before making changes.

2026-11-01

There are two ways to deploy: one-click panel deployment and image deployment. After going online, check which items first.

The projects to be checked after the one-click deployment of Baota panel and Docker image deployment are the same, just in a different order. First, confirm that the service is running on the default port 8001, reverse proxy the domain, then check if the backend can log in, and then make a full backup and try a recovery on the day of going live, and finally check if the navigation and email reminders take effect in the new environment.

2026-11-01

When deploying the site using a container image, do you need to install the runtime environment version separately?

Whether the program itself is built-in with the runtime. Interpreter-based technology stacks still need to install the runtime separately, the layer installed in the container image is exactly this one, the host machine's version will not take effect automatically; Programs developed with GoLang come with the runtime after compilation, the image only needs to provide the system dependencies and configuration. Both need to distinguish between the minimum version and the recommended version, and regression testing should be performed after the modification.

2026-11-01

How long will it take for a new page without active push to be indexed by search engines?

When a new page does not perform active push, the time for inclusion depends on the speed at which the search engine discovers it, usually one order of magnitude slower than the submission push. This article explains that active push solves the timeliness of notification, and site map solves the master list, both of which cannot be substituted for each other, and provides the order of access to in-site link push, Baidu push, and Bing submission interface, as well as the method of checking the ratio of repeated push to inclusion.

2026-11-01

Is the free quota of the message form verification code enough?

Determine if the free quota is sufficient, first calculate your actual monthly submission volume instead of the access volume. The free tier of the plan charged by the number of evaluations is up to 10,000 times per month, not based on the access volume; another type of interactive verification plan is unlimited in the number of challenges, but limited in the scale of access. This article provides an estimation method, access sequence, and fallback plan, and explains how to handle submissions that cannot be blocked using in-app review and email reminders.

2026-11-01

What should be done before upgrading to the new version?

Before upgrading, do two things: back up the data along with the static files and confirm that they can be restored, write down the upgrade window and rollback path. For versions involving security fixes, you also need to rotate the site signature key and change all admin passwords after the upgrade. Upgrading itself is not enough to clear the attacker's existing sessions.

2026-11-01