Prepare recovery
Save the files and database as a consistent set. Check the access to the backup copy and the ability to restore it separately from the work site. Before changing the PHP version, check the theme and plugin requirements. A copy in the same directory does not protect against all server or account problems.
Continue with: Website backups: prove that recovery works.
Repeat the update on the copy
Close staging from indexing and third-party visitors, turn off real emails, payments and CRM-sending. Update the components in the agreed order with a check after each group. If an error occurs, write down the component version and log: accidentally disabling all plugins at the same time makes it difficult to find the cause.
Continue with: Website monitoring: why HTTP 200 is not enough.
Check out the site as a visitor
Open the homepage, key landing page, form, search and page in another language. Check the mobile view, successful and failed form submission, analytics operation according to the agreed mode. After publishing, clear the relevant caches and repeat the short test on the live domain. For the store, separately consider the orders that appeared during the works.
Should I turn off automatic updates?
The solution depends on the component and the support process. It is more important to have backups, monitoring and a proven procedure for responding to a failed update.