How to Fix WordPress 500 Internal Server Error When Updating Plugins in IIS Windows

December 9, 2025

2 Min Read

I recently refreshed my WordPress theme and plugins after performance issues and errors on an eight year old theme. It was a fun theme, but it needed to go. After upgrading to a new WordPress theme, installing updates on all plugins gave me a WordPress 500 error. The error isn’t actually from WordPress. It’s from IIS, if you host your site on Windows. Here is how I fixed it!

Why You’re Getting WordPress 500 Errors

If you’re like me, you started your WordPress site years ago when plugins and WordPress code were much smaller. You have enough server resources for a small blog, so the thought of upgrading your virtual machine’s RAM or CPU seems unnecessary. When you update to a newer theme or WordPress version, you start getting these errors:

What’s worse is that if this happens in the middle of a WordPress core update, it can break your site. My issue started happening as soon as I installed a large plugin named Elementor. Hopefully, you have backups of your code to restore it. I use Azure virtual machines, so I could just restore from the previous night’s backup. Still, it’s annoying, stressful, and wastes your time. If you’re not technical, it can be especially stressful.

Fixing Error 500 in WordPress

Note that a server 500 error is a general error, so this won’t fix all 500 internal server errors. Here are some pre-requisites to tell you if this change might fix your issues:

Your WordPress site is running slow
You must recycle the application pool after updating
Scans from applications like WordFence crash the site
Your site displays a critical error page to users after plugin updates
Upgrading goes slow and then returns a 500 error

In my case, my site was running slow but then completely crashed when I would perform updates to plugins and WordPress itself. I disabled plugins and tried removing some widgets that I thought were causing issues, but it didn’t work.

					
												

							
															
									Join Our Newsletter								
							
															
									get weekly access to the latest hacks, tricks, and updates								
							
						
						
						
					
							
		
			Name
			

		
			
		
			Email Address

Steps to Fix It

First, you need to go to your host machine. I use an Azure VM, but you might have cPanel or some other interface with your WordPress host. The important part is that you need to be able to access the php.ini file. This file contains several settings for WordPress and the PHP interpreter running the site.

Open the php.ini file with Notepad.
Do a search for the following configuration setting:

memory_limit

3. Change the memory_limit value to 1024M. (Mine was set to 128M, which is far too low for a modern WordPress site)

Bonus PHP Setting!

Scroll a bit up the file and you’ll see this other setting:

max_execution_time

It’s probably set to 60, which is 60 seconds. It’s recommended that you set this value to 300 seconds (5 minutes).

After you change the settings in the php.ini file, you need to stop and restart the website. You don’t need to stop and start all of IIS (and essentially all your websites), and you don’t need to reboot the server entirely. Follow these steps:

1. Open IIS Manager by typing “iis” into the search bar.

2. When IIS opens, go to your list of websites and right click the name given to your website. Click the “Restart” button to bounce the site. This will reload the new PHP settings.

After you’re done, check your site. It should run noticeably faster. Before any update, you should still take a backup of your site files and database, but now you should be able to upgrade all your plugins and WordPress core functions.

Categorized in:

Technical Analysis

Tagged in:

jennifer

As a writer with 15 years of experience helping brands grow their visibility online, I provide content with proven success for many small businesses and large enterprises. I've helped numerous companies improve traffic to their sites including Microsoft, Pure Storage, Adobe, Rackspace, CloudLinux, SolarWinds, IBM and several more. I've had content featured in TechCrunch and FastCompany. I've also ghostwritten technical books for O'Reilly. Contact me to see what I can do for you at [email protected]. See my portfolio here: https://www.clippings.me/jennm.

View All Articles

Other Stories

How to Exploit the CSV-to-SortTable Vulnerability Local File Inclusion (CVE-2025-13070 with Proof of Concept)

Tis the Season for Ecommerce Fraud and Account Takeover Attacks

jennifer

Founder & Editor

Title: The OWASP Top 10 Handbook: Hacking Broken Access Controls (with practical examples and code)

Summary: Buy this book on Amazon. The OWASP Top 10 is a categorization of common vulnerabilities affecting applications. This book covers category one: broken access controls. Broken access controls is an umbrella category for several different ways hackers can gain control over accounts and applications using mistakes in authentication and authorization. You might think that you have authentication locked down in your application or API, but hackers often find bugs to bypass controls. Broken access controls are usually minor mistakes with huge consequences, and this book provides developers and application owners with basic examples to help them find their own vulnerabilities. This book offers real-world examples and code to show developers or application owners how hackers gain access to accounts or unauthorized data using exploits on broken access controls. Python code is used in real-world example scenarios to test applications for common vulnerabilities, so developers can grasp the ease at which some broken access controls can be hacked. Application owners will get a better understanding of cybersecurity issues and the importance of hardened source code. All Python scripts are published on Github publicly for your convenience. The ebook has seven chapters: Introduction: A breakdown of several broken access control subcategories and an understanding of the OWASP Top 10. Chapter 1 (Principle of Least Privilege): If you’re designing an application or need to create authorization rules, the Principle of Least Privilege is covered in this chapter to help you understand the best way to provide data access to customers and employees. Chapter 2 (Modifying URL Parameters and IDOR): This chapter shows you examples of how to exploit query string parameters to gain access to data, escalate privileges, or gain unauthorized access to web pages. Chapter 3 (Exploit URL Parameter Vulnerabilities to Gain Access to Files): URL parameters are often an unnoticed vulnerability, so this chapter shows you how to manipulate URL parameters to access sensitive files that contain data such as server configurations or application passwords. Chapter 4 (Hacking APIs with Missing Authentication): APIs provide critical backend functionality, so this chapter covers testing of API endpoints to find missing authentication controls or other vulnerabilities. Chapter 5 (CORS Misconfigurations): Understand CORS, pre-fetching, and how you can configure an API to allow authorized access from remote domains. Chapter 6 (Bad Redirects and Authentication): Developers often use redirects to bring authenticated users to specific application pages, so we cover checking authorization controls on pages that could be abused by internal users. Chapter 7 (Where to Go From Here?): Wrap-up and provide basic advice for the next steps. Protecting an application is a huge undertaking, so it’s usually best to hire a professional.