A copy of the files and the database before the update: if something goes wrong, you can go back to it (Restore Point on the card).
Security measures of this WordPress installation. The critical ones are applied to new installations. Some measures cannot be reverted: make a backup first.
Update Site URL
Known vulnerabilities of the versions installed now. Update to a fixed version, or remove what has no fix.