After reading all the documentation I could stand and going through the process a number of times, this is the protocol I’ve developed for myself:

1. Make sure all your modules are compatible with the new version

If they aren’t, you should deal with this before the update, not after.

2. Back up all the files, and the database

If anything goes wrong, I need to be able to revert to a known-working state. This also serves as a useful archive, in case anything goes wrong with the site between updates.

3. Put the system in maintenance mode

This will prevent any visitors from potentially encountering a scarily-broken web site before you’re done upgrading.

4. Create a temporary folder, and move all the existing files in there

Don’t want to run the risk of overwriting anything important (especially .htaccess or /sites). Alternately, you could delete your whole site and then re-upload, but this is faster.

5. Upload the new version of Drupal

6. Replace the freshly installed /sites/all folder with the old one from your temporary directory or your backup

This should restore all modules and themes. You’ll notice that I haven’t disabled any modules or themes prior to the update: I only work with custom themes, and so far none have broken in an update. I try to use as few modules as possible on any given site, and always check to ensure essential modules are compatible prior to an update.

7. Move /sites/default/files from your temporary directory or backup to /sites/default/files.

You might need to change the permissions on the old /sites/default/files to do so.

8. Reconcile /sites/default/settings.php

Compare the old /sites/default/default.settings.php to new one. If they match, you can just move the old /sites/default/settings.php to the new /sites/default directory. If they don’t, you need to open the old /sites/default/settings.php, copy /sites/default/default.settings.php to /sites/default/default.settings.php,
and migrate all settings to the new /sites/default/settings.php we just
created.

9. Reconcile .htaccess

If I’m getting Internal Server Errors after the update, it’s nearly always because I missed something in this step. Compare your old .htaccess to your new .htaccess, and make sure to migrate any changes over. For me, this nearly always means enabling RewriteBase (to support pretty urls), and ensuring Drupal runs under PHP5 (required by many modules).

10. Run update.php

This will upgrade all your database tables to the new version.

11. Take the system out of maintenance mode

12. Visit /admin/reports/updates to make sure everything is ok there

13. Verify functionality