WordPress automatic updates: how they work and how to set them up safely

What WordPress updates automatically by default

WordPress has updated itself in the background since version 3.7. Out of the box, each part behaves differently:

So on most sites, the security releases already arrive on their own. The choices you make are about major core versions, plugins and themes.

How to turn on automatic updates for plugins and themes

Plugin and theme auto-updates arrived in WordPress 5.5. They stay off until you turn them on, one at a time or in bulk.

1. In wp-admin, go to Plugins > Installed Plugins.
2. In the Automatic Updates column, click Enable auto-updates next to the plugin.
3. To do several at once, tick them, choose Enable Auto-updates from the Bulk actions menu and click Apply.

For a theme, go to Appearance > Themes, click the theme to open its details and click Enable auto-updates. WordPress emails the site admin after automatic plugin and theme updates, so you know what changed.

If you do not see the column or the link, your host or another plugin has switched the feature off, or the plugin comes from outside WordPress.org and has its own updater.

How to turn WordPress core automatic updates on or off

From the dashboard: go to Dashboard > Updates. Near the top, WordPress says whether the site updates to every new version automatically, with a link to switch between all new versions and maintenance and security releases only.

In wp-config.php: add one of these lines above the comment that says to stop editing:

define( 'WP_AUTO_UPDATE_CORE', true );    // every core update, including major versions
define( 'WP_AUTO_UPDATE_CORE', 'minor' ); // minor and security releases only
define( 'WP_AUTO_UPDATE_CORE', false );   // no core updates at all

Use only one of the three. When the constant is set, it overrides the dashboard setting, so the switch on the Updates screen stops working.

How to disable WordPress automatic updates

You can switch off one part or everything. Think twice before turning off minor core updates: they carry the security fixes, and WordPress's own documentation strongly discourages disabling all automatic updates.

Turn off all automatic updates

define( 'AUTOMATIC_UPDATER_DISABLED', true );

This stops core, plugin, theme and translation updates, security releases included. From then on, you update everything by hand.

Turn off core automatic updates only

define( 'WP_AUTO_UPDATE_CORE', false );

Turn off plugin or theme auto-updates

Click Disable auto-updates next to each plugin or theme, or use the Bulk actions menu. To force them off for every plugin and theme, even if someone turns them on later, add a filter in a must-use plugin: a PHP file in wp-content/mu-plugins/.

<?php
// Never auto-update plugins or themes on this site.
add_filter( 'auto_update_plugin', '__return_false' );
add_filter( 'auto_update_theme', '__return_false' );

Returning false also blocks the rare security fixes WordPress.org pushes, so watching for those becomes your job.

Keep one plugin from auto-updating

To leave every other plugin as it is but never auto-update one of them, check its slug in the filter:

<?php
// Never auto-update WooCommerce, whatever the setting says.
add_filter( 'auto_update_plugin', function ( $update, $item ) {
    if ( isset( $item->slug ) && 'woocommerce' === $item->slug ) {
        return false;
    }
    return $update;
}, 10, 2 );

Automatic update constants and filters at a glance

What WordPress does when an automatic update breaks a site

WordPress has a few safety nets. They cover less than most people assume.

• Failed core updates are undone. Since background updates arrived in 3.7, a core update that fails to install is rolled back.
• Failed plugin and theme updates are restored (6.3). If an update fails partway, for example because a file cannot be moved, WordPress puts the previous version back from a temporary backup in wp-content/upgrade-temp-backup/.
• Plugin auto-updates that crash the site are rolled back (6.6). After a plugin auto-updates, WordPress requests the home page. If that finds a PHP fatal error, or the request fails, the previous version is restored and the site admin gets an email.

What those safety nets do not catch:

• A plugin update that breaks a page other than the home page.
• A layout, checkout or form that breaks without a PHP fatal error: the page loads, but looks or works wrong.
• A theme auto-update that breaks the site, because the 6.6 rollback covers plugins only.
• Problems that appear later, after the check has run.

For those you need a restore point from just before the update and someone, or something, checking the site afterwards. That is the gap visual regression testing closes. If an update has already broken a site, follow our guide for when a plugin update breaks your site, or the steps for the WordPress critical error message.

Should you turn on WordPress automatic updates?

Usually yes for security releases, and selectively for plugins. Many WordPress break-ins go through plugin vulnerabilities that already had a fix available, so an update that never gets installed is a real risk. The argument against is just as real: an update can break a site while nobody is watching. The answer is not to pick one side, it is to make every update checkable.

Why WordPress automatic updates sometimes do not run

• WP-Cron is not running. WordPress checks for updates about twice a day through its built-in scheduler, which only runs when the site gets visits. On a quiet site, or where DISABLE_WP_CRON is set without a real cron job, updates can be late or never happen.
• File changes are blocked. DISALLOW_FILE_MODS set to true in wp-config.php stops updates and installs from wp-admin, automatic ones included.
• The code is under version control. WordPress skips automatic updates when it detects a version control checkout, such as a .git folder.
• Your host manages updates. Some managed WordPress hosts run updates themselves and turn WordPress's own updater off.
• WordPress cannot write its own files. Background updates need direct write access. If WordPress would have to ask for FTP details, they do not run.
• Loopback requests are blocked. Since 6.6, WordPress checks the home page after a plugin auto-update. If a firewall blocks that request, the update is treated as failed and rolled back.
• Premium plugins. Plugins from outside WordPress.org update only if their own updater supports it, usually with an active license.

Tools > Site Health flags several of these, including problems with background updates and loopback requests.

How to set up WordPress automatic updates safely, step by step

These seven steps work whether WordPress runs the updates or a tool does. A backup with a restore point before every update is the one you should not skip, and our WordPress backup guide shows how to set one up.

1. Take a restore point right before updates. A nightly backup can be almost a day old. A restore point taken minutes before the update gives you a clean way back without losing new orders or form entries.
2. Leave core minor and security releases on. They are small, rarely break anything and carry the security fixes.
3. Turn on plugin auto-updates selectively. Start with well-maintained plugins with many active installs. Hold back page builders, store extensions and anything your custom code depends on.
4. Pick a quiet window. Update when traffic is low and someone can look at the site afterwards, not during a sale or a launch. WordPress picks its own time, so use a tool if timing matters.
5. Check more than the home page. After updates, open the pages that earn money or collect leads: checkout, forms, login. Look for layout breaks, not only errors.
6. Make sure the update emails reach someone. WordPress's update and rollback emails go to the site's admin address. Point it at an inbox a person reads.
7. Know your way back before you need it. Write down how to restore the restore point or roll back a single plugin, so a broken update costs minutes, not an afternoon.

The same routine is part of any good WordPress maintenance plan, and if you already test WordPress updates visually, steps five and seven are mostly done for you.

Managing automatic updates across many WordPress sites

Every setting above lives inside each site. With ten or fifty sites, that means ten or fifty update setups, a stream of emails, and no single place to see what changed. This is the problem safe WordPress updates with automatic rollback in WPCentrify are built for. (Disclosure: WPCentrify is our product.)