WordPress Automatic Updates: What Runs, How to Control It

WordPress automatic updates are one of the best security features WordPress has, and one of the most common reasons a site looks different in the morning than it did the night before. Both things are true at once.

This guide explains what WordPress updates on its own, how to turn auto-updates on or off per plugin and theme, how to control core updates with constants and filters, and what should update automatically. It ends with the part most guides skip: what happens after an update runs and nobody is looking.

What WordPress updates automatically by default#

Out of the box, a standard WordPress install updates some things in the background with no action from you. Here is the default behaviour:

A few details are worth knowing:

• Minor releases are the security and bug-fix releases. WordPress has installed these automatically for years, and for most sites that is the right call.
• Major releases add features and change more code. You can opt in from Dashboard > Updates, where WordPress shows a link to enable automatic updates for all new versions of WordPress, or to switch back to maintenance and security releases only.
• Plugins and themes only update automatically if you, your host or another plugin turned that on. Some managed WordPress hosts run their own update system, so check your hosting dashboard too.
• Version control: if WordPress detects that the site is a Git or SVN checkout, it skips automatic core updates, on the assumption that you deploy code another way.

Background updates run through WP-Cron, the same scheduler WordPress uses for scheduled posts. WordPress checks for new versions about twice a day, and the update itself runs when WP-Cron fires. On many sites that ends up being at night, when traffic is low and nobody on your team is watching.

How to enable or disable auto-updates for plugins#

Since WordPress 5.5, you can control auto-updates per plugin from the admin screen.

1. Go to Plugins > Installed Plugins.
2. Find the Automatic Updates column on the right of the table.
3. Click Enable auto-updates next to a plugin to turn it on, or Disable auto-updates to turn it off.
4. To change several at once, tick the checkboxes, open the Bulk actions menu and choose Enable Auto-updates or Disable Auto-updates, then click Apply.

When auto-updates are on, the column also shows roughly when the next update check will run.

If you manage sites from the command line, WP-CLI does the same job:

# See which plugins have auto-updates on
wp plugin auto-updates status --all

# Turn on auto-updates for one plugin
wp plugin auto-updates enable wordfence

# Turn off auto-updates for every plugin
wp plugin auto-updates disable --all

How to enable or disable auto-updates for themes#

Themes work the same way, but the control is in a different place.

1. Go to Appearance > Themes.
2. Click a theme to open its details.
3. Click Enable auto-updates or Disable auto-updates.

With WP-CLI:

wp theme auto-updates enable twentytwentyfive
wp theme auto-updates disable --all

If you use a child theme, the setting that matters is on the parent theme, because that is the code that changes. Your child theme is your own code and does not receive updates from WordPress.org.

How to control major core updates#

You have three ways to decide whether WordPress jumps to new major versions on its own:

1. Dashboard > Updates. Use the link at the top of the screen to switch between automatic updates for all new versions and maintenance and security releases only. This is the simplest option for one site.
2. The WP_AUTO_UPDATE_CORE constant in wp-config.php. This overrides the dashboard setting.
3. Filters such as allow_major_auto_core_updates, for developers who want logic in code.

For most business sites, the sensible default is to keep minor releases automatic and run major releases yourself, after a backup, on a day when someone can check the site.

The wp-config.php constants#

Add these to wp-config.php, above the line that says /* That's all, stop editing! */.

WP_AUTO_UPDATE_CORE#

Controls automatic core updates only. It does not affect plugins or themes.

// Only minor (security and maintenance) releases. This is the default.
define( 'WP_AUTO_UPDATE_CORE', 'minor' );

// All core releases, major and minor.
define( 'WP_AUTO_UPDATE_CORE', true );

// No automatic core updates at all.
define( 'WP_AUTO_UPDATE_CORE', false );

Setting it to false is rarely a good idea. You lose automatic security releases, which is exactly the protection most sites need.

AUTOMATIC_UPDATER_DISABLED#

This is the big switch. It turns off every background update: core, plugins, themes and translations.

define( 'AUTOMATIC_UPDATER_DISABLED', true );

Use it only when updates are handled somewhere else, for example by a deployment pipeline or a managed host. If you set this and forget about it, the site stops receiving security fixes.

DISALLOW_FILE_MODS#

Worth knowing because it often causes confusion. Setting DISALLOW_FILE_MODS to true blocks plugin and theme installs, the file editors and updates from the dashboard, and it also stops automatic updates. If auto-updates seem to have stopped working, check that this constant is not set.

The filters: auto_update_plugin and auto_update_theme#

Filters give you more control than the constants. Put them in a small must-use plugin, for example wp-content/mu-plugins/auto-updates.php, so a theme change cannot remove them.

Turn on auto-updates for all plugins and themes#

<?php
add_filter( 'auto_update_plugin', '__return_true' );
add_filter( 'auto_update_theme', '__return_true' );

Turn off auto-updates for all plugins and themes#

<?php
add_filter( 'auto_update_plugin', '__return_false' );
add_filter( 'auto_update_theme', '__return_false' );

Auto-update everything except a hold list#

This is the pattern most agencies end up with: auto-update the low-risk plugins, hold the ones that can break the front end or the store.

<?php
add_filter( 'auto_update_plugin', function ( $update, $item ) {
    $hold = array( 'woocommerce', 'elementor', 'wp-rocket' );

    if ( isset( $item->slug ) && in_array( $item->slug, $hold, true ) ) {
        return false;
    }

    return true;
}, 10, 2 );

A filter wins over whatever is set on the Plugins screen, so document it for anyone else who works on the site. Otherwise someone will click Enable auto-updates and wonder why nothing happens.

The email WordPress sends after background updates#

After a background update, WordPress emails the address set in Settings > General > Administration Email Address.

• For core updates, you get an email saying the site was updated to a new version, or that an update failed.
• For plugin and theme auto-updates, you get a summary of what was updated and what failed.

These emails are useful, but they only tell you that an update ran and whether the update process itself succeeded. They do not tell you whether your pages still look right or still work. A plugin can update "successfully" and still remove a button, break a layout or set a page to noindex.

If the emails are too noisy, developers can turn them off with filters:

<?php
add_filter( 'auto_plugin_update_send_email', '__return_false' );
add_filter( 'auto_theme_update_send_email', '__return_false' );
add_filter( 'auto_core_update_send_email', '__return_false' );

Think twice before doing that. Those emails are often the only record of what changed overnight.

Is it working? Check Site Health#

Go to Tools > Site Health. WordPress runs a test for background updates and tells you if something is stopping them, such as a constant, a filter or file permissions. It is the fastest way to confirm automatic updates are actually running.

Should you turn on WordPress automatic updates?#

For some things yes, for others not without a check afterwards. It is a tradeoff between security and breakage.

The case for auto-updates:

• Security fixes reach your site within hours instead of whenever someone remembers to log in.
• Sites that are never touched stay patched.
• On many sites, outdated plugins are a bigger risk than a bad update. Our WordPress security guide covers why.

The case against:

• An update can change your layout, conflict with another plugin or break your checkout.
• It usually happens when nobody is watching.
• When something breaks, you find out from a customer, and nobody knows which update caused it.

WordPress has added some safety nets. Since WordPress 6.6, if a plugin auto-update causes a PHP fatal error, WordPress tries to roll that plugin back to the previous version. That helps with the worst case, a critical error that takes the site down. It does not help when the site loads fine but something on the page is wrong, because no error is thrown.

Which plugins to auto-update#

Good candidates are plugins that rarely touch the front end and where speed matters:

• Security plugins.
• Small utility plugins with a simple job and a good track record.
• Backup plugins.
• Plugins that are not active on the live site's pages, such as admin tools.

Which plugins to hold for manual updates#

Hold the ones where a bad release costs money or traffic:

• WooCommerce and its payment gateway and shipping extensions.
• Page builders such as Elementor, Divi or Beaver Builder.
• Caching and performance plugins, which can change how every page is served.
• SEO plugins, which control titles, canonicals and robots tags. See our WordPress SEO guide.
• Anything custom built or heavily configured.

For held plugins, follow a routine: back up, update one at a time, then check the important pages. Our guide on how to safely update WordPress plugins walks through it, and if an update has already gone wrong, here is how to roll back a WordPress plugin.

The missing piece: nobody checks the site afterwards#

Here is the real problem with automatic updates. They are designed to run unattended, and they do. But the check that should follow an update, "does the site still work?", is still left to a person, and at three in the morning there is no person.

What can go wrong after an update that completes without errors:

• A checkout or signup button disappears or stops working. If it is your store, start with our guide to WooCommerce checkout not working.
• The layout shifts or a section stops rendering.
• An SEO plugin update changes titles or sets pages to noindex.
• A caching plugin update serves a broken or outdated page.
• Analytics or tag manager scripts stop loading.
• Internal links start returning 404.

None of these trigger a PHP fatal error, so the 6.6 rollback does nothing, and the update email still says everything updated successfully.

This is the gap MyKavo's free WordPress plugin was built for. Its Safe Updates feature listens for every plugin, theme, core and translation update, including automatic background updates. When an update finishes, MyKavo checks your monitored pages against your approved baseline and gives a verdict: nothing changed, or exactly what did, with the update named, for example "Appeared after: Updated WooCommerce 8.1.0 to 8.2.0". It does the same when a plugin is activated or deactivated, or the theme is switched.

Update checks with verdicts are included in every paid plan, from Starter at $7 a month. On the free plan, updates are still listed, so you can see what updated and when next to any changes MyKavo found on its regular scans.

With a check after every update, you can leave more plugins on auto-update and hear about a bad one in the morning, not from a customer.

A simple automatic update policy for most sites#

If you want a starting point, this works for most business sites and agencies:

1. Keep minor core releases automatic. Leave WP_AUTO_UPDATE_CORE at its default.
2. Run major core releases manually, after a backup.
3. Auto-update security, backup and low-risk utility plugins.
4. Hold WooCommerce, payment gateways, page builders, caching and SEO plugins, and update them during a planned maintenance window.
5. Keep the update emails turned on.
6. Check Tools > Site Health monthly to confirm background updates are working.
7. Check your key pages after every update, automatic or manual. Our WordPress maintenance checklist has the full routine.