Security vulnerabilities in WordPress plugins are discovered and patched constantly. A single day with an unpatched critical vulnerability is enough time for automated scanners to find and exploit it across thousands of sites. WordPress auto updates keep plugins, themes, and WordPress core current without requiring manual intervention — reducing the vulnerability window from days or weeks to hours. But WordPress auto updates also carry a small risk of breaking the site if a plugin update introduces incompatibilities. Configuring them correctly balances protection against disruption. We go deeper on the whole subject in our Complete Guide to WordPress How.
WordPress Auto Updates — What Updates Automatically by Default
WordPress auto updates apply different default policies to different update types based on their risk profile. Understanding which updates already run automatically versus which require configuration shapes the correct approach for each site.
Minor core updates (patch versions like 6.4.1 → 6.4.2) automatically install on all WordPress sites by default. These updates contain only security patches and bug fixes — no new features, no API changes, no compatibility risks. WordPress auto updates apply them silently overnight without any administrator action. Major core updates (6.3 → 6.4) do not auto-update by default — they require manual action because major versions sometimes change APIs, template structures, or admin behaviours that could affect themes and plugins. WordPress correctly treats them as requiring human review.
Plugins and themes do not auto-update by default. Each plugin and theme has an “Enable auto-updates” toggle in the Plugins and Themes admin screens. Enabling it for specific items turns on WordPress auto updates for that item — WordPress installs new versions within 12 hours of publication on WordPress.org. This per-item toggle allows selecting which plugins to auto-update (security plugins, popular well-maintained tools) versus which to update manually (complex page builders, WooCommerce, business-critical custom plugins). According to the WordPress developer documentation, WordPress auto updates are performed by a background WP-Cron job. Sites with WP-Cron reliability issues — where cron only runs when visitors trigger page loads — may experience delayed automatic updates even when auto-updates are fully configured.
Enabling WordPress Auto Updates for All Plugins and Themes
Enabling WordPress auto updates across all installed plugins and themes via the admin is straightforward but can be tedious with many plugins. Bulk enable options and WP-CLI commands make the process fast regardless of plugin count.
Bulk enable for plugins: Plugins → All Plugins → checkbox in the table header to select all → Bulk Actions → Enable Auto-updates → Apply. This enables WordPress auto updates for every currently installed plugin in one action. For themes: Appearance → Themes → hover over each theme → enable auto-updates individually, or use WP-CLI for bulk operations: wp theme auto-updates enable --all and wp plugin auto-updates enable --all. These WP-CLI commands process all installed plugins and themes in seconds from the server command line — significantly faster than admin clicks for sites with 30+ installed plugins.
Selective WordPress auto updates — enabling them only for security-relevant plugins — balances protection with risk management. Enable auto-updates for: security plugins (Wordfence, Sucuri, WP 2FA — security patches should install as quickly as possible), SEO plugins (Rank Math, Yoast — frequently updated with improvements, rarely breaking), and established utility plugins with professional maintenance teams. Manually review updates for: page builder plugins (Elementor, Divi — complex updates with potential layout compatibility issues), WooCommerce and payment plugins (business-critical, test on staging before production), and plugins from smaller developers with less rigorous quality control. Our guide on fixing themes broken after updates covers the staging-first update testing workflow that applies to any plugin designated for manual update review rather than WordPress auto updates.
Configuring Auto Updates via wp-config.php and Filters
Fine-grained control over WordPress auto updates behaviour is available through wp-config.php constants and WordPress filters — providing programmatic configuration beyond what the admin toggle interface offers, including enabling major core updates and disabling all updates for specific environments.
Key auto-update constants for wp-config.php:
// Enable major WordPress core auto-updates (disabled by default)
define('WP_AUTO_UPDATE_CORE', true);
// Options: true (all), false (none), 'minor' (patch only — default)
// Disable ALL auto-updates site-wide (staging environments)
define('AUTOMATIC_UPDATER_DISABLED', true);
Filter-based control gives per-plugin or per-theme WordPress auto updates configuration without touching the admin: add_filter('auto_update_plugin', '__return_true'); enables all plugin updates; add_filter('auto_update_theme', '__return_false'); disables all theme updates. For granular per-plugin control: add_filter('auto_update_plugin', function($update, $item) { return in_array($item->slug, ['wordfence','rank-math-seo']); }, 10, 2); — this enables WordPress auto updates only for the specified slugs, disabling them for everything else regardless of the admin toggle state. This approach is particularly useful for agencies managing multiple client sites from a shared must-use plugin — the auto-update policy is enforced consistently across all sites from a single code location.
For staging environments, always disable WordPress auto updates entirely: add define('AUTOMATIC_UPDATER_DISABLED', true); to the staging wp-config.php. Automatic updates on staging would change the environment between testing sessions, making testing results non-deterministic. Staging and production should be identical except for intentional changes under test — WordPress auto updates on staging undermine this parity. Managed WordPress hosts (WP Engine, Kinsta, Cloudways) sometimes enforce their own auto-update policies via the hosting dashboard that override wp-config.php constants — check the hosting control panel for auto-update settings before relying solely on code-based configuration. Our guide on fixing WordPress scheduled posts covers the WP-Cron system that drives WordPress auto updates — sites that have replaced WP-Cron with real server cron have more reliable update timing than sites relying on visitor-triggered cron.
Monitoring WordPress Auto Updates Success and Failures
WordPress auto updates run silently in the background — without monitoring, a failed update or an update that breaks functionality may not be discovered for hours or days. Setting up notification and logging for auto-update events converts the silent background process into a monitored, auditable operation.
WordPress sends an email to the admin email address when WordPress auto updates complete — both successful and failed updates generate notification emails. Verify the admin email receives these notifications: Settings → General → Administration Email Address → confirm it is correct and actively monitored. If update emails are not arriving, the WordPress email delivery issue described in our guide on fixing WordPress not sending emails is the likely cause — resolving email delivery restores update monitoring. Check spam folders if the emails are sent but not visible in the inbox — auto-update notifications from [email protected] are occasionally filtered by spam systems.
The WP Activity Log plugin records every WordPress auto updates event in a searchable log — which plugins updated, when, from which version to which version, and whether the update succeeded or failed. This log is invaluable for diagnosing site problems after an auto-update: check the log for any plugin that updated in the hours before a problem appeared → use WP Rollback to revert that specific plugin → confirm whether the rollback resolves the problem. The WP Activity Log also captures failed WordPress auto updates attempts with error codes, allowing identification and resolution of failures before they leave vulnerabilities unpatched for extended periods. For sites on hosting providers with managed control panels (Kinsta, WP Engine, Cloudways), the hosting dashboard typically shows update history including auto-updates — check both the WordPress activity log and the hosting dashboard for a complete picture of all update events.
Auto Updates and Site Stability — Managing the Risk
WordPress auto updates carry a small but real risk of introducing compatibility issues. The correct response is not disabling them — which leaves security vulnerabilities unpatched — but managing the risk through monitoring, backup preparation, and rollback readiness that makes any update failure quick to detect and reverse.
Combine WordPress auto updates with automated site monitoring: UptimeRobot (free) checks the site every minute and alerts immediately if any page returns an error — an auto-update that breaks the homepage triggers an alert within 60 seconds rather than being discovered by a visitor complaint hours later. Configure monitors for multiple key pages (homepage, a single post, the checkout page for WooCommerce sites) to catch failures that affect specific page types rather than the entire site. Some updates break specific functionality without taking the site offline — a broken checkout or contact form may not be caught by basic availability monitoring. A synthetic transaction monitor (testing a complete page flow programmatically) or a weekly manual test of critical user journeys complements uptime monitoring for functional regression detection.
Maintain current backups when relying on WordPress auto updates. If UpdraftPlus is configured with daily backups and 14-day retention, a pre-update restore point is always available within 24 hours. Keep WP Rollback installed and configured — this allows reverting a specific plugin or theme to a previous version in seconds, without a full site restore from backup. The combination of real-time uptime monitoring (fast failure detection), a daily backup (full restore capability), and WP Rollback (targeted plugin-level rollback) creates a complete safety net that makes WordPress auto updates a reliable protection strategy. Reviews from the WordPress security community consistently confirm that unpatched plugin vulnerabilities are the most common WordPress compromise entry point — the risk of a broken site from a bad auto-update is significantly lower than the risk of a compromised site from delayed manual updates, making WordPress auto updates the correct default security posture for production sites with proper monitoring in place.
Auto Updates for WooCommerce and High-Stakes Plugins
WooCommerce, payment gateway plugins, and other business-critical extensions require special consideration for WordPress auto updates — these plugins have direct financial and operational impact, and a breaking update at a busy time can cause significant revenue loss before it is discovered and reversed.
The recommended approach for WooCommerce auto-updates: disable them in production, enable them on a staging environment that mirrors production, and implement a weekly scheduled update review process. Each week: apply all pending updates on staging → run a complete checkout test including payment processing → verify all WooCommerce features (product pages, cart, checkout, emails, order management) → if staging passes, apply the same updates to production during a low-traffic window (late night or early morning). This weekly scheduled update review captures the security benefit of timely updates while providing a human verification step before business-critical changes reach production. The staging environment must be current (updated frequently from production data) for this process to catch compatibility issues that only appear with real product, order, and customer data.
Translation auto-updates are a separate category of WordPress auto updates that is often overlooked. WordPress stores translation files for core, plugins, and themes and updates them automatically when new translations are available — this is controlled by the AUTOMATIC_UPDATER_DISABLED constant but can also be independently managed with the auto_update_translation filter. Translation updates rarely cause functionality issues (they only change language strings, not PHP or JavaScript) but can occasionally cause unexpected label changes on sites with partially customised translations. For sites using custom translation files that override specific strings, translation auto-updates may overwrite the custom strings — use a plugin like Loco Translate (which stores custom translations in a separate file from the auto-updated translation files) to prevent WordPress auto updates from overwriting custom translation work. Our guide on setting up WordPress translation and multilingual sites covers the translation file structure and management that ensures auto-updated translations do not conflict with custom string overrides.
Third-party update management services — ManageWP, MainWP, InfiniteWP — provide centralised WordPress auto updates control across multiple WordPress sites from a single dashboard. For agencies or developers managing 10+ WordPress sites, these platforms are significantly more efficient than logging into each site individually. ManageWP’s Safe Updates feature tests a site’s uptime before and after each update and automatically rolls back if the update causes downtime — providing automated rollback without requiring human monitoring of each individual site. MainWP (self-hosted, free core) provides similar functionality with the ability to schedule update windows (apply all plugin updates on all managed sites every Tuesday at 3 AM) and receive consolidated update reports. The per-site update delegation model — where each site’s WordPress auto updates configuration determines what happens automatically versus what waits for the agency’s scheduled review — is the professional standard for agencies responsible for the security and stability of client sites.
The interaction between WordPress auto updates and WordPress Multisite differs from single-site installations. In a multisite network, plugin and theme updates apply to the entire network — a plugin update on the network administrator’s Updates screen updates that plugin for all subsites simultaneously. Network-activated plugins that auto-update apply the update network-wide without per-subsite opt-in. This means a breaking plugin update affects every subsite on the network at once, amplifying the impact compared to a single-site installation. For multisite networks with business-critical subsites, consider disabling WordPress auto updates for network-activated plugins and implementing a scheduled update review process where all plugin updates are tested on a staging network before being applied to production — this is the approach used by large WordPress multisite networks (university systems, media groups, franchise networks) where simultaneous impact across dozens or hundreds of subsites makes unreviewed auto-updates too risky regardless of the update source’s reputation.
