WordPress automatic updates can help keep your website secure and reduce the time spent managing software updates. Instead of manually installing every new release, WordPress can update certain components in the background.
However, automatic updates are not always the best option for every website.
A straightforward business website may benefit from installing updates automatically, while an online shop, membership platform or heavily customised website might need more controlled testing.
The important decision is not simply whether to enable or disable automatic updates. It is which updates to automate and how to manage the risks.
In this guide, we’ll explain how WordPress automatic updates work, their advantages and disadvantages, and how to choose the right settings for your website.
How Do WordPress Automatic Updates Work?
WordPress has supported automatic background updates since version 3.7, allowing certain software updates to install without an administrator manually starting the process.
There are four main types:
- Core updates: Updates to WordPress itself.
- Plugin updates: New versions of installed plugins.
- Theme updates: New versions of installed themes.
- Translation updates: Updates to language files.
These can operate under different settings, so enabling automatic updates for WordPress core does not necessarily mean every plugin and theme will also update automatically.
Minor and major WordPress core updates
WordPress distinguishes between minor and major core releases.
Minor updates generally contain security fixes, bug fixes and maintenance improvements.
Major updates may introduce new features, changes to existing functionality and broader compatibility considerations.
Minor core updates have generally been enabled automatically since WordPress 3.7.
Starting with WordPress 5.6, new installations generally enable automatic updates for both major and minor core releases by default. Websites installed before this change may retain their previous minor-only settings.
Your hosting provider or website configuration can also affect which updates run automatically.
Plugin and theme automatic updates
Since WordPress 5.5, administrators have been able to enable automatic updates for individual plugins and themes.
Unlike core updates, these are generally opt-in settings rather than something automatically enabled for every installed extension.
This gives you more control over which components update unattended.
For example, you might enable automatic updates for a straightforward, well-maintained plugin while choosing to review updates to a payment gateway or complex page builder before installing them.
WordPress also occasionally applies certain critical security updates under special circumstances, so individual update behaviour can depend on more than the dashboard setting alone.
What Are the Benefits of Automatic Updates?
Automatic updates offer several advantages, particularly for websites that might otherwise go weeks or months without maintenance.
1. Faster security fixes
Outdated WordPress software can contain known security vulnerabilities.
When developers release patches, automatic updates can reduce the time between a fix becoming available and being installed on your website.
This matters because attackers may actively target vulnerabilities in older WordPress versions, plugins and themes.
Automatic updates cannot prevent every security issue, but they can reduce your exposure to vulnerabilities addressed by available patches.
2. Less manual maintenance
Keeping track of WordPress core, themes and multiple plugins takes time.
Automatic updates can handle some of this routine work without requiring you to log in and install every release individually.
This can be particularly useful for smaller websites where maintenance might otherwise be overlooked.
However, reducing the amount of manual work does not remove the need to check that updates have completed successfully.
3. More consistent software maintenance
A common problem with WordPress websites is that updates gradually accumulate.
One plugin gets overlooked, then another, until several components are running considerably older versions.
Automatic updates can help prevent this by keeping selected software closer to its current supported release.
Maintaining reasonably up-to-date software also makes it easier to manage compatibility and investigate problems when they arise.
What Are the Risks of Automatic Updates?
Although automatic updates offer genuine benefits, they can introduce problems when changes happen without prior testing.
1. Plugin and theme compatibility problems
WordPress websites often rely on several components working together.
A plugin update might introduce changes that affect another plugin, a theme or custom functionality.
For example, a WooCommerce extension could update successfully but introduce a compatibility issue affecting checkout.
WordPress may consider the installation successful even though part of the website no longer behaves as expected.
The same applies to page builders, booking systems, membership plugins and custom integrations.
2. Unexpected disruption
Automatic updates can run when you are not actively working on your website.
If an update introduces a problem, you might not notice until a customer reports it or a monitoring system raises an alert.
This makes automatic updates particularly sensitive for websites where broken functionality could affect sales, bookings or enquiries.
Basic uptime monitoring is useful, but it will not necessarily detect a broken contact form or checkout that still returns a normal webpage.
3. Changes to customised files
WordPress updates replace the files belonging to the software being updated.
If someone has modified WordPress core files directly, those changes may be lost during a core update.
Similarly, updating a parent theme can overwrite changes made directly to its files.
A properly configured child theme helps protect theme customisations from parent-theme updates. Custom functionality should also be maintained using appropriate development practices.
Normal WordPress core updates do not ordinarily overwrite your site’s wp-config.php configuration file.
4. Limited testing before installation
An ordinary automatic update does not test every feature of your website before installing a new version.
WordPress includes safeguards to reduce certain types of update failure. For example, modern WordPress versions can roll back some failed plugin automatic updates when a PHP fatal error is detected.
However, these protections cannot identify every compatibility or functionality problem.
An update that completes successfully might still affect a payment integration, page layout or other feature.
Automatic updates reduce manual work, but they are not a substitute for testing and monitoring.
Which WordPress Updates Should You Automate?
The right approach depends on how your website is built, what it does and how disruptive a problem would be.
There is no universal setting that suits every WordPress installation.
Simple blogs and brochure websites
For a relatively straightforward website with a well-maintained theme and a small number of reliable plugins, automatic core updates can be a sensible choice.
You may also decide to enable automatic updates for selected plugins and themes.
This approach works best when you have reliable backups, website monitoring and a way to investigate problems.
Business websites with important functionality
A business website may depend on contact forms, CRM integrations, appointment systems or other functionality.
Automatic security and maintenance updates can still be beneficial, but you should consider how an unexpected change could affect essential services.
For example, you might automate updates for lower-risk components while reviewing changes to critical integrations before installation.
The importance of a plugin matters more than simply how many plugins are installed.
WooCommerce and membership websites
Online shops and membership websites often benefit from a more controlled update process.
These websites may rely on:
- Payment gateways and checkout functionality.
- Subscription or membership integrations.
- Customer accounts and access restrictions.
- Booking or order management systems.
- Custom plugins and third-party services.
A compatibility problem could affect transactions or prevent customers from accessing their accounts.
For these websites, it may be appropriate to retain automatic minor core updates while testing major core releases and sensitive plugin changes before deploying them.
However, this should not become an excuse to delay important security fixes indefinitely.
When a serious vulnerability is identified, prompt assessment and patching should take priority.
Highly customised websites
Websites containing significant custom development generally benefit from a defined update and testing process.
This might include reviewing release notes, checking compatibility, testing on staging and scheduling production changes.
The objective is to maintain security without introducing unnecessary operational risk.
If your website regularly experiences problems following updates, investigate the underlying compatibility issues rather than simply disabling updates permanently.
How to Enable or Disable Automatic Updates in WordPress
WordPress includes built-in controls for managing most common automatic-update settings.
The exact options available can depend on your WordPress installation, permissions and hosting provider.
Change WordPress core automatic updates
- Log in to your WordPress dashboard.
- Navigate to Dashboard > Updates.
- Check the automatic-update information displayed for WordPress core.
- Where available, choose whether WordPress should automatically install all new core releases or only maintenance and security releases.
WordPress may display a link allowing you to switch between these options.
Some hosting providers manage core updates themselves, so the setting may be unavailable or controlled elsewhere.
If your website is maintained by a developer or hosting company, check their update arrangements before overriding any existing settings.
Enable or disable automatic plugin updates
To manage plugin automatic updates:
- Navigate to Plugins > Installed Plugins.
- Locate the plugin you want to manage.
- Find its Automatic Updates option.
- Select Enable auto-updates or Disable auto-updates, depending on your preference.
You can also use bulk actions to change automatic-update settings for multiple plugins.
Before enabling automatic updates for a plugin, consider its maintenance history, compatibility, importance to your website and whether you have a reliable recovery process.
Some premium or custom plugins may use their own update systems and require an active licence or additional configuration.
Enable or disable automatic theme updates
Navigate to Appearance > Themes and select the theme you want to manage.
Where supported, the theme details will include an option to enable or disable automatic updates.
If your website uses a child theme, remember that updating the parent theme may still affect how the website works, even when customisations are stored separately.
You can find more information in the official WordPress plugin and theme automatic-update documentation.
Advanced: Configure core updates through wp-config.php
WordPress also supports configuring automatic core updates through the WP_AUTO_UPDATE_CORE constant.
For example, the following PHP configuration enables automatic minor core releases:
define( 'WP_AUTO_UPDATE_CORE', 'minor' );
Other supported values include:
true: Enable all eligible types of core automatic updates, including development updates where applicable.'minor': Enable minor core automatic updates only.false: Disable automatic core updates.
These settings apply to WordPress core, not the individual plugin and theme controls.
Only modify wp-config.php if you understand the configuration and have a suitable backup and recovery method.
An incorrect change can prevent WordPress from loading. You should also avoid defining the constant more than once or conflicting with settings managed by your hosting provider.
Disabling automatic core updates entirely is generally not advisable unless another reliable process is responsible for applying updates promptly.
For further details, refer to the official WordPress automatic background-update guidance.
How to Make Automatic Updates Safer
Whether you enable automatic updates for a few components or most of your website, suitable safeguards make a significant difference.
1. Maintain reliable automated backups
Automatic updates can run without warning, so taking a single backup before enabling them is not enough.
Your website needs an ongoing backup process that covers its files, database and relevant configuration.
Backups should be stored securely, retained for an appropriate period and periodically tested.
For busy WooCommerce or membership websites, backup frequency should reflect how much new data the website generates.
Remember that restoring an older database can overwrite orders, registrations and other activity created since the backup.
For practical instructions, see our guide on how to back up and restore your WordPress website.
2. Monitor uptime and important functionality
Uptime monitoring can notify you if your website becomes unavailable following an update.
However, a website can remain online while essential functionality is broken.
Depending on your website, additional checks might include:
- Testing contact forms and email notifications.
- Checking WooCommerce basket and checkout functionality.
- Verifying customer login and membership access.
- Monitoring important integrations and scheduled processes.
- Reviewing server errors and application logs.
The more important a function is to your business, the more valuable it is to have a way to detect problems quickly.
3. Review update notifications and failures
WordPress can send notifications about automatic-update results, including plugin and theme update successes and failures.
These messages are useful, but they should not be your only way of monitoring website health.
Check that notifications reach an email address someone actually monitors.
Periodically review Dashboard > Updates to identify outstanding releases or failed installations.
An automatic-update setting does not guarantee that every available update has been installed.
4. Use staging for sensitive changes
Staging allows you to test updates on a separate copy of your website before applying them to production.
This is especially helpful for major WordPress releases, important plugin changes and custom functionality.
However, enabling ordinary unattended automatic updates on your live website does not automatically provide a staging test beforehand.
If you want every significant update tested first, you need a controlled process or a suitable managed update system that supports those checks.
See our guide on how to create a WordPress staging website.
5. Check WordPress Site Health
WordPress relies on scheduled tasks and background processes to perform automatic updates.
If those processes are not working correctly, updates may be delayed or fail to run.
Navigate to Tools > Site Health and review any warnings relating to background updates, scheduled events, loopback requests or connectivity.
Automatic plugin and theme updates normally run through scheduled checks rather than immediately when a new release becomes available.
Your hosting configuration can affect this behaviour.
If Site Health reports problems, investigate them or contact your hosting provider.
What Should You Do If an Automatic Update Fails?
If an automatic update causes a problem, first establish what changed and whether the installation actually failed.
Avoid immediately restoring the entire website or disabling every plugin without investigating.
Identify the affected update
Check available update notifications, the WordPress dashboard, monitoring alerts and relevant error logs.
Look for evidence of which component was updated and when the problem started.
A plugin compatibility issue requires a different solution from a failed WordPress core installation or a server permissions error.
Check whether WordPress recovered automatically
WordPress has safeguards for some failed updates, including automatic rollback support for certain plugin updates that trigger PHP fatal errors.
However, these mechanisms do not guarantee recovery from every problem.
A plugin might update without a fatal error but still break an important feature.
If WordPress reports a critical error, check whether its Recovery Mode feature is available.
The official WordPress Recovery Mode documentation explains how it can help administrators investigate certain plugin and theme failures.
Choose an appropriate recovery method
Depending on the problem, you might need to:
- Correct a plugin or theme configuration issue.
- Temporarily deactivate an incompatible component.
- Restore a known working version of an affected plugin or theme from a trusted source.
- Resolve a hosting or filesystem problem.
- Restore appropriate files from a verified backup.
A complete website restore should be considered carefully, particularly on websites that continue receiving orders or customer activity.
For help identifying plugin-related failures, see our guide on how to fix WordPress plugin problems.
Once the problem is resolved, review your update settings and determine whether additional testing or monitoring would help prevent it from happening again.
Frequently Asked Questions
Do automatic WordPress updates install immediately?
Not necessarily.
WordPress generally performs automatic updates through scheduled background checks rather than installing every new version the moment it is released.
Plugin and theme automatic-update checks normally run twice daily, although the timing and reliability can depend on the website’s scheduling and hosting configuration.
For an urgent security fix, it may be better to assess and install the update promptly rather than waiting for the next scheduled run.
Can premium WordPress plugins update automatically?
Many premium plugins support automatic updates, but their behaviour depends on the developer’s update system and licensing requirements.
Some require an active licence to receive updates through the WordPress dashboard.
Others may use a separate management tool or require manual installation.
Check the plugin developer’s documentation rather than assuming that enabling the WordPress automatic-update option guarantees every future release will install.
Can I turn off automatic updates and update everything manually?
Yes, but you need to make sure updates are actively managed.
Disabling automatic updates does not remove known vulnerabilities or make compatibility problems disappear.
If you prefer a manual or controlled approach, establish a regular maintenance schedule and a process for promptly handling important security releases.
For instructions on manually updating WordPress core and checking the result, see our guide on how to update WordPress safely.
Choosing the Right WordPress Update Strategy
WordPress automatic updates can save time and reduce the risks associated with outdated software, but they work best as part of a wider maintenance strategy.
For simpler websites, automating core updates and selected plugin or theme updates may be entirely reasonable.
For websites handling transactions, memberships or complex functionality, more controlled updates and additional testing may be appropriate.
Whichever approach you choose, the essentials remain the same: keep software updated, maintain reliable backups, monitor your website and have a recovery plan.
If you would rather have ongoing updates, backups and maintenance managed for you, Newt Labs WordPress Maintenance can help keep your website properly maintained without leaving everything to unattended updates.
