Table of contents16
The phone call came at 6 AM. A client’s WooCommerce store had updated itself overnight — a plugin auto-update had gone through, and the checkout page was showing a fatal error. Every order placed since midnight had failed. I rolled it back in twenty minutes, but those lost sales haunted me for months. That morning changed how I think about WordPress auto-updates forever.
I am Mei Chen, and I manage update strategies for dozens of WordPress sites — from tiny personal blogs to stores doing six figures a month. I have seen auto-updates save sites from hackers, and I have seen them break checkout pages at the worst possible moment. Both sides of this debate are right, and both are wrong.
If you have ever stared at the auto-update settings wondering whether to turn them on or off, this guide is for you. I will explain exactly how WordPress auto-updates work, make the honest case for both sides, and then give you my recommended setup for every type of site — so you get the security without the 6 AM phone calls.
There is no single right answer. But there is a right answer for YOUR site, and by the end of this guide you will know exactly what it is.
Here is what this guide covers:
- How WordPress auto-updates actually work (core, plugins, themes)
- The honest case for enabling auto-updates
- The honest case for disabling them
- My recommended setup for every type of site
- Configuring auto-updates step by step
- What to do when an auto-update breaks something
- Frequently asked questions
- Final thoughts
I am not going to give you a one-size-fits-all answer, because anyone who does is selling you something. Let us look at how the system really works first.
How WordPress Auto-Updates Actually Work
Most confusion about auto-updates comes from not realizing that WordPress treats three different things — core, plugins, and themes — as three separate systems with three separate settings. Let me untangle them.
WordPress core: minor updates are automatic by default
Since WordPress 5.6, every new installation automatically applies minor and security releases — the small updates like 7.1 to 7.1.1 that fix vulnerabilities and bugs. Major releases (7.1 to 7.2) still require you to click the button yourself. This default is controlled by a constant in your wp-config.php file called WP_AUTO_UPDATE_CORE, and it has three possible values: 'minor' (the default, security and maintenance releases only), true (everything including major releases), or false (nothing automatic at all).
Since WordPress 5.6 you can also flip this from your dashboard: go to Dashboard, then Updates, and below the WordPress version line you will see either “This site is automatically kept up to date with maintenance and security releases of WordPress only” or “This site is automatically kept up to date with each new version of WordPress.” One click switches between minor-only and everything. Here is the catch most guides skip: the constant in wp-config.php always wins over the dashboard toggle. If your config file says 'minor', the dashboard setting cannot override it. As the Hostney automatic updates guide puts it, setting the constant explicitly is the only guarantee that survives a database restore or a plugin reset.
Plugins and themes: opt-in, one by one
Since WordPress 5.5, plugin and theme auto-updates are opt-in per item — nothing updates itself unless you say so. For plugins, go to Plugins, then Installed Plugins, and look at the rightmost “Automatic Updates” column. Each row has an “Enable auto-updates” link, and you can select multiple plugins and use the Bulk Actions dropdown to toggle them all at once. For themes, open Appearance, then Themes, click a theme’s details, and you will find its own “Enable auto-updates” link. Repeat for each theme.
For developers and advanced users, two filters in wp-config.php or a custom plugin enable auto-updates globally: add_filter( 'auto_update_plugin', '__return_true' ); and add_filter( 'auto_update_theme', '__return_true' );. Powerful, but blunt — I will explain in a moment why I almost never recommend the global approach.
Now that you know the machinery, let us talk about the real question: should you use it?
The Honest Case for Enabling Auto-Updates
I will start with the side that gets less respect in developer circles, because for most site owners it is the right side. Auto-updates exist for one overwhelming reason: speed of patching.
Security research from Patchstack found that the median time from a WordPress vulnerability disclosure to mass exploitation is about 5 hours. Five hours. If you update your plugins manually every Sunday, you are exposed for up to seven days every single week. An auto-update that applies a security patch at 3 AM closes that window while you sleep. For a small blog or brochure site with no dedicated maintainer, that automatic patching is the difference between safe and compromised.
There is a second argument that nobody talks about: most site owners never update at all. I have audited sites running WordPress versions from three years ago, with plugins older than my nephew. The Singapore WordPress security study from August 2026 found that 40.2% of business WordPress sites were running outdated core versions — and every one of their critical-risk sites was outdated. For these owners, auto-updates are not a convenience. They are the only updates that will ever happen.
And here is the part the “always update manually” crowd glosses over: minor core releases and security patches almost never break anything. They are deliberately small, deliberately boring, and tested against a huge matrix of configurations. The WordPress core team has been auto-shipping them since 2013, and the sky has not fallen. That is why the default has been minor-only since WordPress 5.6 — it is the consensus of a decade of experience.
The Honest Case for Disabling Them
Now the other side — the side I learned about at 6 AM with a broken checkout page. Auto-updates have a fundamental flaw: they can break your site at a moment when nobody is watching.
When you update manually and something breaks, you know immediately. You see the error, you restore the backup, you are done in minutes. When an auto-update breaks something at 3 AM, you discover it hours or days later — from an angry customer, a lost sale, or a Google Search Console error report. As Jon Henshaw of Coywolf wrote: the problem with auto-updating plugins and themes is not that updates break things — it is that you may not know about it until hours or perhaps days later.
This risk is not theoretical, and it is not evenly distributed. A plugin that renders nothing on your pages — a backup plugin, an SEO plugin’s background tasks — can auto-update with near-zero risk. But anything that touches what visitors see or what earns you money carries real danger: page builders, checkout flows, membership plugins, booking systems, multilingual plugins, anything with custom code. For a WooCommerce store, one widely shared recommendation is to never update on release day — wait 48 to 72 hours so early adopters surface the breaking changes first. Auto-updates do the opposite of that by design.
There is also the compatibility lag problem. When a major WordPress release ships, plugin authors need days or weeks to release compatible versions. If your core auto-updates to a major release on day one (the true setting), your plugins may not be ready. That is why enabling major core auto-updates is the single riskiest toggle on this entire page.
So both sides are right. Security demands speed; stability demands control. The answer is not picking a side — it is a setup that gives you both.
My Recommended Setup for Every Type of Site
After years of managing updates across dozens of sites, I have stopped thinking in terms of “on or off” and started thinking in terms of risk tiers. The BlogVault team’s philosophy nails it: automate the boring updates, test the expensive ones, and keep restore close. Here is how that looks in practice.
Tier 1: Simple blogs and brochure sites — automate almost everything
If your site is a blog, portfolio, or business brochure with standard plugins and no revenue flowing through it: keep the default minor-only core auto-updates, and enable plugin auto-updates for well-maintained plugins from reputable authors. Check the site weekly. This is the set-it-and-mostly-forget-it tier, and it is genuinely fine — the security benefit dwarfs the small breakage risk.
Tier 2: Business sites with forms and leads — automate selectively
Keep minor core auto-updates on. Enable plugin auto-updates only for low-risk, well-maintained plugins — your security plugin, your backup plugin, simple utility plugins. Leave auto-updates OFF for your form plugin, your page builder, your SEO plugin, and anything custom. Update those manually once a week after a backup, and test the key pages afterward. This is where most of my clients live.
Tier 3: Stores, memberships, and anything earning money — control everything
Keep minor core auto-updates on (security patches are non-negotiable), but disable plugin and theme auto-updates across the board. Update on a schedule — I recommend a fixed weekly window — following a proper checklist: backup first, update on staging if you have it, update in the right order, verify checkout and critical flows after. Our safe WordPress update checklist is the exact process I follow for every Tier 3 site. It takes thirty minutes a week and has prevented every 6 AM phone call since I adopted it.
Bonus Tip: Whatever tier you are in, enable email notifications for update failures. WordPress sends an email to the admin address when an automatic update fails — but only if your site can actually send mail. Test it once by checking that you receive other WordPress emails, like password resets. A notification system you never verified is not a notification system.
One more thing the tiers share: never enable major core auto-updates (WP_AUTO_UPDATE_CORE set to true) unless you have a staging workflow that tests every major release first. Major releases deserve your attention, not your trust. Our explainer on major versus minor WordPress updates shows why the two behave so differently.
Configuring Auto-Updates Step by Step
Let us get practical. Here is exactly where to click — and what to type — for each layer.
Core updates: dashboard or wp-config.php
The dashboard path: go to Dashboard, then Updates. Under the WordPress version line, click “Enable automatic updates for all new versions of WordPress” for major-plus-minor, or “Switch to automatic updates for maintenance and security releases only” to return to minor-only. The wp-config.php path is more durable: add define( 'WP_AUTO_UPDATE_CORE', 'minor' ); for the recommended default, true for everything, or false for nothing. Remember the hierarchy — the constant beats the dashboard every time.
Plugin updates: per-plugin toggles and bulk actions
Go to Plugins, then Installed Plugins. In the Automatic Updates column, click “Enable auto-updates” on each plugin you want automated. To do several at once, check their boxes, open the Bulk Actions dropdown, choose “Enable auto-updates,” and click Apply. Reversing it later is the same flow with “Disable auto-updates.” The setting takes effect on the next twice-daily update check — WordPress checks for updates roughly every 12 hours.
Theme updates: one by one
Go to Appearance, then Themes, click any theme, then “Theme Details,” and use the “Enable auto-updates” link. There is no bulk toggle for themes, so repeat for each one. Note: only enable auto-updates on themes you are not actively customizing — if you have edited theme files directly (rather than using a child theme), an auto-update will wipe your changes. That is a separate problem worth fixing regardless.
After configuring, verify your choices stuck: revisit each screen a day later and confirm the toggles show what you expect. I have seen caching plugins and security plugins interfere with the update checks, so a quick verification pass is cheap insurance.
What to Do When an Auto-Update Breaks Something
Even with the perfect setup, something will eventually break. It is software; it happens. What matters is how fast you recover, and that comes down to preparation you do now, not heroics later.
First, do not panic-update everything else. The most common mistake I see is someone discovering one broken plugin and then clicking “update all” in a frenzy, which turns one problem into five. Identify the culprit first: if the whole site shows a fatal error, rename the most recently updated plugin’s folder via FTP or your host’s file manager — WordPress will deactivate it automatically and your site will come back. Then restore that single plugin from your backup.
Second, this is why backups exist. A backup taken before the update window lets you roll back in minutes instead of debugging for hours. If you are not sure your backup strategy is solid, read our comparison of manual backups versus backup plugins — and then actually test a restore once, because an untested backup is a rumor, not a safety net.
Third, after recovery, decide the plugin’s future: leave its auto-updates off and update it manually going forward, or replace it with a better-maintained alternative. A plugin that breaks on routine updates twice is telling you something. Listen.
If the breakage looks like a hack rather than an update gone wrong — strange admin users, spammy links, redirects — stop and follow our WordPress hacked recovery guide instead. Update failures and compromises can look similar at first glance, and treating a hack like a bad update wastes precious time.
Frequently Asked Questions
Are WordPress auto-updates enabled by default?
Partially. Since WordPress 5.6, minor core releases (security and maintenance updates) install automatically on every site — that is the default and I recommend keeping it. Plugin and theme auto-updates are off by default; you opt each one in individually from the Plugins or Themes screens.
Should I enable auto-updates for all plugins?
No — be selective. Enable them for low-risk, well-maintained plugins like security and backup tools. Keep them off for anything tied to revenue, leads, logins, or layout: checkout plugins, form builders, page builders, membership systems, and anything with custom code. Update those manually on a schedule.
How do I completely disable WordPress auto-updates?
Add define( 'WP_AUTO_UPDATE_CORE', false ); to wp-config.php to stop core auto-updates, then use Bulk Actions on the Plugins screen to disable auto-updates for all plugins, and disable them per theme under Appearance, then Themes. I do not recommend full disabling unless you have a strict manual update routine — unpatched sites get hacked.
Do auto-updates slow down my website?
Not in any way your visitors will notice. WordPress checks for updates roughly twice daily via a lightweight background request. If your site feels slow, the cause is almost certainly something else — our complete WordPress speed checklist walks through the real culprits.
What happens if an auto-update fails halfway?
WordPress has a built-in rollback for failed core updates — if a core update fails, it automatically restores the previous version and emails the site admin. For plugins and themes there is also automatic rollback on failure since WordPress 5.2 era improvements. The dangerous scenario is not a failed update but a “successful” update that introduces a compatibility bug, which is why selective automation plus backups is the winning combination.
Final Thoughts
That 6 AM phone call still sits in my memory, but it taught me the right lesson — not “auto-updates are evil,” but “automation without judgment is gambling.” The store that broke had every plugin on auto-update with no backups and no monitoring. Any one of those missing pieces would have changed the outcome.
Here is my honest summary after years on both sides of this debate: keep minor core auto-updates on, always. Automate the boring plugins. Hand-control everything that touches money, leads, or logins. Back up before every manual update window. That setup gives you 95% of the security benefit with almost none of the 6 AM risk.
You do not need to decide everything today. Start with one change: go to your Plugins screen right now and enable auto-updates for your security and backup plugins — the two you most want patched fastest. Then schedule a weekly fifteen-minute update window for the rest. Future you, sleeping soundly at 6 AM, will be grateful.
