WordPress Auto Updates: Enable, Disable and Control Them

WordPress can update itself in the background. Out of the box it installs minor core releases (maintenance and security releases) and translation files on its own, and since WordPress 5.5 you can switch on auto-updates for plugins and themes one by one. This guide covers what updates by default, and the four places you can change it: the dashboard, wp-config.php, filters in a must-use plugin, and WP-CLI. Every setting below comes from the WordPress Advanced Administration Handbook and the plugin and theme auto-updates documentation on WordPress.org.

What WordPress updates automatically by default

The auto_update_{$type} hook reference sums up the history: since WordPress 3.7, minor and development versions of core and translations have been auto-updated by default. New installs on WordPress 5.6 or higher also auto-update major versions by default, and from 5.6 older sites can opt in to major version auto-updates.

That last row matters. A plugin with auto-updates switched off can still be updated in the background if the WordPress security team pushes a fix for a critical vulnerability through the WordPress.org API.

Turn plugin and theme auto-updates on or off in the dashboard

The WordPress.org documentation describes the controls that arrived in WordPress 5.5:

1. Plugins: go to the Plugins screen. Each plugin has an "Automatic update" column with a link to enable or disable auto-updates for that plugin.
2. Several plugins at once: tick the plugins in the first column, choose enable or disable auto-updates from the bulk action selector at the top of the table, and click Apply.
3. Themes: go to Appearance, click a theme thumbnail, and use the "Enable auto-updates" link below the theme author. Themes are switched one by one.

WordPress runs these auto-updates twice a day by default, and when an update is waiting, the time until the next run shows below the toggle link and on the Dashboard, Updates screen. It emails the site owner when plugins or themes update, when an update fails, or when some succeed and some fail.

If you do not see the controls, check that you are on WordPress 5.5 or later. If you are and the controls are still missing, the documentation says the feature has probably been switched off by your host or by a plugin.

Control core updates in wp-config.php

The handbook gives two constants. To turn off every type of automatic update, core or otherwise:

define( 'AUTOMATIC_UPDATER_DISABLED', true );

WordPress strongly discourages this, because automatic minor updates are one of the best ways to keep a site up to date and secure. To change core updates only, use WP_AUTO_UPDATE_CORE:

define( 'WP_AUTO_UPDATE_CORE', 'minor' );

When this constant is set, it overrides the automatic update setting on the Updates screen in wp-admin, so a site owner cannot change it from the dashboard.

Fine-grained control with filters

Filters give more control than constants. The handbook says to put them in a must-use plugin, and not to call add_filter() in wp-config.php, because WordPress is not fully loaded there and it can conflict with tools such as WP-CLI.

// Turn on auto-updates for all plugins and all themes
add_filter( 'auto_update_plugin', '__return_true' );
add_filter( 'auto_update_theme', '__return_true' );

// Core: pick each update type separately
add_filter( 'allow_minor_auto_core_updates', '__return_true' );
add_filter( 'allow_major_auto_core_updates', '__return_false' );

// Stop core update emails
add_filter( 'auto_core_update_send_email', '__return_false' );

Be careful with __return_false on auto_update_plugin or auto_update_theme. The handbook notes that it disables all plugin or theme updates, even forced security pushes from the WordPress security team. The same filters receive the item being updated, so you can allow a short list of plugins and leave the rest to the normal API response:

function auto_update_specific_plugins( $update, $item ) {
	$plugins = array( 'akismet', 'buddypress' );
	if ( in_array( $item->slug, $plugins ) ) {
		return true;
	}
	return $update;
}
add_filter( 'auto_update_plugin', 'auto_update_specific_plugins', 10, 2 );

Translation updates have their own filter, auto_update_translation, and automatic_updater_disabled turns everything off in the same way as the constant.

Manage auto-updates with WP-CLI

WP-CLI 2.5.0 added commands for the same plugin and theme settings, which is quicker when you look after several sites:

• wp plugin auto-updates enable --all turns on auto-updates for every plugin (docs); wp plugin auto-updates disable --all turns them off (docs).
• wp plugin auto-updates status --all --enabled-only --field=name lists the plugins that have auto-updates on (docs).
• wp theme auto-updates enable does the same for themes (docs).
• wp core update --minor updates core to the latest minor release only, without waiting for the background updater (docs).

When auto-updates do not run

Plugin and theme auto-updates rely on WordPress Cron tasks, so they can fail to run depending on your server, your installation or your plugins. The WordPress.org documentation suggests checking Tools, Site Health for any error messages. Also look for AUTOMATIC_UPDATER_DISABLED or WP_AUTO_UPDATE_CORE in wp-config.php, and remember that a site WordPress sees as a version control checkout does not get major core auto-updates by default.

Whatever you choose, keep regular backups so you can roll back if an update breaks something; the documentation suggests this before you switch on plugin and theme auto-updates. Our post on WordPress 7.1.4 shows why minor updates matter: it fixed 22 vulnerabilities, and sites that support automatic background updates received it automatically. If the update screen also warns about an old PHP version, see how to update PHP in WordPress.