Turn on WordPress auto-updates for most things, but not everything. Let WordPress security releases, translations and simple plugins update themselves, because speed matters when a flaw is published. Hold back the plugins your business can’t run without, such as your shop, payments and page builder, and test those on a copy of the site first.
Key takeaways
- WordPress already installs minor and security releases automatically. Plugins and themes are opt-in, one by one.
- Auto-updates close security holes quickly, which matters when attacks start within hours of a flaw being published.
- Since WordPress 6.6, a plugin auto-update that causes a fatal PHP error is rolled back, but a broken layout or checkout isn’t.
- The safer middle ground: auto-update low-risk items, and test revenue-critical plugins before they go live.
What does WordPress update automatically by default?
More than many owners realise. Since WordPress 3.7, minor releases (the maintenance and security ones) and translation files update themselves out of the box (WordPress Developer Resources). New sites installed on WordPress 5.6 or later also get major releases automatically.
Plugins and themes are different. Since WordPress 5.5, you choose them one at a time (WordPress.org). The only exception is a rare forced update, which the WordPress.org team can push out for a critical security fix.
What are the benefits of auto-updates?
The main one is speed. Patchstack found that heavily exploited WordPress flaws were mass-exploited within a median of 5 hours in 2025, and 91% of all new vulnerabilities were in plugins (Patchstack). A plugin set to auto-update can be patched the same day a fix is released.
WordPress checks for auto-updates twice a day and emails the site’s admin address after each attempt, whether it worked or failed. Nobody has to remember to log in, which is how most sites fall behind.
What can go wrong with automatic updates?
An update can install perfectly and still break something. A new version of a payment plugin might clash with your theme. A page builder update might shift a layout. Because the update runs on a timer, it can happen overnight, and you find out when a customer can’t pay.
WordPress has a safety net, but it’s narrow. Since version 6.6, it rolls back a plugin auto-update when it detects a PHP fatal error, and emails the admin (WordPress 6.6 Field Guide). It checks by loading the home page in the background (WordPress Core). It can’t tell that a form stopped sending or a checkout button disappeared.
Other limits are worth knowing:
- Premium plugins often need a valid licence before they’ll update at all.
- Auto-updates rely on WP-Cron, which runs when the site gets visits, so timing on quiet sites can be patchy.
- The emails go to the admin address, which is often an old developer’s inbox.
If an update has already broken your site, follow our guide for when a WordPress update broke the site. Page builders have quirks of their own, covered in our article on when an Elementor update broke the site.
What’s the safer middle ground?
Sort everything on the site by what it would cost you if it broke. Auto-update the low-risk items so security fixes land fast. Stage and test the items that touch money, bookings or the look of every page.
| Item | Auto-update? | Why |
|---|---|---|
| WordPress minor and security releases | Yes (default) | Small, well-tested fixes |
| Translations | Yes (default) | Very low risk |
| Small, single-purpose plugins | Yes | Little to clash with, and fast fixes matter |
| Security and backup plugins | Yes | Out-of-date protection is no protection |
| WooCommerce, payment gateways, bookings | No, test first | A fault costs sales and may change the database |
| Page builders and their add-ons | No, test first | Can change the layout of every page |
| Your theme | No, test first | Affects the whole site’s design |
| Major WordPress releases | Test first | Plugins sometimes need time to catch up |
“Test first” doesn’t mean “leave for months”. Those items still need updating within days, especially when the update is a security fix. Unpatched plugins are one of the most common ways into a WordPress site.
How do I turn WordPress auto-updates on or off?
- Plugins. Go to Plugins. Each one has an “Enable auto-updates” link in the Automatic Updates column. To change several at once, tick them and use the bulk actions menu.
- Themes. Go to Appearance, then Themes. Click a theme and use the “Enable auto-updates” link under the author name.
- WordPress itself. Go to Dashboard, then Updates. You can choose whether major releases update automatically. Security releases stay on.
- Check the emails reach you. Under Settings, then General, make sure the administration email address is one you read.
- Check WP-Cron works. Tools, then Site Health, will flag scheduled tasks that aren’t running.
Warning: Developers can switch off every automatic update in the site’s configuration. WordPress says doing so is strongly discouraged, because it also blocks emergency security releases. If the controls are missing, your host or a plugin may have done this.
What should happen before and after an update?
Before: take a fresh backup, and make sure it’s one you can actually get back. Our page on website backups you can restore explains what that looks like. For the plugins you hold back, run the update on a WordPress staging site first. That’s a private copy where breaking things costs nothing.
After: open the home page, a few key pages, every contact form and, on a shop, a test order. Check on a phone as well as a computer. If something’s wrong, roll back that one plugin rather than the whole site.
What do managed updates add?
A person. Auto-updates are a timer, and a managed update service adds judgement and testing around it. With our safe, tested WordPress updates, routine updates run monthly and high-risk security updates are applied weekly, after a backup.
Maintain & Protect Advantage adds visual and form checks after updates, plus repairs if an update breaks something. Elite adds checkout and payment gateway checks for online shops. Compare all three on our website maintenance plans page.
Frequently asked questions
Should I enable automatic updates in WordPress?
For most items, yes. Leave WordPress security releases on, and turn on auto-updates for simple plugins and your security plugin. Test plugins that run your shop, payments, bookings or page layouts before updating them, and keep a recent backup either way.
How do I disable WordPress auto-updates for one plugin?
Go to Plugins and click “Disable auto-updates” next to that plugin. The setting is per plugin, so the others aren’t affected. Remember that this plugin now needs someone to update it by hand, ideally within days of each release.
Can WordPress auto-updates break my site?
Yes. An update can clash with your theme or another plugin. Since WordPress 6.6, a plugin auto-update that causes a fatal error is rolled back automatically, but problems that don’t crash PHP, such as a broken form or layout, stay until someone notices and fixes them.
Why aren’t my WordPress auto-updates working?
Common causes are WP-Cron not running, a premium plugin with an expired licence, or a host or plugin that has switched auto-updates off. Check Tools, then Site Health, for scheduled task errors, and check the licence status in the plugin’s settings.
Should I turn off WordPress core auto-updates?
Not the security releases. They fix known holes, and WordPress strongly discourages switching them off. Major releases are a judgement call: many managed sites test them on staging first, then update within a week or two once key plugins have caught up.
Sources
- Upgrading WordPress, WordPress Advanced Administration Handbook
- Plugins and themes auto-updates, WordPress.org, updated January 2023
- State of WordPress Security in 2026, Patchstack
- WordPress 6.6 Field Guide, Make WordPress Core, June 2024
- Merge proposal: Rollback Auto-Update, Make WordPress Core, April 2024