Back in October 2013, WordPress 3.7 introduced automatic background updates. At the time, I joked that it was a feature for lazy admins, just like a smartphone. Thirteen years on, WordPress auto updates have become one of the platform’s most important security features. However, they now cover far more than core, so they deserve a proper setup.

What WordPress Updates Automatically

By default, WordPress installs minor core releases on its own, such as security and maintenance fixes. Major releases, such as version 7.0, still wait for your approval. Furthermore, WordPress can update plugins and themes automatically, although you must switch that on for each one.

Managing WordPress Auto Updates from the Dashboard

Core Updates

Go to Dashboard > Updates. There, you can keep only maintenance and security releases automatic, or enable automatic updates for all new versions. For most business websites, I recommend automatic minor updates and manual major updates after testing.

Plugin and Theme Updates

Next, open the Plugins screen, where each plugin has an “Enable auto-updates” link in its row. Similarly, you can enable theme auto-updates from Appearance > Themes by opening a theme’s details. Additionally, since version 6.6, WordPress rolls back a plugin if its automatic update breaks the site.

Controlling Updates in wp-config.php

Developers can also control core updates in code. Add one of these lines to wp-config.php, above the line that says “That’s all, stop editing”:

define( 'WP_AUTO_UPDATE_CORE', 'minor' ); // minor releases only (default)
define( 'WP_AUTO_UPDATE_CORE', true );    // all core releases

Avoid setting AUTOMATIC_UPDATER_DISABLED to true unless you manage updates another way. Otherwise, your website will miss urgent security fixes.

Is It Safe to Leave Auto Updates On?

In my experience, the risk of an outdated plugin is far greater than the risk of an update. Still, a few habits make automatic updates considerably safer:

  • Take daily off-site backups.
  • Use a staging site to test major releases.
  • Check Tools > Site Health for update warnings.
  • Keep only the plugins you actually use.

Ultimately, auto updates work best as part of a regular maintenance routine. If you would rather not manage them yourself, our annual maintenance plan covers updates, backups and monitoring.