How to Disable WordPress Update Notifications Without Missing Security Patches

WordPress update messages come from separate systems, so there is no single “turn them all off” switch. The red core nag, plugin and theme badges, update emails, and automatic installation each require a different control. Hide only the message that is distracting you, keep at least one administrator or maintenance owner able to see updates, and treat disabling automatic installation as an operational change rather than a cosmetic one.

Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.

For most sites, the safest fix is to hide the core nag from non-maintaining users while leaving administrators informed. Use the procedures below when you need to suppress plugin/theme notices, stop core update emails, or deliberately move all updates to a manual staging workflow.

#	Preview	Product	Price
1		WordPress Multisite Administration	$34.38	Buy on Amazon
2		Mon Site WordPress – Volume 2 – Administration & Utilisation (French Edition)	$9.90	Buy on Amazon
3		WordPress 24-Hour Trainer	$3.95	Buy on Amazon
4		Teacher Record Book	$4.89	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

Identify which WordPress notification you are seeing

Start with the symptom, because each notification channel has its own setting or hook. Hiding a dashboard message does not stop WordPress checking for updates, and it does not prevent an automatic update from being installed.

Check the sender and the exact screen before changing code. An email from a host, a security tool, or a plugin is not controlled by WordPress core’s email filter.

#1 Best Overall

Sale

WordPress Multisite Administration

$34.38

Buy on Amazon

Map the notice to its owner first

Open the page where the message appears and note its wording, color, location, and the link it provides. A notice in the main admin-content area is different from a numbered bubble beside Plugins or Appearance. An email may mention a core release, a specific plugin, an automatic-update result, or a hosting account. Record the account that sees it as well: the capability-based solution intentionally behaves differently for users who can update core.

Take a screenshot or copy the subject before making a change. This gives you a simple before-and-after test and helps avoid disabling a useful security message while trying to remove a cosmetic reminder. If several administrators see different messages, test each role separately rather than assuming that one account represents the whole site.

Hide the core update nag for selected users

If editors or other non-maintaining users only need the red core notice removed, use a capability check rather than disabling update information for everyone. WordPress Developer Resources describes update_nag() as the function that “Returns core update notification message.” The following user-contributed pattern removes that notice for users who do not have the update_core capability, while administrators who retain that capability continue to see it.

Install the snippet as a must-use plugin

1. Create the directory wp-content/mu-plugins if it does not already exist.
2. Create a file such as quiet-core-update-nag.php in that directory.
3. Paste the code below, save it, and load an admin page as a non-maintaining user.
4. Open another browser session as an administrator and confirm that the administrator still sees the core notice.

<?php
function hide_core_update_notifications_unless_admin() {
    if ( ! current_user_can( 'update_core' ) ) {
        remove_action( 'admin_notices', 'update_nag', 3 );
    }
}
add_action( 'admin_head', 'hide_core_update_notifications_unless_admin', 1 );

The priority values are intentional: the function runs early on admin_head, then removes update_nag from admin_notices at priority 3. This is a display change only. WordPress can still check for updates, show other update indicators, send email, and install updates according to the site’s automatic-update policy.

The example is intended for installations that are not multisite. In a multisite network, capabilities and network-administration rules differ; test with a network administrator and the relevant site administrators before deploying a network-wide change.

Verify the capability result

Use a fresh browser session or sign out and back in after installing the must-use plugin. Confirm three things: a user without update_core no longer sees the core notice, a user with that capability still sees it, and the Dashboard → Updates screen remains available to the people who maintain the site. A cached admin page can make a successful change look ineffective, while a role-management plugin can give an account capabilities you did not expect.

Do not remove the capability itself merely to hide a notice. Capabilities govern what a user may do, whereas this pattern changes only whether one notice is printed. Removing capabilities can affect update screens and other administrative tasks in ways that are harder to audit.

Handle plugin and theme update bubbles

Plugin and theme updates are shown on the Plugins and Appearance screens and through an admin-menu alert bubble. These indicators identify items with available updates; they are not the same notice removed by the core-nag snippet.

Use the built-in controls for installation behavior

WordPress provides an Automatic updates control for individual plugins and themes, including bulk actions for plugins. Turning a plugin or theme’s toggle off tells WordPress not to install that item automatically. It does not create a universal “hide every update notice” setting, and the item can still be listed as out of date.

1. Go to Dashboard → Updates to see the overall update state.
2. For plugins, open Plugins → Installed Plugins and use the item’s Automatic updates control or the bulk action menu.
3. For themes, open Appearance → Themes, select the theme, and use its automatic-update control when available.
4. Leave a documented maintenance owner responsible for applying updates that are no longer automatic.

These controls are per item, so review every active plugin and each theme that matters to the site. A bulk action can change several plugins at once; check the resulting state afterward rather than assuming that a failed or partially completed request changed everything. The control determines installation behavior, not whether WordPress knows an update exists.

When another component is generating the notice

Some plugins, themes, security products, and hosting dashboards add their own banners or emails. If the message names a particular product or service, inspect that product’s settings and its update documentation. Removing the core update_nag() action will not affect a notice printed by a different callback.

Translations are another update type handled by WordPress’s automatic-update system. If a notice refers to a translation package, treat it separately from a plugin or theme toggle and review the translation policy in the code or management tool controlling automatic updates.

Use a settings interface only when you need one

The WordPress.org listing for Disable & Manage Updates describes separate controls for core, plugin, theme, and translation update behavior, plus notification notices, badges, counts, and alerts. It is an optional third-party plugin, not a WordPress core feature. Review its maintenance activity, compatibility with the site’s WordPress version, permissions, and security posture before enabling it, and test it on staging first.

Rank #2

Mon Site WordPress – Volume 2 – Administration & Utilisation (French Edition)

$9.90

Buy on Amazon

A settings interface can be useful when several nontechnical administrators need a visible policy, but it also adds another component to maintain. Keep a record of which controls are enabled, who may change them, and how the settings will be restored if the plugin is removed.

Stop WordPress core update emails

Dashboard suppression and email suppression are independent. To stop the administrator email generated for a core update, add the send_core_update_notification_email filter in a must-use plugin.

<?php
add_filter( 'send_core_update_notification_email', '__return_false' );

This filter targets the core update notification email. It does not silence a message sent by a plugin, a hosting platform, or an automatic-update result. Inspect the message’s sender, subject, and headers when you are unsure which system sent it.

WordPress also exposes the automatic_updater_disabled hook. The reference documentation notes that this hook controls whether background updates are disabled and that it also disables update-notification emails. That makes it a broad operational switch, not an email-only preference. Do not use it merely to clean up an inbox unless you also intend to change background-update behavior and have a manual process ready.

Test mail suppression safely

After adding the filter, wait for the next controlled notification opportunity or use a staging copy to verify the result. Keep the original message details in your maintenance record, and tell the maintenance owner that the mailbox is no longer a complete signal for core updates. Continue checking the dashboard or another monitoring process so the site does not become silent by accident.

Disable automatic installation when manual updates are intentional

Suppressing an alert is cosmetic; stopping an automatic installation changes how the site is maintained. The Advanced Administration Handbook documents the WP_AUTO_UPDATE_CORE and AUTOMATIC_UPDATER_DISABLED constants, along with filters for core, plugins, themes, and translations. It warns that “disabling these updates is strongly discouraged,” because minor and security updates help keep sites current.

Put filters in a must-use plugin

Use a must-use plugin for add_filter() calls. The handbook advises against placing filters directly in wp-config.php: WordPress is not fully loaded there, and other configuration can conflict with the call.

<?php
add_filter( 'auto_update_plugin', '__return_false' );
add_filter( 'auto_update_theme', '__return_false' );

Those two lines prevent automatic installation for plugins and themes while leaving the update information visible. The dynamic auto_update_{$type} hook also covers core and translations through auto_update_core and auto_update_translation. Add a core filter only if your maintenance policy explicitly requires manual core updates, and document the decision for the people who operate the site.

Keep type-specific rules as narrow as possible. A rule for plugins should not be presented as a rule for themes, core, or translations. Before adding another filter, search the site’s must-use plugins and configuration for an existing rule that may override or duplicate it. Conflicting policies are a common reason an expected automatic update does not occur.

Understand the constants

AUTOMATIC_UPDATER_DISABLED is a broad switch for disabling the automatic updater. WP_AUTO_UPDATE_CORE controls core automatic-update behavior. These constants belong in the configuration layer, while filters belong in a must-use plugin. Neither constant is a reliable way to hide a particular dashboard badge; they change update behavior and can also affect notification email.

Because these are site-wide decisions, record the value, the date it changed, and the person responsible. If a host or deployment system also manages updates, check that layer before changing WordPress settings; otherwise two systems may present contradictory status information.

Account for WordPress version behavior

WordPress 5.5 introduced the plugin and theme automatic-update controls documented in the hook reference. The same reference records the default major-core behavior for new WordPress 5.6 and later installations. Existing sites can retain different settings, so inspect the site’s current configuration rather than assuming that every installation has the same defaults.

Rank #3

Sale

WordPress 24-Hour Trainer

$3.95

Buy on Amazon

Build a safe manual-update workflow

If you hide notices or disable automatic installation, replace the automation with an explicit process. The minimum workflow should include:

• A named owner: one administrator or maintenance team must retain permission to see and apply security updates.
• Tested backups: take a current backup before updating and verify that restoration is possible, not merely that a backup job reported success.
• Staging: apply updates to a staging copy first when the site supports it, then check logins, forms, payments, media uploads, scheduled jobs, and key integrations.
• A change record: record the date, versions, updater, test result, and any rollback action.
• Monitoring: watch for failed updates, PHP errors, broken background jobs, and messages from the host or security tooling.

Keep at least one administrator or maintenance owner able to see update information. A quiet dashboard is not evidence that the site is patched.

Suggested maintenance sequence

1. Review the update list and identify security-sensitive or business-critical components.
2. Confirm that the latest backup can be restored and that the staging copy reflects the production configuration.
3. Apply updates on staging, then exercise the site’s important paths, including authentication, forms, payments, uploads, scheduled tasks, and integrations.
4. Record versions and test results, and note any compatibility issue or rollback.
5. Schedule the production change and monitor logs and site behavior afterward.

If the owner is unavailable, do not compensate by hiding more warnings. Restore visibility to an available administrator or maintenance service until responsibility is clear.

Decision tree: choose the smallest change that solves the problem

1. Only non-admin users see an unwanted red core notice? Install the capability-based update_nag() removal snippet and leave administrators untouched.
2. Plugin or theme bubbles are the problem? Check the named item, use its built-in automatic-update control for installation policy, and inspect the item’s own settings for extra notices.
3. The complaint is email? Identify the sender. Use send_core_update_notification_email for the core email; use the sender’s own controls for host- or plugin-generated messages.
4. The goal is to stop updates installing automatically? Use the documented constants or type-specific filters in the correct configuration location, then activate the manual workflow before removing automation.
5. Is the site multisite? Treat the single-site core-nag example as unverified for network use and review network capabilities and administration separately.

Troubleshooting persistent notifications

The core nag disappeared, but a badge remains

The snippet removes one admin notice only. A plugin or theme badge is a separate menu and screen indicator; manage that item or the component that added the message.

Email continues after the dashboard is quiet

Check whether the message is core, an automatic-update result, a plugin, or the host. The dashboard action does not govern mail, and the core email filter does not govern third-party senders.

Updates stopped after adding a filter

Review all must-use plugins and configuration constants for overlapping rules. Remove the broad rule if it was added only to hide a message, restore the desired per-type policy, and run a controlled update on staging.

An editor still sees the notice

Confirm the account’s effective capabilities and test in a fresh session. A user with update_core is intentionally allowed to retain the notice under the capability-based pattern.

The automatic-update toggle is missing

Check the WordPress version, the item type, the user’s permissions, and whether another configuration or management layer has disabled automatic updates. The toggle is per item, not a universal notification preference.

A notice returns after a plugin update

Check whether the updated component registers its own callback or settings page. A core-nag removal affects only the callback named in the snippet; a component can continue to print a separate notice after it changes its code.

A multisite change behaves differently

Stop and review network administration rules before applying a single-site pattern across the network. Confirm which account controls network updates and whether site administrators should see or act on notices.

Frequently asked questions

Can I hide update notices without disabling updates?

Yes, when the unwanted message is the core admin nag. The capability-based update_nag() pattern changes display for users without update_core; it does not disable update checks or automatic installation.

Does turning off a plugin’s automatic updates hide its update badge?

No. The per-plugin toggle controls whether WordPress may install that plugin automatically. The plugin can still appear as out of date in the Plugins screen and admin menu.

Rank #4

Teacher Record Book

• Keep track of everything from attendance to test scores
• Spiral bound
• Measures 8-1/2" x 11"

$4.89

Buy on Amazon

Will the core email filter stop hosting or security-plugin emails?

No. send_core_update_notification_email applies to the core update email. Identify the sender and use that service’s notification settings for other messages.

Where should I put update filters?

Put add_filter() calls in a must-use plugin. The administration guidance warns against placing them directly in wp-config.php, where WordPress is not fully loaded and conflicts can occur.

Should I disable automatic updates on a production site?

Only when there is a documented, staffed manual process with backups and staging. The administration guidance strongly discourages broadly disabling updates because minor and security updates help keep sites current.

What changed in WordPress 5.5 and 5.6?

The hook documentation records the plugin and theme automatic-update controls from WordPress 5.5 and the default major-core behavior for new WordPress 5.6 and later installations. Existing sites may have different settings, so inspect the actual configuration.

Can the same snippet be used on multisite?

Do not assume so. The documented example is for non-multisite installations; network capabilities and administration rules require separate review and testing.

Is there a plugin that hides badges, counts, and alerts?

The WordPress.org listing for Disable & Manage Updates describes controls for core, plugin, theme, and translation behavior, as well as notices, badges, counts, and alerts. Evaluate its maintenance, compatibility, permissions, and security before deploying it.

Frequently Asked Questions

What is the safest way to hide the red WordPress update nag?

Remove the update_nag() notice only for users without the update_core capability, while leaving at least one administrator able to see and act on it.

Does hiding a notice stop WordPress from checking for updates?

No. Display suppression is separate from update checks, automatic installation, and email notifications.

How do I stop core update emails?

Use the send_core_update_notification_email filter in a must-use plugin, after confirming that the message is actually from WordPress core.

How do I disable plugin and theme automatic updates?

Use the per-item controls in the Plugins and Themes screens, or type-specific filters such as auto_update_plugin and auto_update_theme in a must-use plugin. These settings do not necessarily hide update badges.

Should I use AUTOMATIC_UPDATER_DISABLED just to quiet notifications?

No. It is a broad operational switch that disables background updating and also affects update-notification email. Use it only with an explicit manual-maintenance policy.

Does the core-nag snippet work on multisite?

The documented example is for non-multisite installations. Review network capabilities and administration rules separately before making a multisite change.

The Bottom Line

Choose the narrowest control that matches the symptom: remove the core nag only for non-maintaining users, manage plugin and theme behavior per item, filter core email separately, and use automatic-updater constants or filters only when a staffed manual workflow is ready. Keep tested backups, staging checks, change records, and at least one administrator who can see security updates.

Quick Recap

SaleBestseller No. 1

WordPress Multisite Administration

$34.38

Bestseller No. 2

Mon Site WordPress – Volume 2 – Administration & Utilisation (French Edition)

$9.90

SaleBestseller No. 3

WordPress 24-Hour Trainer

$3.95

Bestseller No. 4

Teacher Record Book

Keep track of everything from attendance to test scores; Spiral bound; Measures 8-1/2" x 11"

$4.89

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.