What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
WordPress separates automatic updates into four paths: core software, plugins, themes, and translations. You control plugin and theme automation in the dashboard; core policy is set mainly in wp-config.php or with update filters. The safest policy is usually to retain automatic core maintenance and security updates, enable plugin or theme automation only for components you can restore, and test high-impact or customized code on staging first.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What WordPress auto-updates actually control
There is no single auto-update switch that behaves identically for every part of a site. WordPress handles these update classes separately:
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- Core: the WordPress application itself, including maintenance and security releases.
- Plugins: extensions installed on the site. Each plugin can have its own automatic-update setting.
- Themes: installed themes. Automatic updates are selected theme by theme.
- Translations: language files, which follow WordPress’s own translation update process.
Plugin and theme controls in the dashboard have been available since WordPress 5.5. Eligible plugin and theme automatic updates normally run twice per day. WordPress sends the site owner an email after a successful or failed attempt, so the notification mailbox is part of your operating procedure rather than an optional extra.
Automatic updating reduces the time a known vulnerability remains unpatched, but it can also introduce a compatibility problem. A reliable policy therefore combines update speed with a current backup, a tested restore path, and a clear exception process for customized or business-critical components.
#1 Best Overall
Turn plugin auto-updates on or off in the dashboard
Enable or disable one plugin
- Sign in to the WordPress administrator area.
- Open Plugins.
- Find the Automatic update column in the plugin list.
- Select the action shown for that plugin: enable automatic updates if they are off, or disable automatic updates if they are on.
The setting applies to that plugin, not to every plugin on the site. This makes it possible to automate a low-risk, actively maintained extension while holding a customized integration for a scheduled maintenance window.
Change several plugins together
- Open Plugins and tick the checkboxes for the plugins you want to change.
- Choose the relevant automatic-update action from the bulk-action control.
- Apply the action and verify the resulting status in the Automatic update column.
After a bulk change, inspect the list again. A plugin can be omitted from the selection or have a status that differs from the rest, and the column is the authoritative check of what WordPress will attempt automatically.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Turn theme auto-updates on or off
Enable or disable a specific theme
- Open Appearance in the administrator area.
- Select the theme you want to manage.
- Use Enable auto-updates, or use the matching disable action if automation is already active.
The theme control is individual. Activating automatic updates for one theme does not activate them for the other installed themes. Treat a customized theme differently from an unmodified theme: a child theme or a theme with edited files can lose those edits or become incompatible when its parent or related code changes.
Choose a core update policy
Core behavior can be set with the WP_AUTO_UPDATE_CORE constant in wp-config.php. The documented values are:
| Setting | Effect | When it fits |
|---|---|---|
define( 'WP_AUTO_UPDATE_CORE', false ); |
Disables automatic core updates. | Only when you have a deliberate testing, hosting, or customization reason and a scheduled manual-update process. |
define( 'WP_AUTO_UPDATE_CORE', true ); |
Enables all core updates. | Sites that can tolerate the broadest automatic core coverage and have a dependable rollback path. |
define( 'WP_AUTO_UPDATE_CORE', 'minor' ); |
Enables minor releases; WordPress describes this as the default core setting. | A conservative baseline that keeps routine maintenance and security coverage without opting into every major release automatically. |
Place the constant according to the WordPress configuration instructions for your installation and define it only once. A duplicate definition later in the file can make the effective policy difficult to understand. Before editing, save a copy of the existing configuration and confirm that your host does not inject its own update setting.
Disable every automatic update only as an exception
WordPress also documents:
define( 'AUTOMATIC_UPDATER_DISABLED', true );This disables automatic updates. Legitimate uses include a host that supplies and coordinates updates, a site with substantial customizations that must be tested first, or a deliberate pause while a development or staging copy is being validated. A full shutdown should not become the default: WordPress strongly discourages disabling automatic updates because automatic minor updates are an important way to keep sites current and secure. WordPress states that only the latest version is officially supported, while its Security Team may backport critical fixes to older versions as a courtesy; that courtesy is not a substitute for keeping the site current.
Use filters for finer control
Constants provide broad core policy. If you need programmatic control over plugin or theme classes, WordPress documents update filters that belong in a regular plugin or a must-use plugin:
auto_update_plugincan enable or disable plugin automatic updates globally.auto_update_themecan enable or disable theme automatic updates globally.auto_update_$typesupports decisions for an individual item of a given update type.
These filters let an administrator express rules such as allowing automation for approved plugins while excluding one plugin identified by its slug, or allowing theme updates except for a customized theme. The exact callback must return the documented boolean decision and should be maintained like any other production code.
Do not put filter calls directly in wp-config.php. The WordPress developer handbook cautions that WordPress is not fully loaded there, so the hooks and APIs your callback expects may not yet exist. A small site-specific plugin or must-use plugin loads at the appropriate point and keeps the policy visible, version-controlled, and removable.
Example policy skeleton
<?php
// Put this in a site-specific plugin or a must-use plugin.
add_filter( 'auto_update_plugin', function ( $update, $item ) {
// Return true or false only after identifying the plugin safely.
return $update;
} );The skeleton is intentionally not a copy-and-paste rule for every site. Identify the item using the data WordPress passes to the filter, document the reason for the exception, and test the callback on staging before deploying it. A malformed callback can affect every future update attempt.
A safe operating procedure before changing automation
1. Inventory the site
Record the current WordPress core version, active theme, installed and active plugins, custom code, and any integrations that matter to visitors or administrators. Note whether the host performs its own updates. Two systems updating the same component without coordination can create confusing timing and notification patterns.
2. Back up both files and the database
Make a backup that includes the WordPress files and the database, not just one or the other. WordPress recommends regular automatic backups and advises ensuring that you can roll back before enabling plugin or theme auto-updates. A backup is useful only if it is recent, stored separately from the live site, and restorable; verify that the restore procedure and credentials are available to the person responsible for an incident.
3. Clone production to staging when risk is material
Use a development or staging environment when the site contains customizations, ecommerce workflows, membership features, unusual integrations, or code supplied by a host. Test the proposed update there, exercise the workflows that generate revenue or account changes, and inspect logs for errors. WordPress explicitly recognizes staging and testing as valid reasons to control update timing.
4. Select the update scope
Keep core maintenance and security coverage in place where possible. For plugins and themes, enable automation for well-maintained, unmodified components with a proven restore path. Hold customized, abandoned, or high-impact components for a controlled maintenance window. The decision is not permanent: review the exception when the customization is removed or the component becomes actively maintained.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors5. Monitor the result
Read the success and failure emails generated by WordPress. After a meaningful update, test the public home page, login, forms, search, media uploads, and the site’s most important business or community workflow. A green update email confirms an update attempt, not that every custom interaction is healthy.
6. Document every exception
For each disabled automatic update, record the component, reason, owner, backup location, and review date. Assign a recurring review so a temporary pause does not become an unowned security exposure. When the review date arrives, either re-enable automation or schedule and document a manual update.
Details that prevent surprises
Translations follow a separate path
Translation files are another update class, but they do not use the same per-plugin or per-theme controls described above. Let WordPress handle them through its translation update process unless your host has a documented policy that changes that behavior. If a multilingual site shows stale strings after an update, check the translation status as a separate task rather than assuming the plugin or theme toggle controls it.
Twice-daily attempts are not a guaranteed completion time
The documented schedule means eligible plugin and theme updates are normally attempted two times per day. It does not guarantee that every attempt succeeds: maintenance windows, file permissions, disk space, connectivity, or a host-level process can interfere. Treat the success or failure email as an operational signal and investigate failures instead of waiting for the next cycle.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallIf the controls are missing
The per-plugin and per-theme dashboard controls require WordPress 5.5 or later. On an older installation, plan an upgrade path rather than assuming the feature is broken. A managed host may also hide or supersede dashboard controls; ask which system owns updates and where its logs and notifications are kept before changing configuration.
Keep policy changes reversible
Store a copy of the original wp-config.php before changing constants, and record the effective value in your maintenance notes. For filter-based rules, keep the site-specific or must-use plugin in version control. A reversible change lets you remove an exception quickly if it blocks a security release or causes an unexpected update decision.
Assign a real owner
Automation still needs human oversight. Give one person or team responsibility for reading update notices, checking critical workflows, maintaining staging, and initiating a restore. If responsibility is shared, define who acts first when a failure email arrives and who approves re-enabling a paused component.
Rank #4
Compare practical update policies
There is no universal setting. Compare the options using five operational axes: security speed, compatibility control, rollback readiness, operational effort, and interaction with host-managed updates.
| Policy | Security speed | Compatibility control | Rollback readiness needed | Operational effort | Hosting interaction |
|---|---|---|---|---|---|
| Broad automation | Fastest because eligible updates are attempted automatically. | Lowest; production may update before a manual test. | High-quality, current restore path is essential. | Lower routine effort, but failures require prompt investigation. | Must be coordinated with any host update system. |
| Selective plugin and theme automation | Fast for approved components; delayed for exceptions. | Moderate to high because risky items receive a controlled window. | Required for the automated set and strongly advisable for manual updates. | Moderate; someone must maintain the approved and excluded lists. | Confirm which layer owns each component. |
| Manual updates with core maintenance retained | Core maintenance coverage remains automatic; plugin and theme fixes wait for review. | High for extensions, provided reviews happen promptly. | Required before each update window. | Higher and dependent on a named operator. | Useful where the host schedules or stages updates. |
| All automatic updates disabled | Slowest and dependent entirely on human action. | Highest immediate control. | Still required; a backup cannot compensate for months of missed patches. | Highest, with a documented cadence and monitoring burden. | May be appropriate only when the host explicitly owns updates. |
How to handle common failure scenarios
An update breaks the front end
- Use the failure notification and server or WordPress logs to identify the component that changed.
- If visitors cannot use a critical workflow, place the site in the safest temporary state available and restore the known-good files and database from your verified backup.
- Reproduce the update on staging, then check the component’s compatibility notes and your custom code before trying again.
- Keep the affected component out of automatic updates until you have a tested fix, and document the exception with a review date.
An update email reports failure but the site appears normal
Do not ignore the message. Confirm the installed versions in the dashboard, inspect the update screen for a partial result, and check that file permissions, available disk space, and host maintenance did not interrupt the attempt. Run a controlled manual update only after a fresh backup and an explanation of the original failure.
The host and WordPress both claim to manage updates
Ask the host which update classes it controls and when it runs them. Compare that schedule with the dashboard’s twice-daily plugin and theme attempts, then choose one owner for each class. If the host supplies updates, a deliberate AUTOMATIC_UPDATER_DISABLED policy may be appropriate, but document the host’s responsibility, notification path, and rollback procedure.
A customized theme or plugin must not change unexpectedly
Disable automation for that item, preserve the current version in a backup or deployment system, and test upgrades on staging. Prefer a maintainable customization approach, such as a child theme or a site-specific plugin, so that future vendor updates do not overwrite local changes. Revisit the exception whenever the customization is refactored.
Operational checklist
- Core policy is explicitly recorded and matches the site’s risk tolerance.
- Each plugin and theme shows the intended status in its dashboard column or theme screen.
- Files and database are backed up before enabling new automation or performing a manual update.
- A restore has been tested, not merely scheduled.
- Staging is used for custom code, ecommerce, membership, and other high-impact changes.
- Success and failure notifications reach a monitored mailbox.
- Host-managed updates have a single, documented owner.
- Every disabled update has a reason, an owner, and a review date.
- Critical visitor and administrator workflows are checked after substantial updates.
Recommended default for most sites
Start with WordPress’s documented minor-core policy, retain security and maintenance coverage, and use the dashboard to enable plugin and theme automation selectively. Exclude customized or high-impact components until they pass staging tests. If you must disable all automation, treat that as a time-bounded exception with a named operator, current backups, and a calendar date for review. This approach preserves the security benefit of timely updates without pretending that every site has the same compatibility risk.
Frequently Asked Questions
How do I turn off WordPress auto-updates completely?
Add define( 'AUTOMATIC_UPDATER_DISABLED', true ); in wp-config.php. Use this only for a documented hosting, customization, or testing reason, and assign someone to perform and monitor manual updates.
Can I enable automatic updates for only some plugins?
Yes. In Plugins, use the Automatic update column for individual plugins or select several and use the bulk action. Verify the column afterward.
Best Value
Can I auto-update one theme but not another?
Yes. Open Appearance, select the theme, and choose Enable auto-updates or the disable action. Themes are managed individually.
What is the safest core setting?
define( 'WP_AUTO_UPDATE_CORE', 'minor' ); keeps the documented minor-release policy, which WordPress describes as the default. Broader or narrower policies should match your testing and rollback capability.
How often do plugin and theme auto-updates run?
Eligible updates are normally attempted twice per day. WordPress emails the site owner after successful or failed attempts, so monitor that mailbox.
Why should I use staging before an automatic update?
Staging lets you test custom code, ecommerce, membership, and other high-impact workflows before production changes. It is especially useful when compatibility is uncertain or a host also performs updates.
Where should update filters be added?
Put documented filters such as auto_update_plugin, auto_update_theme, and item-level auto_update_$type callbacks in a regular plugin or must-use plugin, not directly in wp-config.php.
The Bottom Line
Keep WordPress core maintenance and security coverage enabled whenever practical. Turn on plugin and theme auto-updates selectively, maintain current file-and-database backups with a tested restore, and use staging for customized or business-critical components. Any disabled automation should have a named owner, a documented reason, and a review date.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
