Auto-Update
Quick Definition
Auto-updates are WordPress's built-in system for automatically installing new versions of core, plugins, themes, and translations without you having to click anything.
What Is Auto-Update?
Auto-updates in WordPress automatically install new versions of software on your site without manual intervention. WordPress handles four types of auto-updates, each with different default behaviors:
- Minor core updates (e.g., 6.9.3 → 6.9.4) — Enabled by default since WordPress 3.7. These are security patches and bug fixes. You should never disable these.
- Major core updates (e.g., 6.9 → 7.0) — Enabled by default on new installations since WordPress 5.6. Older sites may need to enable this manually via Dashboard > Updates.
- Plugin updates — Disabled by default. Since WordPress 5.5, you can enable auto-updates individually for each plugin from the Plugins screen. An "Enable auto-updates" link appears next to each plugin.
- Theme updates — Disabled by default. Same per-theme toggle available at Appearance > Themes.
- Translation updates — Always enabled. Language packs are small and safe to update automatically.
You can also control auto-updates through constants in wp-config.php:
define( 'AUTOMATIC_UPDATER_DISABLED', true );— Disables ALL auto-updates (core, plugins, themes, translations). Use this only on sites where you need complete manual control.define( 'WP_AUTO_UPDATE_CORE', true );— Enables auto-updates for all core releases (minor + major)define( 'WP_AUTO_UPDATE_CORE', 'minor' );— Only auto-update minor releases (the default for older installations)define( 'WP_AUTO_UPDATE_CORE', false );— Disables all core auto-updates
Important: enabling auto-updates for a plugin does not mean it will update immediately — it means that when a new version is available, WordPress will install it automatically without waiting for you to click "Update."
Auto-Updates in Practice
For most sites, the recommended configuration is: keep minor core updates and translations on automatic (the default), enable auto-updates for trusted plugins that you rely on (like your SEO plugin or security plugin), and leave major core updates manual so you can test on a staging site first.
The risk with plugin auto-updates is that a bad update can break your site while you are asleep. This is why backups are essential — if an auto-update causes problems, you need to be able to roll back. Many managed WordPress hosts offer automatic backups before updates and visual regression testing that catches layout issues automatically.
Site management tools like MainWP give you a middle ground: review available updates across all your sites from a single dashboard, then approve them in bulk rather than logging into each site individually.
Why It Matters
Outdated plugins and themes are the #1 attack vector for WordPress sites. Auto-updates keep your site patched against known vulnerabilities without relying on you to check manually. The trade-off between convenience and control is real — but for most sites, the security benefit of staying updated outweighs the small risk of an occasional breaking change.