WordPress Automatic Updates: What to Turn On and What to Leave

The large majority of WordPress security vulnerabilities reported each year are in plugins and themes, not in WordPress itself, and many of them are exploited on sites where a fix had been available for weeks. Automatic updates are the obvious answer, and a good one. Switched on without any thought, though, they bring a different risk: a site that changes overnight with nobody watching.

What WordPress does on its own

Maintenance and security releases of WordPress, such as 7.0.3 to 7.0.4, have installed automatically by default since WordPress 3.7. Leave this on. These releases are deliberately small and exist to fix problems.

Major releases, a move to a new version number such as 7.1, can also be set to install automatically, from the Updates screen in the dashboard.

Plugins and themes only update automatically if you choose. Since WordPress 5.5, each one has an “Enable auto-updates” link on the Plugins and Themes screens, so the decision can be made one plugin at a time.

Automatic updates are run by WordPress’s own scheduler, which only runs when the site receives visits unless a real server cron job has been set up. Why your scheduled posts do not publish explains the difference, and the same applies here.

What to switch on

• WordPress maintenance and security releases: always.
• Well maintained plugins that do one job: good candidates. A widely used plugin with frequent small releases and a narrow purpose, such as a spam filter, is unlikely to break a site when it updates.
• Anything with a security fix announced: do not wait for the next automatic run. Update it by hand straight away.

What to update by hand

• Anything that takes money. WooCommerce, payment gateways and shipping extensions control behaviour that customers depend on. Update them when someone can place a test order straight afterwards.
• Page builders and the active theme. These control how every page looks. A layout that changes after an update produces no error, so nothing warns you.
• Major WordPress releases on a complex site, until the plugins you rely on have confirmed they are compatible.
• Premium plugins that update through their own licence system, where an expired licence can quietly stop updates arriving at all. These need checking by eye, not just trusting.

The safety net

Since WordPress 6.6, if an automatic plugin update causes a fatal error, WordPress detects it and puts the previous version of the plugin back. That covers the worst case, a site that no longer loads. It does not cover a plugin that updates cleanly and then behaves differently, which is why the lists above still matter.

Make updates something you notice

WordPress emails the site’s administration address after automatic updates. Make sure that is an address someone reads, and do read the emails: they list exactly what changed, which is what you need to know if something looks different the next morning.

Pair that with regular backups and a known way to restore them, and an automatic update that goes wrong becomes a short job rather than a crisis. Updates are one part of the website security measures that actually matter. For the PHP side of keeping WordPress current, see WordPress and PHP versions: upgrading without taking the site down.