Configure automatic updates in WordPress

WordPress can update itself, its plugins and its themes in the background. Automatic updates close security holes within hours instead of days, which matters most for sites nobody logs into often. You decide how far to go.

Before you start

• Administrator access to WordPress.
• Working daily backups (MdmHost JetBackup runs automatically) so you can roll back a bad update.
• A working cron: automatic updates run through WP-Cron, so a site with no visitors and no real cron job may not update.

What updates by default

Turn on plugin and theme auto-updates

1. Go to Plugins → Installed Plugins.
2. In the Automatic Updates column click Enable auto-updates for each plugin you trust, or select several and use Bulk actions → Enable Auto-updates.
3. For themes go to Appearance → Themes, click a theme and choose Enable auto-updates.

Good candidates are small, well-maintained plugins and security plugins. Large plugins that change your database, such as shop or page builder plugins, are safer to update manually after a staging test.

Control core updates

Add one of these lines to wp-config.php above the "stop editing" comment:

define( 'WP_AUTO_UPDATE_CORE', 'minor' );

• 'minor': only maintenance and security releases (recommended).
• true: all core updates, including major versions.
• false: no automatic core updates. Only use this if you have another update process.

You can also switch major-version auto-updates on or off from Dashboard → Updates with the Enable automatic updates for all new versions of WordPress link.

Disable all automatic updates

If you manage updates with WP-CLI or a management tool, you can switch off the background updater completely:

define( 'AUTOMATIC_UPDATER_DISABLED', true );

Only do this if someone really does update the site every week.

Get notified

WordPress emails the admin address after automatic updates and when one fails. Check that the address in Settings → General → Administration Email Address is monitored, and that WordPress mail actually arrives. If it does not, set up SMTP.

Troubleshooting

• Updates never run: WP-Cron is not triggered. Add a real cron job in cPanel.
• "Another update is currently in progress": wait 15 minutes, or delete the core_updater.lock row from the options table.
• Auto-update link missing: a plugin or a constant in wp-config.php disables it.
• Update failed because files are not writable: check that folders are 755 and files 644 and owned by your cPanel user.

Fine-grained control with filters

Developers can control updates per plugin with a small must-use plugin in wp-content/mu-plugins. For example, the auto_update_plugin filter receives each plugin and returns true or false, so you can auto-update everything except a list of critical plugins. The auto_update_theme and allow_major_auto_core_updates filters work the same way for themes and core. Keep such code in a must-use plugin rather than in your theme, so it keeps working when you switch themes.

A sensible policy for most sites

• Core: minor releases automatic, major releases by hand within a week.
• Security and small utility plugins: automatic.
• Shop, membership, page builder and form plugins: by hand after reading the changelog.
• Themes: automatic only if you use a child theme for your changes.
• Backups: daily, which MdmHost already does with JetBackup.

Next steps

• Update WordPress safely by hand
• Set up a real cron job
• Make WordPress emails arrive