WordPress automatic updates: what to switch on
Short answer: Leave WordPress's minor core updates switched on everywhere; they carry maintenance and security fixes and are on by default. For plugins and themes, turn auto-updates on for well-maintained, low-risk components on simple sites, and keep manual control over the few plugins that run your shop, bookings or memberships. Whatever you choose, have automatic daily backups and make sure the update emails reach someone who reads them.
What WordPress updates on its own
WordPress's own documentation lists four kinds of automatic background update: core, plugins, themes and translation files. Out of the box (as of November 2026):
- Minor core updates (maintenance and security releases, such as x.y.1 to x.y.2) are enabled by default on existing sites.
- Major core updates (x.y to x.z) are enabled by default on installations created with WordPress 5.6 or later; older installations keep their previous behaviour unless an administrator turns major updates on.
- Translation files auto-update by default.
- Plugins and themes only auto-update if you opt in, one by one, a feature added in WordPress 5.5.
WordPress runs its auto-update checks twice a day by default and emails the site's admin address when plugin or theme auto-updates succeed, fail, or partly fail.
Some hosts, especially managed WordPress hosts, add their own update systems on top, and some switch the built-in auto-update controls off. If you can't see the controls described below, check with your host before assuming something is broken.
The real trade-off
Updates fix security holes and bugs. Updates also occasionally break things: a plugin update conflicts with another plugin, a theme update changes a layout, a major core release exposes old code in a custom theme.
So the question isn't "updates: yes or no". It's which risk you'd rather manage for each component. An outdated contact-form plugin with a known vulnerability is a bigger danger to a brochure site than a broken layout for an hour. A broken checkout plugin on Black Friday is a bigger danger to a shop than waiting two days for a patch you install by hand after testing.
Recommendation matrix
Use this as a starting point and adjust for your own plugins.
| Component | Simple brochure site | Small shop (WooCommerce) | Bookings or membership site | Custom-built theme or plugins |
|---|---|---|---|---|
| Core minor (security) | On | On | On | On |
| Core major | On | Manual, within a week of release | Manual, within a week | Manual, after testing |
| Popular, well-maintained plugins (SEO, caching, forms, security) | On | On | On | On, unless they interact with custom code |
| Revenue-critical plugins (WooCommerce, payment gateways, booking engine, membership) | n/a | Manual, check changelog, update in quiet hours | Manual, same approach | Manual, after testing |
| Page builder and its add-ons | On if the site is simple | Manual | Manual | Manual |
| Theme from a reputable marketplace, unmodified | On | On | On | n/a |
| Custom or heavily edited theme | Off (updates would overwrite edits; use a child theme) | Off | Off | Off |
| Translations | On | On | On | On |
"Manual" doesn't mean "never". It means a person updates within days, checks the critical flows afterwards (add to cart, pay, book, log in), and is ready to restore a backup if needed. If you have a test copy of your site, that's the place to try risky updates first; we cover that elsewhere, so here it's enough to say it helps.
Settings walkthrough
1. Check core settings
Go to Dashboard → Updates. The top of the screen states which mode the site is in, for example "This site is automatically kept up to date with maintenance and security releases of WordPress only", with a link to enable automatic updates for all new versions (or to switch back). Choose the option that matches your column in the matrix.
If someone has defined update constants in wp-config.php, they override this screen. WordPress's documentation describes the WP_AUTO_UPDATE_CORE constant: true enables development, minor and major updates; false disables them all; 'minor' enables only minor updates. It also notes that disabling minor updates and translations is strongly discouraged. If the Updates screen doesn't behave as expected, ask your developer whether these constants or a plugin are controlling it.
2. Plugins
Go to Plugins → Installed Plugins. Each plugin has an "Automatic update" column with an enable/disable link. You can also select several plugins and use the bulk actions menu to enable or disable auto-updates in one go. Work through the list using your matrix.
While you're there, delete deactivated plugins you don't use. An inactive plugin can still be a security risk and still needs updating.
3. Themes
Go to Appearance → Themes, click a theme thumbnail, and use the "Enable auto-updates" link below the theme author. Themes have to be set one by one. Only enable this for themes you haven't edited directly.
4. Backups before anything else
WordPress's own guide recommends making sure you can roll back before enabling plugin and theme auto-updates. Set up automatic daily backups of files and database, stored off the server, with at least a couple of weeks of history. Test restoring one once, so you know how long it takes.
5. Make the emails useful
Update notifications go to the site's administration email address (Settings → General). Make sure it's a monitored address, not a former employee's or a developer who's no longer involved. Create a mail rule so "failed to update" messages are flagged.
6. Check that scheduling works
Auto-updates rely on WordPress's scheduled tasks (WP-Cron). If updates never seem to happen, go to Tools → Site Health and look for scheduled-event errors, as WordPress's documentation suggests.
A five-minute weekly routine
- Read any update emails and note failures.
- Open the home page, a key landing page and your money flow (form, cart, booking).
- Check Dashboard → Updates for anything left waiting, especially manual-only plugins.
- Once a month, glance at Site Health for new warnings.
FAQ
Will auto-updates break my site?
Occasionally, and usually in small ways. For simple sites, the risk of running outdated, vulnerable plugins is generally bigger than the risk of an update glitch, as long as you have backups.
Should I auto-update WooCommerce?
For most shops, update WooCommerce and payment plugins by hand within a few days of a release, outside busy trading hours, and test a purchase afterwards.
My host says it handles updates. Do I still need to do anything?
Ask exactly what it updates (core only, or plugins and themes too), whether it tests anything, and how fast it can restore a backup. Then fill the gaps yourself.
What if a plugin hasn't been updated in years?
That's a warning sign regardless of your auto-update settings. Look for a maintained alternative.
If you'd like your WordPress site's updates, backups and checks set up so they run quietly in the background, tell us which plugins your site depends on.