Outdated plugins are the most common way WordPress sites get hacked. Automatic updates close that gap — as long as you can recover quickly when an update breaks something. This guide shows what WordPress updates by default, how to change it, and how to make automatic updates safe on your own server.

What updates automatically by default

Component Default behaviour
Core minor / security releases (e.g. 6.x.1 → 6.x.2) On
Core major releases (e.g. 6.7 → 6.8) On for new installs since WordPress 5.6; older sites may have it off
Plugins Off — enable per plugin
Themes Off — enable per theme
Translations On

Turn on plugin and theme auto-updates (dashboard)

  • Plugins → Installed Plugins: each plugin has an Enable auto-updates link. Use bulk actions to enable it for several at once.
  • Appearance → Themes: open a theme’s details and click Enable auto-updates.
  • Dashboard → Updates shows whether major core updates are automatic.

A sensible policy: enable auto-updates for well-maintained plugins with a good track record, and update complex ones (page builders, WooCommerce and its extensions, membership plugins) manually after checking the changelog.

Control updates in wp-config.php

Add these lines above /* That's all, stop editing! */:

// Core: true = all updates, 'minor' = security/minor only, false = none
define( 'WP_AUTO_UPDATE_CORE', 'minor' );

To disable all automatic updates (only if you update another way, such as WP-CLI from cron):

define( 'AUTOMATIC_UPDATER_DISABLED', true );

Don’t use DISALLOW_FILE_MODS unless you deploy code from Git — it also hides the plugin installer and update buttons.

Fine-grained control with filters

In a small must-use plugin (wp-content/mu-plugins/updates.php):

<?php
// Auto-update all plugins except the ones listed
add_filter( 'auto_update_plugin', function ( $update, $item ) {
    $manual = [ 'woocommerce', 'elementor-pro' ];
    return in_array( $item->slug, $manual, true ) ? false : true;
}, 10, 2 );

// Auto-update themes
add_filter( 'auto_update_theme', '__return_true' );

Updating with WP-CLI

On a VPS, WP-CLI is the most reliable way to update and to script updates:

wp core update
wp plugin update --all
wp theme update --all
wp core update-db

Run as the site’s user (not root), from the WordPress directory, e.g. sudo -u www-data wp plugin update --all.

Make updates safe

1. Use a real cron

WordPress runs its updater through WP-Cron, which only fires when someone visits the site. On low-traffic sites updates can be delayed for days. Replace it with a system cron:

// wp-config.php
define( 'DISABLE_WP_CRON', true );
# crontab -e (as the site user)
*/5 * * * * cd /var/www/example.com && wp cron event run --due-now >/dev/null 2>&1

2. Back up before updates

Take a database dump and file backup every night, stored off the server:

wp db export /backups/db-$(date +%F).sql
tar czf /backups/files-$(date +%F).tar.gz wp-content

Our automated VPS backups guide shows how to send these to remote storage automatically.

3. Watch for problems

  • Enable email notifications (WordPress sends them for automatic updates by default).
  • Use an uptime monitor that checks a page for an expected string, not just a 200 response.
  • Keep WP_DEBUG_LOG available so you can enable logging quickly if something breaks.

4. Know how to roll back

If a plugin update breaks the site, deactivate it with WP-CLI (wp plugin deactivate plugin-name) or rename its folder under wp-content/plugins. Then install the previous version (wp plugin install plugin-name --version=1.2.3 --force).

Summary

Keep minor core updates and most plugin updates automatic, update complex plugins manually, run WP-Cron from a real system cron, and back up every night. That combination keeps a WordPress VPS secure without surprises.

  • WordPress
  • Security
  • Updates