How to Manage Automatic Updates in WordPress (Core, Plugins and Themes)

Most hacked WordPress sites run outdated plugins or core. Automatic updates close those holes quickly, but a big update can occasionally break something. The answer isn't all or nothing; here is how to control updates sensibly.

Core updates

By default, WordPress installs minor and security releases automatically. Major versions can be enabled for auto-update from Dashboard > Updates. Or control it in wp-config.php:

// Minor (security) updates only - recommended default
define( 'WP_AUTO_UPDATE_CORE', 'minor' );

// All core updates, including major versions
define( 'WP_AUTO_UPDATE_CORE', true );

Plugin and theme auto-updates

1. Go to Plugins > Installed Plugins.
2. Click Enable auto-updates next to each plugin you trust.
3. For themes, open Appearance > Themes, click a theme and choose Enable auto-updates.

What to auto-update and what to do manually

• Auto-update: small, well-maintained plugins (SEO, forms, security, SMTP).
• Update manually after a backup: page builders, WooCommerce and its extensions, membership plugins, and your main theme.
• Premium plugins need an active licence to update; keep licences current.

A safe update routine

1. Take a backup (see free WordPress backups).
2. Test big updates on a staging site first.
3. Update one major plugin at a time and check key pages, forms and checkout.
4. Read changelogs for major version jumps.

If an update breaks the site

Check the email WordPress sends; it often links to recovery mode. You can also deactivate the plugin by renaming its folder in File Manager, or restore your backup. See fixing a critical error.

The attached snippets include the update constants plus other wp-config.php hardening settings.