Somewhere along the way, WordPress quietly started updating things on its own — a plugin patched itself overnight, and you never even noticed. For a lot of site owners, that’s the first moment they realize automatic updates are running in the background at all, which usually leads to two questions in quick succession: is that safe, and can I turn it off?
The honest answer is: it depends on which updates you’re talking about, and it’s rarely an all-or-nothing decision. Below is exactly what WordPress updates automatically by default, how to disable any part of it if you want to, and — more usefully — what the smartest WordPress teams actually do instead of just flipping a switch.
By default, WordPress automatically installs minor core updates (security and maintenance releases, like 6.5.1 to 6.5.2) but leaves major core updates, plugin updates, and theme updates to you, unless you’ve turned those on yourself. Most of the “auto-updates broke my site” horror stories come from site owners who manually enabled automatic plugin or theme updates — not from WordPress’s actual default behavior.
| Update Type | Default Behavior |
|---|---|
| Minor WordPress core updates (security/maintenance) | Automatic |
| Major WordPress core updates (e.g., 6.4 → 6.5) | Manual (you click “Update”) |
| Plugin updates | Manual, unless you’ve enabled auto-updates for each plugin |
| Theme updates | Manual, unless you’ve enabled auto-updates for each theme |
| Translation file updates | Automatic |
For most business websites, the safest approach isn’t “disable everything” or “auto-update everything.” It’s keeping automatic security patches on while managing plugin, theme, and major core updates through a controlled, tested process. Here’s why, and exactly how to set it up either way.
Before deciding what to disable, it helps to know what’s actually happening without any configuration at all:
This matters because a lot of the fear around “automatic updates” is really about plugin and theme auto-updates specifically — a setting most people turned on themselves at some point, often without realizing the implications, or that got enabled by a hosting provider’s default configuration.
The risks are legitimate, not theoretical. A plugin update can silently change how a shortcode renders, breaking a page layout nobody notices until a customer complains. A WooCommerce update can alter checkout behavior overnight, and if orders stop processing at 2 AM, you might not find out for hours. A theme update can overwrite customizations in a child theme that wasn’t set up correctly. And on inconsistent hosting environments — different PHP versions, different caching layers, different plugin combinations — the exact same update can behave perfectly on one site and break another one entirely.
None of this means WordPress itself is unstable. It means updates are only as safe as the environment they’re running into, and a lot of real-world WordPress environments are messier than they should be — mismatched PHP versions, unused plugins that never got removed, customizations layered on customizations over the years.
Here’s the part that gets underplayed in a lot of “just disable it” advice: turning off updates entirely doesn’t remove risk, it just delays it and changes its shape. Every week an update sits unapplied, the gap between your site’s code and the current, patched version grows — and that gap is exactly what automated vulnerability scanners look for. Security researchers and attackers both watch plugin changelogs closely; the moment a vulnerability is disclosed in a specific plugin version, sites still running that version become an active target, not a theoretical one.
The sites that get compromised are rarely the ones that updated too aggressively. They’re overwhelmingly the ones that stopped updating altogether and never went back.
If you’ve decided to take manual control of some or all updates, here’s exactly how, from most to least technical.
Add this line to your wp-config.php file, above the line that says “That’s all, stop editing”:
define( ‘WP_AUTO_UPDATE_CORE’, false );
This disables automatic core updates entirely, including minor security releases — which is why most experts recommend against disabling this specific one unless you have a solid manual patching process in its place.
This keeps automatic security patches on while requiring manual approval for bigger version jumps:
define( ‘WP_AUTO_UPDATE_CORE’, ‘minor’ );
This is actually the setting most security professionals recommend as a starting point — you stay protected against newly disclosed vulnerabilities without a major version update changing your site’s behavior unexpectedly.
If you’ve enabled auto-updates for individual plugins or themes, go to Plugins (or Appearance → Themes) in your dashboard, and next to each item you’ll see an “Enable auto-updates” / “Disable auto-updates” link — click to toggle it off individually. For a global override via code, add this to your theme’s functions.php or a site-specific plugin:
add_filter( ‘auto_update_plugin’, ‘__return_false’ );
add_filter( ‘auto_update_theme’, ‘__return_false’ );
If editing code isn’t your thing, plugins like Easy Updates Manager give you a dashboard interface to control exactly which update types run automatically — core, plugins, themes, and translations — without touching a single file.
Disabling auto-updates buys you control, but control only helps if you actually use it. Turning updates off and then never checking back in is the worst of both worlds — you’ve disabled the safety net without replacing it with anything.
If you’re managing updates manually, build an actual routine around it: review available updates weekly rather than “whenever you remember,” test updates on a staging copy of your site before touching production, read the changelog for anything that mentions breaking changes or deprecated functions, and keep a recent, verified, off-site backup before applying anything to your live site. If that sounds like more process than you want to own, that’s a legitimate signal that a managed WordPress maintenance service — where someone else runs exactly this workflow on a schedule — is worth more than the monthly cost.
Keep automatic minor/security core updates on, in almost every case — the security benefit consistently outweighs the small risk of an unexpected change. Disable automatic plugin and theme updates if your site has heavy customization, a business-critical checkout flow, or a history of update-related conflicts — and replace that automation with a scheduled, tested manual process instead of just letting things sit. If your site is simple, low-customization, and low-stakes, broader auto-updates (including plugins) can be a reasonable trade of convenience for a small amount of added risk, as long as you’re still checking in regularly and have working backups.
The wrong answer, in every case, is disabling updates and then forgetting the site exists. That’s not caution — it’s just risk on a delay.
Should you disable WordPress automatic updates? For most business sites, the smarter move isn’t an all-or-nothing switch — it’s disabling automatic major core, plugin, and theme updates while keeping minor security patches on, and replacing the rest with a real, scheduled manual review process. Auto-updates aren’t the enemy, and neither is manual control. The actual risk is inconsistency: an environment nobody’s watching, running updates nobody’s testing, on a schedule that doesn’t exist.
If building and maintaining that process yourself sounds like more than you want to take on, that’s exactly what WPdepend handles for clients every day — reviewing updates on staging before they touch a live site, applying them on a controlled schedule, and keeping verified off-site backups the entire time, so updates stay boring instead of becoming an emergency. If you’re not sure whether to disable auto-updates or manage them a smarter way, WPdepend can set up the right update strategy for your specific site.
No. By default, WordPress automatically applies minor core updates (security and maintenance releases) but leaves major core updates, plugins, and themes to manual updates unless you’ve specifically enabled auto-updates for them.
Add define( ‘WP_AUTO_UPDATE_CORE’, false ); to your wp-config.php file to stop automatic core updates entirely, and disable auto-updates individually for each plugin and theme from the Plugins and Themes screens in your dashboard.
It’s generally not recommended. Minor core updates almost always contain security patches for actively exploited vulnerabilities, and disabling them leaves your site exposed unless you have a reliable manual process for applying security patches quickly and consistently.
Auto-updates most often break sites when a plugin or theme update conflicts with custom code, an outdated PHP version, or another plugin — issues that are far more likely on inconsistent, untested environments than on well-maintained ones with a staging workflow in place.
It can help if you’d rather not edit code directly. Plugins like Easy Updates Manager let you control exactly which update types (core, plugin, theme, translation) run automatically through a simple dashboard interface.
Keep automatic minor security updates enabled, disable automatic plugin and theme updates, and apply those manually on a regular schedule after testing on staging — ideally through a managed maintenance service if you don’t have the time to run that process consistently yourself.
A seasoned technology writer and marketing consultant with over a decade of experience helping businesses grow online. I specialize in content marketing, SEO, web design, and e-commerce development. I am enthusiastic about using cutting-edge technology to acquire high-quality traffic, generate leads, and increase sales for my clients.
