In this article9 sections
Automatic updates keep a WordPress site secure while you sleep. Most security fixes ship in minor releases and plugin patches, and a site that waits weeks for a manual update is open to attacks that are already public. The risk is the other kind of update: a major release or a plugin change that breaks a checkout while nobody is watching. This guide shows how to turn on the updates that are safe to run unattended, how to keep the risky ones under control, and how to find out quickly when something has broken.
SiteHarbour’s WordPress hosting plans include automatic and scheduled updates, and the staging tool used to test the risky ones. The steps below show what to turn on and what to leave manual, whichever host you use.
Know the three kinds of update
- WordPress core minor releases. These fix security and bugs without changing features. They are the safest to run automatically.
- WordPress core major releases. These can change how plugins and themes behave. Test them before they go live.
- Plugins and themes. Each one is a separate risk. A security patch is usually safe, but a feature update can change the output of a page or a form.
A sensible policy is to run minor core updates and security patches automatically, and to test major core updates and feature updates on staging first.
Step 1: Turn on minor core updates
WordPress has automatic updates for minor releases built in, but a site can turn them off in its configuration. Check the setting in wp-config.php, above the line that says to stop editing:
define('WP_AUTO_UPDATE_CORE', 'minor');Expected: minor releases install on their own. The value true turns on all core updates, including major ones, so use 'minor' unless you have tested the major releases. The value false turns off core updates entirely, which is a poor choice for a public site.
Step 2: Turn on plugin and theme updates one by one
In the dashboard, open Plugins and enable automatic updates for each plugin you trust, using the link beside it. Do the same under Appearance > Themes. Turn on automatic updates only for plugins that are actively maintained and that you actually use. A plugin with no updates for a year is a risk on its own, so remove it instead.
Plugins that handle payments, forms or membership deserve more care. Keep those on manual updates, and test them on staging first.
Step 3: Keep the risky updates on a schedule
For major core releases and feature updates, choose a quiet day, make a backup, and update on staging before you update the live site. The steps are in how to set up a WordPress staging site before updates. A monthly update window is enough for most sites, and it leaves time to fix a problem before the next one arrives.
Step 4: Check that the updates ran
Open Tools > Site Health once a week. It lists the core version, the plugins that need updates and any problem it has found. Use the WP-CLI command below if you have shell access, which gives the same list on the command line:
sudo -u www-data wp --path=/var/www/example plugin list --update=availableExpected: an empty list, or only the plugins you are testing on staging. A plugin that has waited weeks for an update is a sign that automatic updates are not running for it.
Step 5: Know how to recover
An automatic update can break a site, and the fix is faster when you have a plan. Keep a backup from before the update, use the steps in how to fix the WordPress white screen of death to find the plugin that failed, and roll the plugin back. WordPress does not roll back a plugin by itself, so keep the previous version in your backup or on your own storage.
Check the site after each automatic update by loading the home page, a post, the login and a page that takes a payment or a form, if you have one. A quick check each week finds a problem before a customer does.
Step 6: Protect the update path
Automatic updates depend on the file permissions being right. Folders should be 755 and files 644, so the update can write to the folders it needs and no more. A site that is writable by everyone is open to attack, so check the permissions after each change to the server.
Common mistakes
- Turning on every update. A feature update can break a form or a checkout. Keep the risky ones manual.
- Leaving plugins that nobody maintains. A plugin with no updates for a year is a security risk.
- Never checking the site after an update. A broken page can sit for days without anyone noticing.
- Disabling updates to avoid breakage. The site then runs known bugs and open security holes.
- Updating without a backup. A backup taken before the update is the only quick way back.
Frequently asked questions
Are automatic updates safe for a shop?
Minor core updates and security patches are usually safe. Test major releases and feature updates on staging first, because they can change the checkout.
Why did an update break my site?
A plugin or theme changed how it works, or it conflicts with another plugin or with the PHP version. The debug log names the cause, as shown in the white screen guide.
Can I turn updates off for one plugin?
Yes. Disable its automatic update link in the Plugins list, and update it by hand after you test it.
How do I know an update ran?
Check the core version and the plugin versions in Site Health, or in the update log that the dashboard shows after each run.
Turn on minor core updates and the security patches for the plugins you trust. Keep major releases and risky plugins on a monthly schedule, tested on staging first, and check the site after each change. Automatic updates protect the site only when someone is still watching the result. For the account-level protections that go with them, read how to secure WordPress on cPanel hosting.