How to enable or disable automatic updates in WordPress (plugins, themes & core)

Since WordPress 5.5, you can let the platform update plugins, themes and its own core files on their own, without you logging in to click anything. This guide is the practical how-to: it walks through every way to switch automatic updates on or off, from the simple dashboard toggles to the wp-config and code methods that give you finer control. Once you know where the switches are, the second half of the guide covers the more interesting question of which updates you should actually automate, and how to do it without ever waking up to a broken site.

How to enable automatic updates for plugins

This is the most common request, and it takes seconds. In your WordPress dashboard, go to Plugins. You will see the full list of installed plugins, and on the right hand side there is an Automatic Updates column. Next to each plugin is a link that reads Enable auto-updates. Click it, and from then on WordPress will install new versions of that plugin automatically as they are released. The official WordPress documentation on managing plugins describes this same screen.

You enable it per plugin, which is deliberate. It means you can automatically update the small, low-risk utilities while keeping a tighter hold on the plugin that powers your shop, your forms or your page builder. To switch it back off for any plugin, click the Disable auto-updates link that now appears in the same column.

How to enable automatic updates for themes

Themes work almost the same way, just on a different screen. Go to Appearance then Themes, and click the theme you want to manage. In the details panel that opens, you will find an Enable auto-updates control. Click it and that theme will update itself whenever its developer ships a new version.

One word of caution before you automate a theme: if you have edited the theme files directly rather than using a child theme, an update can overwrite those changes. If that applies to you, move your customisations into a child theme first, then turn auto-updates on. To disable it, open the same theme panel and choose Disable auto-updates.

How to control WordPress core updates (minor vs major)

WordPress core is handled differently from plugins and themes. Out of the box, WordPress automatically installs minor releases, the small security and maintenance patches such as a move from 6.5 to 6.5.1, while leaving major releases such as 6.5 to 6.6 for you to approve. For most sites that default is the right balance.

If you want to change it, you do so with a single constant in your wp-config.php file. The WordPress.org guide to configuring automatic background updates documents the accepted values:

• define( 'WP_AUTO_UPDATE_CORE', 'minor' ); updates minor releases only. This is the default behaviour.
• define( 'WP_AUTO_UPDATE_CORE', true ); automates every core update, including major versions.
• define( 'WP_AUTO_UPDATE_CORE', false ); turns off all automatic core updates, including security patches. Use this with caution.

Add the line near the other defines at the top of wp-config.php, save, and the change takes effect immediately. If your site lives on managed hosting, your host may already enforce a setting here, so check with them before editing the file.

How to force or block updates with filters in functions.php

The dashboard toggles are perfect for a single site. If you manage several sites, or you want a rule that survives no matter what someone clicks, WordPress gives you code-level control through filters you can add to your theme's functions.php file or a small plugin. The two you will use most are auto_update_plugin and auto_update_theme.

Returning true from one of these filters forces auto-updates on, while returning false blocks them. For example, to enable automatic updates for every plugin in one stroke, you would add add_filter( 'auto_update_plugin', '__return_true' );. To turn them all off, swap in '__return_false'. You can also inspect the item passed to the filter and decide on a case-by-case basis, which is how you might automate everything except one critical plugin. The filter approach is documented in the WordPress developer handbook, and it always overrides the dashboard toggles, so use it deliberately.

How to manage updates with a plugin or dashboard

If touching code is not for you, a management plugin gives you the same control through a friendly interface. Tools in this category let you switch auto-updates on or off for plugins, themes and core from one screen, schedule updates for quiet hours, and in many cases take an automatic backup immediately before each update runs. If you look after more than one WordPress site, a central management dashboard goes a step further, letting you set and review update rules across every site you run from a single login. Plenty of these tools work quietly in the background, the same kind of automation we cover in our guide to WordPress tools that work while you sleep.

How to disable automatic updates (every method)

Turning updates off is simply the reverse of everything above, gathered in one place so you can find it fast:

• Plugins. On the Plugins screen, click Disable auto-updates in the Automatic Updates column for each plugin.
• Themes. Open Appearance then Themes, click the theme, and choose Disable auto-updates.
• Core. Set define( 'WP_AUTO_UPDATE_CORE', false ); in wp-config.php to stop all core updates, or 'minor' to keep only security patches.
• Everything at once. Add the auto_update_plugin and auto_update_theme filters returning false, or flip the switches in your management plugin.

One thing worth saying plainly: disabling updates does not make your site safer, it makes it more exposed. The reason to switch any of this off is control over timing, not avoidance. Which brings us to the part that actually matters, deciding what to automate.

Should you enable automatic updates? The honest answer

Now that you know how, here is the why. For most small Australian business sites, the sensible setting is automatic updates on for security and minor core releases, and manual or staged for major core, plugin and theme jumps. That keeps you protected against known exploits, which is no small thing. The overwhelming majority of WordPress hacks do not target the newest version; they exploit known vulnerabilities in outdated software that were patched months earlier but never installed. Independent reporting from Patchstack shows the bulk of compromised sites were running software with a fix already available. Automatic updates close that gap the moment a patch ships.

The trade-off is control. A major update that changes how WordPress behaves can occasionally clash with a plugin, a theme or custom code and break a feature. The risk runs highest on older, heavily customised sites with many plugins and a modified theme, and lowest on a clean, well-built site with a handful of well-maintained plugins. The more custom your build, the more major updates deserve a test run before they reach your visitors. If speed is part of why you keep your stack lean, our guide to WordPress speed optimisation is a useful companion to a tidy update routine.

To make the decision concrete, here is how leaving automatic updates on compares with switching them off, weighed across the things that actually matter for a live business site.

The safety net: backups, staging and a maintenance plan

Whatever you choose to automate, the safety net is what makes it low-stress. Three things turn an update from a gamble into a routine. First, an automatic backup before every update, so any bad update is a quick restore rather than a crisis. Second, a staging environment, a private copy of your site where major updates are applied and checked before they go live. Third, monitoring afterwards, uptime checks and error logs that flag a problem within minutes rather than when a customer emails you.

If an update does break something, recovery is usually fast when you are prepared. Restore the most recent backup taken before the update to return the site to its exact previous state, or if only one plugin caused the trouble, roll that single plugin back to its previous version. The catch is that automatic updates patch your site, but they do not test that everything still works, take backups, watch for downtime or check for conflicts afterwards. That human oversight is exactly why set it and forget it does not work for WordPress maintenance. Automation and attention work best together, not as substitutes for one another.