Here’s our rule. Leave WordPress’s small security updates turned on: they’re widely tested, generally safe, and usually released to patch important security holes. But turn automatic updates off for your plugins and themes, unless someone is checking your site after they run. Updates matter. Running them with no one watching and no plan if something breaks is playing with fire.
| Type of update | Our advice |
|---|---|
| Small WordPress security releases (for example, 6.8.1 to 6.8.2) | Leave automatic updates on |
| Major WordPress releases (for example, 6.8 to 6.9) | Update deliberately: confirm your theme and plugins are up to date and compatible first, take a backup, and check the site afterward |
| Plugins and themes | Leave automatic updates off, and update on a regular schedule |
That’s the whole answer. The rest of this post explains why.
The three kinds of automatic updates in WordPress
- Small WordPress security releases. These install automatically by default, and we recommend keeping it that way. We do the same on every site we manage.
- Major WordPress releases. WordPress has an option to install these automatically too. These bring bigger changes, so it’s better to run them on purpose. When a major release causes trouble, it’s usually not WordPress itself but a plugin or theme that wasn’t ready for it, so update those first and make sure they support the new version.
- Plugins and themes. Next to each plugin on your Plugins screen, there’s an “Enable auto-updates” link. Some hosts also offer to update plugins for you.
Why plugin auto-updates are tempting
It’s worth being fair here. Automatic updates are convenient. They install security fixes quickly, and attackers move fast once a security hole is made public. And for a site nobody looks after at all, they’re better than never updating.
So the goal isn’t fewer updates. It’s updates that someone is paying attention to.
Why we leave plugin auto-updates off
No one is checking afterward. An automatic update runs while no one’s watching. If something breaks, nobody knows until a customer tells you, or until you notice the leads have stopped.
Plugins can clash. Your site might run 20 or 30 plugins from different developers, plus a theme. An update to one can conflict with another in ways no developer tested.
Some updates change how your site looks or works. Not every update is a quiet fix. Some change layouts, settings, or features.
Some sites can’t afford a silent break. On an online store or booking site, a broken checkout or calendar costs real money every hour it goes unnoticed.
Is this common? Fairly rare. But it does happen, and do you want to wake up to a broken website?
The exception: security plugins
If you use a well-known, trusted security plugin, keeping it automatically updated can make sense. It’s the tool defending your site, so you want it as current as possible. The same can be true of a few other plugins with a long, reliable track record. The key is knowing which ones have earned that trust.
A safer update routine
If you’re handling updates yourself:
- Make sure you have a recent backup, and know how to restore it.
- Update plugins and themes on a regular schedule, at least weekly.
- Check your site afterward: the homepage, a few key pages, and your contact form.
- Have a plan if something breaks, whether that’s restoring the backup or calling someone who can fix it.
(For the full routine, see our WordPress maintenance checklist.)
How we handle updates
We update WordPress the same day a new release comes out, and plugins and themes twice a week. After each round, automated checks look for errors and compare your homepage to how it looked before, so problems get caught early, and our team is on hand to fix anything that comes up.
Working on a large number of sites also teaches us things a single site owner rarely sees: which plugins can usually be trusted, which updates tend to cause trouble, and the early signs that something’s about to go wrong.
Website Maintenance covers all of this. Website Care adds a team that handles your website changes, too.
See what Website Care includes → · Compare plans and pricing →
FAQ
How do I turn off automatic plugin updates?
Go to Plugins in your WordPress dashboard. In the Automatic Updates column, click “Disable auto-updates” next to any plugin that has them turned on. To change several at once, select them and use the Bulk actions menu.
Are WordPress’s automatic security updates different?
Yes. Small WordPress security releases are widely tested and focused on fixing problems, not adding features. They’re on by default, and we recommend leaving them on.
What if a plugin has an urgent security fix?
Install it right away, then check your site. Attackers move quickly once a security hole is announced, so urgent fixes shouldn’t wait for your regular schedule.
Does my host update my plugins automatically?
Some hosts offer it. Check your hosting dashboard, and ask whether anyone checks your site afterward. The same concerns apply no matter who runs the update.
