Using WordPress Auto-Updates Properly – When They Run Safely

“Automatic updates are dangerous” – you hear it often, and as a blanket statement it’s wrong. In practice, auto-updates run reliably on many sites and take real work off owners’ plates. What matters isn’t whether, but how: which updates automate well, which are better not, and which guardrails belong with them.

What Automates Without Issue

• Minor and security core releases (e.g. 6.9.1 → 6.9.2): small, backward-compatible, security-relevant. These should run automatically almost always. In wp-config.php:

  define( 'WP_AUTO_UPDATE_CORE', 'minor' );

• Well-maintained plugins with a stable update history and low criticality to the site.

Where Caution Is Warranted

• Major core updates (e.g. 6.x → 7.0): these bring larger changes and should be tested in a staging environment before going live.
• Business-critical plugins (WooCommerce, payment and booking systems): a faulty auto-update can directly cost revenue here – and in the worst case cause a white screen of death or critical error. Better controlled and tested.
• Heavily customised setups with custom code that depends on specific plugin versions.

How to Set Up Auto-Updates

For plugins and themes, since WordPress 5.5 there’s an “Enable auto-updates” link per entry in the backend – no code needed. That’s the easiest way to automate individual, uncritical plugins specifically while deliberately keeping business-critical ones manual.

If you prefer to control it in code, use filters. This way you can enable or disable auto-updates for selected plugins in a targeted way:

// Example: disable auto-update for a specific plugin
add_filter( 'auto_update_plugin', function ( $update, $item ) {
    $blocklist = [ 'woocommerce/woocommerce.php' ];
    if ( in_array( $item->plugin, $blocklist, true ) ) {
        return false; // never auto-update this plugin
    }
    return $update;
}, 10, 2 );

The Guardrails That Make Auto-Updates Safe

Auto-updates work well – when three things run in the background:

1. Daily backups, so a problematic update can be reverted (→ backups done right).
2. Monitoring that alerts you if the site becomes unreachable or throws errors after an update.
3. A clear split: automatic for uncritical minor/security updates, controlled for majors and business-critical components.

Without these three, the automation is a blind flight: an update runs through at night, something breaks, and no one notices until the next customer call.

An Honest Assessment

Whether auto-updates are the right choice depends on the site. A simple brochure site does very well with largely automatic updates plus monitoring. A complex shop benefits from controlled, tested updates. The blanket “always automatic” or “never automatic” does neither justice – the mix is what works. Defining exactly that mix and securing it with backups and monitoring is part of any good WordPress maintenance.

---

Want the right update strategy for your site, with the right guardrails? Drop us a line – we set up auto-updates where they run safely, and secure the rest.