Turn on plugin auto-updates for low risk plugins on sites you can restore quickly, and keep manual, staged updates for anything tied to payments, forms or custom code. Auto-updates close known holes faster, but an unattended bad update can break a client's site overnight.
WordPress core makes this a choice. The core team's 5.5 note says core minor updates apply by default, while plugin and theme auto-updates are disabled by default and an administrator has to enable them.
What the setting does
From WordPress 5.5, the Plugins screen has an Automatic Updates column. Users with the update plugins and update themes capabilities can toggle it per plugin or per theme. On a multisite network, only network administrators can, from the network dashboard. Developers can also use filters to turn auto-updates on for all plugins, or to hide the interface elements.
The core team's note also explains why: keeping WordPress, PHP, and installed plugins and themes up to date is an easy way to protect a site from known security vulnerabilities.
A simple decision guide
| Situation | Suggested choice | Reason |
|---|---|---|
| Brochure site, few plugins, daily backups | Auto-update on | Low blast radius, fast restore |
| Plugin with a long record of small safe releases | Auto-update on | Cost of delay outweighs cost of surprise |
| Checkout, booking or membership plugin | Manual on staging first | A bad update loses money |
| Plugin you customised or that overrides templates | Manual | Updates may overwrite your changes |
| Plugin that is no longer maintained | Replace or remove | Updates will not arrive |
Make the rollback path real
Auto-updates are only safe when you can undo them. Before relying on them, check that backups run before the update window and that you have tested a restore. The WordPress handbook advises backing up before an upgrade and keeping copies in different locations. Pair that with uptime monitoring so a broken page is noticed in minutes, not days.
Keep a record of what changed
Whatever you choose, record it. A short log of "plugin, old version, new version, date" is enough, and it lets you answer the question that always comes after an incident: what changed last?
What auto-updates do not do
They do not tell you whether a vulnerability is exploitable on your site, they do not cover code you installed outside the dashboard, and they do not help with abandoned plugins. Treat them as one layer next to inventory and review.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a known fixed version is surfaced for a vulnerable dependency, which is the same signal that tells you an update is worth applying.
For Composer and npm based projects, Safeguard can open fix pull requests for vulnerable dependencies. That capability is off by default and every category starts on Manual, so you decide what merges.
Quick check
Are WordPress plugin auto-updates on by default?
No. According to the WordPress core team, plugin and theme auto-updates are disabled by default and must be enabled by an administrator.
Do core security updates install on their own?
Core minor releases do by default. The wp-config documentation describes a constant that controls this, with minor releases as the default setting.
Sources
- Controlling plugin and theme auto-updates UI in WordPress 5.5
- Editing wp-config.php
- Backing up your WordPress site
Last reviewed: 19 October 2026.
