WordPress can update plugins, themes and core automatically. Updates matter: most hacked sites we clean up were running outdated software. But most broken sites we fix were broken by an update. So should you turn auto-updates on? Here is how we decide.
The short answer
- Minor core updates (security releases): yes. They are on by default and rarely cause problems.
- Small sites with a few well-maintained plugins: auto-updates are reasonable, as long as you have daily backups and check the site regularly.
- Business-critical sites (stores, forms, memberships, booking): no. Test updates on staging first, then apply them to the live site.
Why updates break sites
- Major version changes in a plugin that rename settings or drop features.
- Conflicts between a newly updated plugin and another plugin or your theme.
- Old sites where years of skipped updates are applied all at once.
- PHP compatibility, when a plugin update requires a newer PHP version than your server has.
WordPress has some protection. Since version 5.2, if an update causes a fatal error, recovery mode pauses the faulty plugin and emails you. Since 6.6, WordPress also rolls back a plugin auto-update automatically if it causes a fatal error. That stops the worst failures, but it does not catch a checkout that quietly stopped working or a layout that broke.
How to turn auto-updates on or off
Plugins
Go to Plugins → Installed Plugins. Each plugin has an “Enable auto-updates” link in the Automatic Updates column. Use the bulk actions menu to change many at once.
Themes
Go to Appearance → Themes, click a theme, and choose “Enable auto-updates.”
WordPress core
Go to Dashboard → Updates. You can choose to keep only maintenance and security releases automatic (the default) or include all new versions.
What about host auto-updates?
Many managed hosts offer their own update tools. The better ones run updates, compare before-and-after screenshots, and roll back if something looks different. That is a good middle ground if you manage your own site.
The safer way: staging first
Our process for client sites: back up, run updates on a staging copy, check key pages, forms and checkout, then apply the same updates to the live site. Major updates get extra testing. It takes more time, which is why we do it for you in every Care Plan. See also six habits that prevent most WordPress problems.
If an update already broke your site, our $79 one-time fix gets it working again.