WordPress Automatic Updates – What they are, and what they do

Computer Illustration of an update loading
License: Adobe Stock

Table of Contents

This article is quite long. Here is a table of contents to jump to your favorite section.


Definitions

Blah blah blah blah blah blah.
Definitions – License: Adobe Stock

Let’s get some boring definitions out of the way before we get to the meat of the article (skip to introduction).

Minor Releases

This is when WordPress updates from say 5.6.1 to 5.6.2.

Minor releases contain security updates, bug fixes, and general maintenance. This is a low-risk release, so it’s always advisable to keep your minor versions of WordPress up-to-date.

Automatic Updates

When WordPress, its plugins, its themes, or its language packs are updated behind-the-scenes without any user action.

Manual Updates

When you manually update WordPress, plugins, and themes on the updates screen, plugin screen, and theme screen.

Major Releases

This is when WordPress updates from say 5.5 to 5.6. A major point release is considered a major release.

Core Updates

Core updates are simply another way of saying, WordPress updates. Core in this case is referring to the fact that the update involves only WordPress core code and files.

Plugin Updates

You likely have about a dozen or so plugins on your site. Everytime a plugin releases a new version, you are alerted and can perform the plugin update.

Theme Updates

Keeping a theme up-to-date is important, but theme updates typically refer to when a WordPress theme requires an update.

Translation Updates

Language packs help translate WordPress Core, and WordPress plugins and themes. These are released on an unpredictable schedule (usually when a language pack is complete) and are typically auto-updated behind the scenes.

Introduction

Cloud Updating Everything
License: Adobe Stock

WordPress Automatic Updates have been around since WordPress 3.7. The goal was to automatically update minor point releases of WordPress as they often include maintenance and security fixes.

Security updates for WordPress plugins and themes came next.

In the event of a security flaw, the WordPress security, plugin, and theme teams can push an update to a WordPress site to ensure everything is up-to-date and secure. The most recent memory of Core forcing an update is a vulnerability affecting the popular Yoast SEO plugin.

Automatic Update Vision

Part of the vision for WordPress, and automatic updates in general, is to:

  • Allow opt-in to WordPress plugin and theme automatic updates.
  • Allow opt-in to WordPress Core automatic updates.

With WordPress 5.5, automatic updates for plugins and themes became a reality inside Core.

However, the implementation (in my opinion) was a bit short-sighted and didn’t include support for third-party plugins and themes.

Third-party plugin and theme shops had to opt-in via code in order to utilize automatic updates with their tools.

But progress has been made. More plugins and themes are embracing automatic updates.

As of WordPress 5.6, automatic updates for Major Releases of WordPress are included as shown in the screenshot below.

WordPress Automatic Updates Screen
WordPress Core Auto-updates Screen

I personally believe that automatic updates are the future of WordPress and will get rid of many pain-points from an agency/client perspective. However, with automatic updates comes several reservations:

  1. What happens when a bad actor releases an auto-update?
  2. How are backups taken into account?
  3. Is there a rollback feature for critical error updates?
  4. What control over updates is left up to the site admin (or agency)?
  5. What if the installation breaks from an update? Who is responsible?

The Current State of Automatic Updates in WordPress

Gavel near a laptop
License: Adobe Stock

WordPress automatic updates have landed in Core (in WordPress 5.5) in a mostly complete feature state with room for iteration.

I’ve been in the auto-updates game for a while now. I began my journey with Matthew Sparrow when I began collaborating with him on an auto-updates plugin renamed Easy Updates Manager. It went from a respectful 10,000 installs to over 300,000 as of this writing.

From my perspective and the 300,000 users on Easy Updates Manager, users want a quick and easy way to control automatic updates without relying on a third-party service. Sure, it would be nice to have a SaaS to control updates, and several services are available, but for the most part, users want to control:

  1. Which plugins or themes update and at what time.
  2. Hide updates for certain plugins or themes (a modified .org plugin or theme).
  3. Block updates or delay automatic updates for certain bad actors who release subpar quality releases periodically.
  4. Enable Core automatic updates.
  5. Control translation updates.
  6. The ability to rollback updates that break the site or functionality.
  7. Comprehensive update logs of what occurred.
  8. Control over email notifications.
  9. Add notes to plugins or themes.
  10. And allow third-party plugins/themes to automatically update.

If you’ve read the above list carefully, out-of-the-box, WordPress Core only allows opt-in to plugin, theme, and core updates. The rest are plugin territory typically.

For the immediate future, automatic updates in WordPress are pretty much done in concept. Users will always demand more features, such as rollback, but I believe such features should stick to plugin territory.
Click to Share

Automatic Updates Reception

Empty Jury Box
License: Adobe Stock

With my background with Easy Updates Manager, I’m used to the criticisms that automatic updates entail.

The majority of the users in my experience just want to turn automatic updates on and let the site chug along without having to log-in every time an update is released.
Click to Share

WordPress has a gigantic market sure, controlling over 40% of all websites as of this writing. Having automatic updates on millions of sites is a nice thought.

There are varying critiques, however.

The Benefits

The benefits of automatic updates are obvious. Well, to me at least. You enable automatic updates, and never again have to worry about what version or patch is available. You’re relying on everything working perfectly.

As WordFence puts it:

Rather than having to log in to your WordPress site regularly to perform required plugin and theme updates, your site will run “unattended” updates when updates to installed plugins and themes are made available within the WordPress repository.

WordFence

But things are far from perfect.

The Drawbacks

An update can crash your site, plain and simple. If you manage a site for a client, expect a frantic wake-up-call that the site is down and there’s hardly any way to track which update broke what.

If the site is down for a while, say over 4 hours, that could be a lot of lost income if you’re running an e-commerce site for example.

Most WordPress maintenance experts advise you to update your sites in a staging environment after a backup has taken place, and then to finally update the plugins in production after testing extensively.

As ThriveWP puts it in regards to updates:

The issue with this new feature is that it’s all or nothing – you either opt to update your plugins and themes automatically, or you don’t. This is an issue for many users because it doesn’t come with the human touch, manual testing & visual regression testing to ensure an update runs well and that nothing breaks on your website. Blindly setting things to auto-update could actually be very damaging to your website and business’s reputation.

The main issue here is that most WordPress users don’t have the knowledge or experience to know when a plugin or theme could be safely set to auto-update or what compatibility issue might arise from this and how to fix it.

ThriveWP

Critical Site Failures

WordPress Core now has a critical failure notification as well as a recovery mode. If your site has a critical error, the admin of the site is notified, and a recovery mode is available to fix any problem plugins or themes.

One plan discussed amongst the Core automatic updates team is to allow rollback of assets that break a site. However, this can be problematic if another plugin relies on the broken one, and will break further if rolled back.

After Update Updates

Some plugin updates include things such as option migrations, database updates, and even new configurations that are required. With automatic updates, a site maintainer will now only rarely log into the back-end and will rely on email notifications to tell if a site is still working as intended.

Plugin or theme authors need a way to run their scripts in a non-obtrusive manner to safely update a site. Should these be automated? Should the plugin email the site owner after an update to ensure things have gone well? It’s all still up in the air.

Backups, Backups, and Backups

To ensure that automatic updates are foolproof, the site owner should backup periodically. Hosts can help with the backups, but there should ideally by an easy way to restore a backup should an update break a site.

When it comes to automatic updates, there are several types of updates. I will go over the different types of updates and how they relate to your WordPress install.

A Quick Note About Semantic Versioning and Updates

Software versioning
License: Adobe Stock

Semantic versioning is a goal to strive for when releasing software.

For example, going from 1.0.0 to 2.0.0 is considered a backward-incompatible change. A backward compatible release would be going from version 1.0.0 to 1.0.1.

A backwards compatible release that introduces features would be 1.1, 1.2, 1.3, etc.

WordPress updates do not necessarily follow semantic versioning. The popularity of WordPress is that it strives to maintain backward compatibility. Yes, certain features of WordPress are deprecated with each release, but for the most part, what worked 3 years ago will still work today.
Click to Share

When it comes to plugins or themes for WordPress, some follow semantic versioning. It’s up to the individual plugin or theme author to decide which versions introduce new features and which break some form of compatibility.

WordPress updates typically follow this versioning paradigm.

Backwards CompatibilityChangesTypeVersion
Some functionality deprecatedNew features and bug fixesMajor5.5, 5.6, 5.7
Generally always backwards compatibleSecurity, maintenance, and bug fixesMinor5.5.1, 5.5.2, 5.5.3
Minor and Major WordPress Releases

WordPress Core Updates

There are two types of WordPress core updates:

  • Major releases
  • Minor releases

Major Releases

Major releases are considered point releases. Point releases in WordPress land are when WordPress goes from, for example, 4.9 to 5.0.

Another example is going from version 5.5 to 5.6. These are considered major releases as a lot goes into a major point release.

Major releases introduce new functionality and are often well-tested and vetted releases. However, no major release is perfect, which is why there are minor releases.

By default, these releases are not auto-updated.

With managed hosts, these major releases are usually tested before rolling these out to customers.

Minor Releases

Minor releases are releases between each major release and often have bug and security fixes. An example is WordPress 5.5, which is a major release. If 5.5.1, 5.5.2, or 5.5.3 releases, these are considered minor releases.

Minor releases are auto-updated unless a user or host disables these. Minor releases are more important than major releases as they often contain fixes in-between major releases.

Plugin Updates

Plugin updates and semantic versioning are usually the wild-west. Some plugins follow semantic versioning, while others treat version numbers rather arbitrarily.

It is a good practice to keep your plugins up-to-date, especially in the age of Gutenberg where changes happen rapidly.

Theme Updates

Themes hosted on the WordPress Theme Directory are released periodically and are not auto-updated automatically.

Since themes can be updated automatically, it is highly recommended to use a child theme so that your changes are not lost upon a theme update.

Translation Updates

Translation updates are typically auto-updated.

. └── wordpress/ └── wp-content/ └── languages/ ├── es_ES.mo ├── plugins/ │ └── advanced-custom-fields-es_ES.mo └── themes/ └── twentyfifteen-es_ES.mo

Translations hosted by the WordPress Directory follow the structure above. Core WordPress translations are stored in a languages folder inside wp-content.

Plugin and theme translations are stored in a plugins and themes folder respectively.

Third-party plugin and theme translations usually are included within a languages folder defined by the individual third-party plugin and theme.

Third-party Plugins

Third-party plugins are plugins not hosted by the WordPress Plugin Directory. Some call these premium plugins, but I prefer to call them third-party plugins.

Third-party plugins usually include some type of license to ensure the update can be applied manually or via automatic update.

Third-party plugins typically are not auto-updated unless the plugin has its own auto-update mechanism. Plugins such as Gravity Forms and Rankmath allow for automatic updates within their options.
Click to Share

Third-party Themes

Also known as premium themes, these are also not auto-updated by default. Many third-party themes do include some type of auto-update mechanism built into their theme.

Like third-party plugins, these require some type of license in order for users to update their themes.

As with themes hosted on the WordPress Theme Directory, it is important to use a child theme so that your changes are not lost in-between updates.


Let’s take a breath before getting into code. What follows is a more technical overview of automatic updates and is geared towards developers. I recommend a quick read-through even if you are not tech-savvy.


WordPress Auto-Update Constants

Cloud computing
License: Adobe Stock

WordPress has several constants in regards to automatic updates. I will go over the various constants and what they are used for. Most of these constants can be placed in wp-config.php. If that is unavailable, you can always create an mu-plugin to place the constants in. Just be sure to check that they are defined first.

AUTOMATIC_UPDATER_DISABLED

The AUTOMATIC_UPDATER_DISABLED constant allows you to blanket disable automatic updates.

For example, this will disable automatic updates for the entire WordPress install:

if ( ! defined( 'AUTOMATIC_UPDATER_DISABLED' ) ) { define( 'AUTOMATIC_UPDATER_DISABLED', true ); }
Code language: PHP (php)

If the constant is set, you are still able to override it via a filter, as defined below:

/** * Filters whether to entirely disable background updates. * * There are more fine-grained filters and controls for selective disabling. * This filter parallels the AUTOMATIC_UPDATER_DISABLED constant in name. * * This also disables update notification emails. That may change in the future. * * @since 3.7.0 * * @param bool $disabled Whether the updater should be disabled. */ return apply_filters( 'automatic_updater_disabled', $disabled );
Code language: PHP (php)

WP_AUTO_UPDATE_CORE

The WP_AUTO_UPDATE_CORE constant allows you to fine-tune how core WordPress updates are handled.

It takes the following values:

  • true (turns on automatic updates for WordPress core)
  • beta (turns on automatic updates for beta releases)
  • rc (turns on automatic updates for Release Candidates)
  • minor (turns on automatic updates for minor releases)
  • false (disables automatic updates for WordPress core)

Passing true will allow automatic updates for your WordPress install. Passing false will do the opposite, which will disable core automatic updates.

The value beta will allow beta automatic updates. The rc value will automatically update to release candidate releases. And minor will only allow automatic updates for minor releases.

DISALLOW_FILE_MODS

Disallowing file modifications can be set to defining DISALLOW_FILE_MODS to false. This will disable any kind of update to your WordPress install, including manual updates.

Usage of this constant is not recommended as it prevents your WordPress install from being updated.

Automatic Update Filters

Filtered Light
License: Adobe Stock

In regards to WordPress and automatic updates, there are several filters you can take advantage of to control automatic updates.

This section will go over the various filters, what they do, and how to code them out. I will attempt to list all the import ones.

automatic_updater_disabled

This filter determines if WordPress automatic updates are disabled or enabled.

The filter automatic_updater_disabled can override the WordPress constant AUTOMATIC_UPDATER_DISABLED.

Here’s the docblock for the automatic_updater_disabled filter.

/** * Filters whether to entirely disable background updates. * * There are more fine-grained filters and controls for selective disabling. * This filter parallels the AUTOMATIC_UPDATER_DISABLED constant in name. * * This also disables update notification emails. That may change in the future. * * @since 3.7.0 * * @param bool $disabled Whether the updater should be disabled. */ return apply_filters( 'automatic_updater_disabled', $disabled );
Code language: PHP (php)

If you were to want to allow automatic updates, you would use the following code:

// Allow automatic updates. add_filter( 'automatic_updater_disabled', '__return_false' );
Code language: PHP (php)

The filter above won’t necessarily enable automatic updates for the WordPress installation, but it does allow the capability for it.

To disable automatic updates completely, you would use the following code:

// Disallow automatic updates. add_filter( 'automatic_updater_disabled', '__return_true' );
Code language: PHP (php)

auto_update_core

This filter determines whether you’d like to automatically update WordPress core when a release is pending.

add_filter( 'auto_update_core', '__return_true' ); // Automatically update all the WP releases. add_filter( 'auto_update_core', '__return_false' ); // Prevents automatic updates for core WP releases.
Code language: PHP (php)

auto_update_theme

Using this filter, you can determine if a theme update should occur. For those using child-themes, it’s fine to automatically update the parent theme. However, if you are stuck on a customized parent theme, you can disable automatic updates for your particular theme.

add_filter( 'auto_update_theme', '__return_true' ); // Automatically update all themes. add_filter( 'auto_update_theme', '__return_false' ); // Prevents automatic updates for all themes.
Code language: PHP (php)

The following demonstrates on how you can prevent theme updates from the Divi theme.

// Demonstrates removing automatic updates from the Divi Theme. add_filter( 'auto_update_theme', 'prevent_divi_updates', 10, 2 ); function prevent_divi_updates( $update, $item ) { if ( $item->slug === "divi" ) { return false; } return $update; }
Code language: PHP (php)

Auto_Update_Plugin

This powerful filter will signal to WordPress whether a plugin should auto-update. With some sites having over a few dozen plugins just to power a simple membership website, it’s very handy to not have to worry about those updates anymore.

Here is an example of enabling automatic updates for all plugins.

add_filter( 'auto_update_plugin', '__return_true' ); // Automatically update all plugins.
Code language: PHP (php)
add_filter( 'auto_update_plugin', '__return_false' ); // Prevent automatic updates for all plugins.
Code language: PHP (php)

And for kicks, I’ll pick on Yoast SEO.

// Demonstrates removing automatic updates from the Yoast plugin. add_filter( 'auto_update_plugin', 'prevent_plugin_updates', 10, 2 ); function prevent_plugin_updates( $update, $item ) { if ( $item->slug === "wordpress-seo" ) { return false; } return $update; }
Code language: PHP (php)

auto_update_translation

This is the same template as above. You can return true or false determining whether translations should automatically update.

add_filter( 'auto_update_translation', '__return_false' ); // Prevent automatic updates for all translations.
Code language: PHP (php)
add_filter( 'auto_update_translation', '__return_true' ); // Enable automatic updates for all translations.
Code language: PHP (php)

The example below demonstrates how to turn translations off for a particular plugin or theme.

<?php /** * Prevent translation updates for the Spanish locale for the Akismet plugin and Memberlite theme. * * @param bool $update Whether to automatically upgrade. * @param object $item Update item. */ function custom_maybe_update_translations( $update, $item ) { if ( isset( $item->slug ) && isset( $item->language ) ) { // Plugin translations off for Akismet. if ( 'akismet' === $item->slug && 'es_ES' === $item->language ) { return false; } // Theme translation for the Memberlite theme. if ( 'memberlite' === $item->slug && 'es_ES' === $item->language ) { return false; } } return $update; } add_filter( 'auto_update_translation', 'custom_maybe_update_translations', 10, 2 );
Code language: PHP (php)

allow_dev_auto_core_updates

The allow_dev_auto_core_updates filter is an off/on switch and determines if the WordPress install should be auto-updated to the development version of WordPress. You’ll need to be on a development version for this filter to be useful.

If you are on a development version of WordPress, these filters will execute when there is a development Core update.

add_filter( 'allow_dev_auto_core_updates', '__return_false' ); // Prevent automatic development updates.
Code language: PHP (php)
add_filter( 'allow_dev_auto_core_updates', '__return_true' ); // Allow automatic development updates.
Code language: JavaScript (javascript)

allow_major_auto_core_updates

The filter allow_major_auto_core_updates is an off/on switch and lets WordPress know you intend to auto-update core.

add_filter( 'allow_major_auto_core_updates', '__return_false' ); // Prevent automatic major Core updates.
Code language: PHP (php)
add_filter( 'allow_major_auto_core_updates', '__return_true' ); // Allow automatic major Core updates.
Code language: PHP (php)

allow_minor_auto_core_updates

This filter allow_minor_auto_core_updates will allow minor versions (e.g., 5.6.1 to 5.6.2) to automatically update.

add_filter( 'allow_minor_auto_core_updates', '__return_false' ); // Prevent automatic minor Core updates.
Code language: PHP (php)
add_filter( 'allow_minor_auto_core_updates', '__return_true' ); // Allow automatic minor Core updates.
Code language: PHP (php)

automatic_updates_is_vcs_checkout

The automatic_updates_is_vcs_checkout filter will prevent updates if enabled. This indicates to WordPress that your site is under version control and should not be updated.

Based on my experience, this disables automatic updates if set to true.

add_filter( 'automatic_updates_is_vcs_checkout', '__return_true' ); // Inform WordPress the site is under version control.
Code language: PHP (php)

auto_core_update_send_email

This filter controls whether core will send you an update when updated. In the example below, we’re going to disable all emails unless a Core update fails.

<?php /** * Filters whether to send an email following an automatic background core update. * * @since 3.7.0 * * @param bool $send Whether to send the email. Default true. * @param string $type The type of email to send. Can be one of * 'success', 'fail', 'critical'. * @param object $core_update The update offer that was attempted. * @param mixed $result The result for the core update. Can be WP_Error. */ function custom_maybe_send_core_email( $send, $type, $core_update, $result ) { // Only send failure emails. if ( 'fail' === $type ) { return true; } return false; } add_filter( 'auto_core_update_send_email', 'custom_maybe_send_core_email', 10, 4 );
Code language: PHP (php)

auto_core_update_email

After Core has completed an update, you can modify the contents of the email. Please see the doc block below.

/** * Filters the email sent following an automatic background core update. * * @since 3.7.0 * * @param array $email { * Array of email arguments that will be passed to wp_mail(). * * @type string $to The email recipient. An array of emails * can be returned, as handled by wp_mail(). * @type string $subject The email's subject. * @type string $body The email message body. * @type string $headers Any email headers, defaults to no headers. * } * @param string $type The type of email being sent. Can be one of * 'success', 'fail', 'manual', 'critical'. * @param object $core_update The update offer that was attempted. * @param mixed $result The result for the core update. Can be WP_Error. */ $email = apply_filters( 'auto_core_update_email', $email, $type, $core_update, $result );
Code language: PHP (php)

Here’s an example of changing the email address Core update notifications are sent to.

function custom_core_update_email( $email, $type, $core_update, $result ) { // Send to IT department if updates fail. if ( 'fail' === $type ) { $email['to'] = '[email protected]'; } return $email; } add_filter( 'auto_core_update_email', 'custom_core_update_email', 10, 4 );
Code language: PHP (php)

auto_plugin_update_send_email

Whether to notify the site owner if a plugin update has occurred.

The docblock within WordPress is shown below.

/** * Filters whether to send an email following an automatic background plugin update. * * @since 5.5.0 * @since 5.5.1 Added the `$update_results` parameter. * * @param bool $enabled True if plugin update notifications are enabled, false otherwise. * @param array $update_results The results of plugins update tasks. */ $notifications_enabled = apply_filters( 'auto_plugin_update_send_email', true, $update_results['plugin'] );
Code language: PHP (php)

Here’s an example of turning these notifications off.

add_filter( 'auto_plugin_update_send_email', '__return_false' );
Code language: PHP (php)

auto_theme_update_send_email

Whether to send updates when a theme automatic upgrade occurs.

The docblock for the filter is below.

/** * Filters whether to send an email following an automatic background theme update. * * @since 5.5.0 * @since 5.5.1 Added the `$update_results` parameter. * * @param bool $enabled True if theme update notifications are enabled, false otherwise. * @param array $update_results The results of theme update tasks. */ $notifications_enabled = apply_filters( 'auto_theme_update_send_email', true, $update_results['theme'] );
Code language: PHP (php)

An example of turning these notifications off is below.

add_filter( 'auto_theme_update_send_email', '__return_false' );
Code language: JavaScript (javascript)

auto_plugin_theme_update_email

The auto_plugin_theme_update_email filter allows you to modify the email that is sent for automatic upgrades for plugins and themes. You can easily override the email being sent using this filter.

Here’s a docblock below to help clear up what this filter does.

/** * Filters the email sent following an automatic background update for plugins and themes. * * @since 5.5.0 * * @param array $email { * Array of email arguments that will be passed to wp_mail(). * * @type string $to The email recipient. An array of emails * can be returned, as handled by wp_mail(). * @type string $subject The email's subject. * @type string $body The email message body. * @type string $headers Any email headers, defaults to no headers. * } * @param string $type The type of email being sent. Can be one of 'success', 'fail', 'mixed'. * @param array $successful_updates A list of updates that succeeded. * @param array $failed_updates A list of updates that failed. */ $email = apply_filters( 'auto_plugin_theme_update_email', $email, $type, $successful_updates, $failed_updates );
Code language: PHP (php)

And here’s an example of sending failure emails to someone in the IT department.

function custom_plugin_theme_email( $email, $type, $successful_updates, $failed_updates ) { // Send to IT department if updates fail. if ( 'fail' === $type ) { $email['to'] = '[email protected]'; } return $email; } add_filter( 'auto_plugin_theme_update_email', 'custom_plugin_theme_email', 10, 4 );
Code language: PHP (php)

automatic_updates_debug_email

The automatic_updates_debug_email typically sends an email after each automatic update process. If you have automatic updates enabled, you’ll likely receive a “Debugging?” email. To disable these types of emails, use the following:

add_filter( 'automatic_updates_debug_email', '__return_false' );
Code language: PHP (php)

send_core_update_notification_email

This filter determines if an admin should be alerted when there is a new WordPress version available for update. You can disable this below:

add_filter( 'send_core_update_notification_email', '__return_false' );
Code language: PHP (php)

Let’s take another quick break as there were a ton of filters to go through. If you’re feeling a bit overwhelmed, don’t stress as we covered a lot of material in a short timeframe.

Up next are the common actions used by the Auto Update mechanism within WordPress.


Automatic Update Actions

clear hour glass with brown frame
Photo by NeONBRAND on Unsplash

In regards to WordPress and automatic updates, there are several actions you can take advantage of during the automatic update process.

Unlike filters, there is no possibility of modifying the output. Actions are executed at a certain point in time. This section will go over several action hooks that can help you supercharge WordPress updates.

pre_auto_update

Whenever Core, Plugin, Themes, of Translations are auto-updated, the pre_auto_update action is run. This action is very useful if you are wanting to determine programmatically what to do with an update prior to automatically updating. This can be useful for logging.

You can then log those actions in a transient and log the “Version From” and also the “Version To.”

Here’s the docblock for pre_auto_update.

/** * Fires immediately prior to an auto-update. * * @since 4.4.0 * * @param string $type The type of update being checked: 'core', 'theme', 'plugin', or 'translation'. * @param object $item The update offer. * @param string $context The filesystem context (a path) against which filesystem access and status * should be checked. */ do_action( 'pre_auto_update', $type, $item, $context );
Code language: PHP (php)

A code example of utilizing pre_auto_update is a deep rabbit hole, but I just wanted to make you aware of the possibility of update logging using this action.

automatic_updates_complete

This action runs after all automatic updates are complete. Here is the docblock for the action.

/** * Fires after all automatic updates have run. * * @since 3.8.0 * * @param array $update_results The results of all attempted updates. */ do_action( 'automatic_updates_complete', $this->update_results );
Code language: PHP (php)

Use-cases can be logging, or running cleanup or migration with your own plugin (database updates, data migrations).

Here’s an example of triggering a translation update, which I’ve found doesn’t always run when the automatic_updates_complete action is triggered.

function custom_update_translations( $update_results ) { $language_updates = wp_get_translation_updates(); if ( ! $language_updates ) { return; } ob_start(); // Prevent output. $language_pack = new Language_Pack_Upgrader(); $language_pack->bulk_upgrade( $language_updates ); ob_end_clean(); // Clear output. } add_action( 'automatic_updates_complete', 'custom_update_translations' );
Code language: PHP (php)

An example of running a core/plugin/theme/translation action is shown below.

<?php function custom_auto_update_complete( $update_results ) { if ( empty( $update_results ) ) { return; } foreach ( $update_results as $type => $results ) { switch ( $type ) { case 'core': // Perform Core update actions. break; case 'plugin': // Perform plugin actions here. break; case 'theme': // Perform theme actions here. break; case 'translation': // Perform translation actions here. break; } } } add_action( 'automatic_updates_complete', 'custom_update_translations' );
Code language: PHP (php)

Controlling Auto-Updates using WordPress’ Built-in Update Mechanism

Wordpress text
Photo by Launchpresso on Unsplash

WordPress updates (as of 5.6) are mostly feature complete, with the rest being delegated to plugins for the time being.

I encourage you to read the official documentation as a starting point.

Auto-Updating Plugins

At the time of this writing I am using a 5.7 beta.

On the plugins screen, you can use bulk-actions to auto-update plugins or use the Automatic Updates column to quickly enable or disable auto-updates for a particular plugin.

Automatic Updates Plugins Screen
Automatic Updates Plugins Screen

If you were to enable automatic updates for a particular plugin, you’ll also see the update schedule for the item.

Automatic Plugin Update Schedule
Automatic Plugin Update Schedule

Theme Updates

Theme updates have a different interface, but behave the same as plugins when it comes to updating.

Theme Auto Updates
Theme Auto Updates

You’ll have to click into each theme that requires an update, but this isn’t a huge dealbreaker. Ideally you should only have a parent theme and child-theme installed. The child-theme shouldn’t be auto-updated, but the parent theme definitely should if you want to put your site on cruise control.

Core Updates

Core updates can be enabled so that you’ll have the opportunity to automatically WordPress Core (i.e., your WordPress install).

Core Automatic Updates Screen
Core Automatic Updates Screen

If you enable automatic updates for Core, it’ll include minor and major releases.

You can easily disable it to return to default WordPress behavior: minor releases which include maintenance and security updates.

Third-Party Plugins/Themes

Third-party plugin and themes will need to opt-in so that automatic updates are handled by WordPress.

There are more details in the official documentation for third-party plugins and themes.

A Quick Note About Cron

The WordPress Cron process for auto-updates is controlled by three hooks:

  1. wp_update_themes
  2. wp_update_plugins
  3. wp_version_check

If you use a plugin like WP Crontrol, you can peak into when the updates will occur.

Here’s a screenshot of the schedule for the Cron hooks mentioned above.

Cron Version Checks
Cron Version Checks

WordPress updates are typically run every 12 hours (twice a day). With certain update plugins, you can modify these Cron schedules.

It’s also possible to disable WordPress’ Cron and control your updates via a crontab, but that is a semi-advanced topic and will not be covered in this article to save some sanity (on your and my end).

No-Code Update Plugins

If messing with code, Cron, and the other intricacies of WordPress Auto-Updating is overwhelming, I recommend a helper plugin that’ll help you with your updates.

There are two that I’ll cover: Companion Auto Update and Easy Updates Manager.

Companion Auto Update

Companion Auto Update is the closest thing to an actual official add-on for WordPress’ native automatic update mechanism. The plugin does, however, prevent the Auto Update column from showing on the plugin’s page. This is a nice touch to ensure that you control the updates in one place (via the plugin).

The admin screen is intuitive and easy to configure.

Companion Auto Update Admin Screenshot
Companion Auto Update Admin Screenshot

As you can see from the above screenshot, you can disable/enable updates with a few clicks, configure email routing, and view a quick log overview of your updates.

The one thing I dislike about the plugin is the logging feature. In my experience, users want to know when an auto-update occurred and if it is pass/fail.

The plugin is a good shot at extending native WordPress updates. If you want an update plugin that gets out of your way, Companion Auto Update is a great fit. Plus, the documentation is fantastic.

Companion Auto Update is looking for funding and volunteers to help with the plugin last I checked. If that is your cup of tea, please get into contact with the developer.

Easy Updates Manager

This plugin is an update powerhouse and does not use core WordPress Auto-Update functionality.

As a disclosure, I used to be heavily involved with Easy Updates Manager, so I have a soft spot for the plugin.

If you activate the plugin, it leaves a note in the plugin and theme’s area that updates are controlled by Easy Updates Manager.

EUM Auto Updates Column
EUM Auto Updates Column

As far as the admin interface, it’s not as pretty as Companion Auto Update, but it’s possible to enable or disable updates in one click in their Dashboard.

Easy Updates Manager Admin Screen
Easy Updates Manager Admin Screen

In addition to the main dashboard screen, EUM provides detailed logs and basic email routing.

The plugin has been sparsely updated, but that’s mostly due to lack of financial support for the plugin.

They do have a premium version that costs $89 a year for unlimited sites, which to me is a no-brainer purchase if you use it on multiple sites. I wrote about the premium offering on this site.

Like Companion Auto Update, the documentation for Easy Updates Manager is fairly well done.

Troubleshooting Automatic Updates

Automatic Updates are typically a marriage between Core or third-party update offerings and the hosts they are running on.

Before contacting your host, there are several things you can try.

Check wp-config

Configuring your wp-config.php file is dangerous, but I recommend a glance at it to ensure that it is not blocking auto-updates via that file.

Check to see if the constant AUTOMATIC_UPDATER_DISABLED is set to true. If so, then automatic updates are blocked by the host. I recommend contacting them to remove the constant.

One other check in wp-config is to see if the WordPress cron has been disabled. Check for the constant DISABLE_WP_CRON. If it set to true, updates relying on the WordPress cron will not run.

Check Your Cron Processes

Using WP-Crontrol, check the three major cron processes for updates: wp_version_check, wp_update_plugins, and wp_update_themes.

Each of these hooks have a valid callback. If wp_version_check and its callback are disabled, this effectively blocks automatic updates.

Disabling wp_version_check is usually done by the host, so again, I’d contact them if you see this problem.

Check Site Health

You’ll find this under Tools->Site Health in the WordPress admin. You’re specifically looking for passed tests for:

  • Scheduled Events
  • Plugin and Theme auto-updates
  • Communication with WordPress.org
  • Background Updates

If all of those are working correctly, your updates should be good to go.

A Note About Third-party Plugins and Themes

Even if you enable updates for a third-party plugin or theme, this doesn’t mean these assets will auto-update.

I’ve seen plenty of third-party offerings that roll their own auto-update mechanism. These may or may not work with native WordPress auto-updates. If a plugin or theme from a third-party doesn’t auto-update, you’ll have to contact the companies behind the theme or plugin.

Automatic Update Recipes

In this last section, I’ll go over some common recipes you can perform on your site without relying on an update plugin.

Disable Update Notification Emails

The following will disable all update notification-related emails:

// Disable core update emails. We'll be sending our own. add_filter( 'auto_core_update_send_email', '__return_false', 10 ); add_filter( 'send_core_update_notification_email', '__return_false', 10 ); add_filter( 'automatic_updates_send_debug_email', '__return_false', 10 ); add_filter( 'auto_theme_update_send_email', '__return_false', 10 ); add_filter( 'auto_plugin_update_send_email', '__return_false', 10 );
Code language: PHP (php)

Hide the Automatic Updates Update Panel

Do you want to hide the automatic updates column on the plugins and themes area? This one will do the trick, albeit a bit hacky.

/** * Remove the auto-update columns on the appropriate screens. */ class Remove_Auto_Update_Columns { /** * Class runner. */ public function __construct() { add_action( 'current_screen', array( $this, 'maybe_remove_update_columns' ), 100 ); } /** * Force remove the auto-updates interface on certain screens. */ public function maybe_remove_update_columns() { // Double-checking we're in the admin. if ( ! is_admin() ) { return; } // Skip on Ajax and Cron requests. if ( ( defined( 'DOING_AJAX' ) && DOING_AJAX ) || ( defined( 'DOING_CRON' ) && DOING_CRON ) ) { return; } // Try to get the current screen. $screen = get_current_screen(); if ( ! isset( $screen->id ) ) { return; } // Force remove the auto-updates interface on certain screens. // todo - get all the multisite screens. switch ( $screen->id ) { case 'site-themes-network': case 'plugins': case 'themes': case 'site-health': add_filter( 'plugins_auto_update_enabled', '__return_false' ); add_filter( 'themes_auto_update_enabled', '__return_false' ); break; } } } new Remove_Auto_Update_Columns();
Code language: PHP (php)

Hide the Autoupdate Notice on the Updates Screen

This one is currently only targetable via CSS.

.auto-update-status { display: none; }
Code language: CSS (css)

Force the Automatic Update Cron Attached to another Cron Process

This one is just in case your host has disabled wp_version_check and you can latch the actions onto another cron process.

<?php /* Enable auto-updates of plugins/themes with cron */ add_action( 'wp_update_plugins', function() { if ( wp_doing_cron() && ! doing_action( 'wp_maybe_auto_update' ) ) { do_action( 'wp_maybe_auto_update' ); } }, 20 );
Code language: PHP (php)

Disable Auto Updates

The following will disable auto updates period.

add_filter( 'automatic_updater_disabled', '__return_true' ); add_filter( 'auto_update_core', '__return_false' ); add_filter( 'auto_update_plugin', '__return_false' ); add_filter( 'auto_update_theme', '__return_false' ); add_filter( 'auto_update_theme', '__return_false' ); add_filter( 'auto_update_translation', '__return_false' );
Code language: PHP (php)

Wrapping Up

We covered a ton in this article, and I still feel like we barely scratched the surface. Automatic updates can be a complicated affair.

Hopefully you can walk away from this article with a better understanding of automatic updates and their possibilities.

If you have any thoughts or questions, comments are welcome. You can also reach out on Twitter.

Ronald Huereca
Ronald Huereca

Ronald Huereca

Ronald has been part of the WordPress community since 2006, starting off writing and eventually diving into WordPress plugin development and writing tutorials and opinionated pieces.

No stranger to controversy and opinionated takes on tough topics, Ronald writes honestly when he covers a topic.

1 thought on “WordPress Automatic Updates – What they are, and what they do”

  1. This is amazing tutorial on automatic updates. You can correct following mistake in one example
    where action is:
    add_action( ‘automatic_updates_complete’, ‘custom_update_translations’ );
    but callback is:
    ‘custom_auto_update_complete’ instead of ‘custom_update_translations’

    Reply

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Ronald Huereca
MediaRon - Ronald Huereca

Ronald created MediaRon in 2011 and has more than fifteen years of releasing free and paid WordPress plugins.