Automatic background updates were introduced in WordPress 3.7 in an effort to promote better security, and to streamline the update experience overall. By default, only minor releases – such as for maintenance and security purposes – and translation file updates are enabled on most sites. In special cases, plugins and themes may be updated.
In WordPress, there are four types of automatic background updates:
- Core updates
- Plugin updates
- Theme updates
- Translation file updates
Core updates are subdivided into three types:
- Core development updates, known as the “bleeding edge”
- Minor core updates, such as maintenance and security releases
- Major core release updates
By default, every site has automatic updates enabled for minor core releases and translation files. Sites already running a development version also have automatic updates to further development versions enabled by default.
Automatic updates can be configured using one of two methods: defining constants in
wp-config.php, or adding filters using a Plugin.
Configuration via wp-config.php
wp-config.php, automatic updates can be disabled completely, and core updates can be disabled or configured based on update type.
Constant to Disable All Updates
The core developers made a conscious decision to enable automatic updates for minor releases and translation files out of the box. Going forward, this will be one of the best ways to guarantee your site stays up to date and secure and, as such, disabling these updates is strongly discouraged.
To completely disable all types of automatic updates, core or otherwise, add the following to your
Constant to Configure Core Updates
To enable automatic updates for major releases or development purposes, the place to start is with the
WP_AUTO_UPDATE_CORE constant. Defining this constant one of three ways allows you to blanket-enable, or blanket-disable several types of core updates at once.
WP_AUTO_UPDATE_CORE can be defined with one of three values, each producing a different behavior:
- Value of
true– Development, minor, and major updates are all enabled
- Value of
false– Development, minor, and major updates are all disabled
- Value of
'minor'– Minor updates are enabled, development, and major updates are disabled
Note that only sites already running a development version will receive development updates.
For development sites, the default value of
true. For other sites, the default value of
Configuration via Filters
Using filters allows for fine-tuned control of automatic updates.
The best place to put these filters is in a must-use plugin.
Do not add
add_filter() calls directly in
wp-config.php. WordPress isn’t fully loaded and can cause conflicts with other applications such as WP-CLI.
Disabling All Updates Via Filter
You can also disable all automatic updates using the following filter:
Core Updates via Filter
To enable all core-type updates only, use the following filter:
But let’s say rather than enabling or disabling all three types of core updates, you want to selectively enable or disable them. That’s where the
allow_major_auto_core_updates filters come in.
There are two shorthand functions built into WordPress that will allow you to enable or disable specific types of core updates with single lines of code. They are __return_true and __return_false. Here are some example filters:
To specifically enable them individually (for disabling, use false instead of true):
For Developers: To enable automatic updates even if a VCS folder (.git, .hg, .svn etc) was found in the WordPress directory or any of its parent directories:
Plugin & Theme Updates via Filter
By default, automatic background updates only happen for plugins and themes in special cases, as determined by the WordPress.org API response, which is controlled by the WordPress security team for patching critical vulnerabilities. To enable or disable updates in all cases, you can leverage the
auto_update_$type filter, where
$type would be replaced with “plugin” or “theme”.
Automatic updates for All plugins
Automatic updates for All themes:
You can use
__return_false instead of
__return_true to specifically disable all plugin & theme updates, even forced security pushes from the WordPress security team.
auto_update_$type filters also allow for more fine-grained control, as the specific item to updated is also passed into the filter. If you wanted to enable auto-updates for specific plugins only, then you could use code like this:
Translation Updates via Filter
Automatic translation file updates are already enabled by default, the same as minor core updates.
To disable translation file updates, use the following:
Disable Emails via Filter
This filter can also be used to manipulate update emails according to email $type (success, fail, critical), update type object $core_update, or $result:
- More examples at https://make.wordpress.org/core/2013/10/25/the-definitive-guide-to-disabling-auto-updates-in-wordpress-3-7/
- More information here: http://wordpress.stackexchange.com/questions/120081/how-do-i-configure-automatic-updates-in-wordpress-3-7
- Info about wp-cli conflict: https://github.com/wp-cli/wp-cli/issues/1310