WordPress Auto Update Plugins and Themes: 7 Safe Ways to Enable Them

You probably searched for WordPress auto update plugins and themes because you want fewer pending updates in your dashboard, but you do not want a broken checkout, form, menu, or page layout while you are away.

The short answer: WordPress lets you turn on auto-updates for each plugin and theme. The better answer: turn them on only where the risk is low, and keep a tested backup ready before you trust any site to update itself.

TL;DR: Enable plugin auto-updates from Plugins > Installed Plugins and theme auto-updates from Appearance > Themes > Theme Details. Use auto-updates selectively, and know how to back up your WordPress site first, because WordPress does not choose your maintenance window, test business-critical updates, or catch every broken page.

What WordPress Auto-Updates Do

WordPress plugin and theme auto-updates let selected plugins or themes update without you clicking Update now each time.

They are not the same as broader automatic WordPress updates or WordPress core updates. Plugin and theme auto-update controls were added in WordPress 5.5, and they are opt-in for each plugin or theme unless another tool, host, or custom setting changes that behavior.

WordPress checks for updates on a schedule through WP-Cron, which is WordPress’s built-in task runner. In plain English, it is the system WordPress uses to run timed jobs such as update checks. By default, update checks happen twice a day, so an auto-update may not run the second a new version appears.

Note 🔎: Auto-update does not mean “instant update.” It means WordPress will update the selected item when its scheduled update check runs.

Check This Before You Enable Updates

The toggle is easy. The risk is in what happens after the toggle. Before you enable auto-updates, check these first:

Check	Why it matters
Recent full-site backup	You need a way back if an update breaks the site. A backup plugin or managed backup system should already be running before broad auto-updates are enabled.
Tested restore process	A backup is only useful if you know it restores cleanly.
Business-critical plugins	Checkout, forms, bookings, memberships, logins, and payments need extra care because plugin conflicts can break real workflows.
Theme customizations	Direct edits to theme files can be lost or exposed by a theme update.
Update emails	Failure emails matter more than routine success emails.
Update timing	Do not enable many updates right before a sale, launch, or traffic spike.

The mistake is treating every plugin the same. A small admin helper and a payment gateway do not carry the same risk.

Note 🛟: If you cannot restore the site quickly, do not turn on broad auto-updates yet. Fix the backup and restore process first.

Enable Plugin Auto-Updates

Start with low-risk plugins from vendors you trust. This gives you the benefit of automation without handing your most important workflows to an unattended update.

Do not bulk-enable every plugin on a complex site. Start with plugins that do not touch revenue, leads, logins, or layout.

Enable Theme Auto-Updates

Theme updates deserve more caution than small utility plugin updates because themes control what visitors see and how key templates behave.

Be careful with parent themes, child themes, WooCommerce templates, mobile menus, headers, and custom CSS. A theme update can be technically successful and still change the look or behavior of an important page.

Remove unused themes you do not need, except for a fallback theme if your maintenance process requires one. Old inactive themes can still become outdated software on the server, so back up theme changes before updating anything customized.

Decide What Should Auto-Update

The right question is not “Are auto-updates good?” The right question is “Which updates can run safely without someone watching?”

Update policy	Good candidates	Use caution with
Auto-update	Small utility plugins, admin-only tools, image optimization plugins, security plugins from trusted vendors, simple brochure-site plugins, default themes	Only if they are actively maintained and easy to recover from
Test or schedule first	WooCommerce, payment gateways, booking plugins, forms, memberships, LMS plugins, page builders, multilingual plugins, SEO plugins, event calendars	Anything tied to revenue, leads, logins, rankings, or user data; test the update on a staging site before production
Keep manual or managed	Custom themes, heavily customized premium themes, major version jumps, database-changing plugins, updates during campaigns	Do not delay security fixes for weeks. Use a faster tested process.

For a personal blog, broader auto-updates may be fine. If a social sharing button moves, the cost is small. For a WooCommerce store, a checkout issue can cost money before anyone notices, so treat any plan to upgrade WooCommerce as a tested update, not a background task.

Security fixes need speed, not fear. If a plugin has a known security issue, back up, test quickly when the plugin is high risk, and update promptly.

Note ⚠️: Do not test a business-critical update on production five minutes before a campaign. That is not maintenance. That is gambling with better branding.

Use BlogVault for Safer Scheduled Updates

Native WordPress auto-updates are useful, but they are not a full update workflow. WordPress does not know that tomorrow is your launch day. It does not know that one form plugin feeds every lead to your sales team. It does not know that your theme has custom WooCommerce templates.

BlogVault is useful when you want update automation with guardrails: scheduled update windows, backups before changes, staging for risky updates, visual checks after updates, and restore when something breaks.

Use BlogVault when the site makes money, collects leads, or belongs to a client. Native auto-updates can handle the boring parts. A managed workflow is better for the updates that would hurt if they failed quietly. For agency dashboards, WP Remote Safe Updates follows the same safety principle: test risky updates before production.

Disable Auto-Updates

Turning off auto-updates can be the right move for a risky plugin or theme. Turning off all updates forever is not a plan.

Disable auto-updates when a plugin needs testing, has a history of risky releases, or is already managed by a safer update workflow. Do not leave outdated plugins and themes sitting untouched, especially after a security notice.

Use Code Only If You Need It

Most site owners should use the dashboard controls. Code-level controls are for developers or site managers who know how to recover the site if a mistake breaks admin access. For plugins, WordPress provides the auto_update_plugin filter. For themes, it provides the auto_update_theme filter. A filter is a small WordPress hook that lets custom code change a WordPress decision.

Enable all plugin auto-updates:

add_filter( 'auto_update_plugin', '__return_true' );

Disable all plugin auto-updates:

add_filter( 'auto_update_plugin', '__return_false' );

Enable all theme auto-updates:

add_filter( 'auto_update_theme', '__return_true' );

Disable all theme auto-updates:

add_filter( 'auto_update_theme', '__return_false' );

WordPress core updates use a separate setting called WP_AUTO_UPDATE_CORE. Core means WordPress itself, not your plugins or themes.

define( 'WP_AUTO_UPDATE_CORE', 'minor' );

Do not use DISALLOW_FILE_MODS just to stop auto-updates. It also blocks plugin and theme installs and manual updates from the dashboard, which can create a bigger maintenance problem.

Note 🧩: If code controls are part of your long-term policy, put them in a custom plugin or must-use plugin. Do not rely on a theme file for update policy, because changing themes can remove that rule.

If you manage updates outside the dashboard, WP-CLI plugin installs and WordPress SSH access are a separate workflow.

Fix Missing Controls or Failed Updates

If the auto-update option is missing, WordPress is not always the problem. Something else may be controlling the update flow. Common reasons include:

Premium plugins are the common surprise. Some work with native WordPress update controls. Others need a license key, vendor dashboard, or custom updater before WordPress can update them properly.

If a plugin auto-update fails and the site is down, restore your site from a backup first. Then update one plugin or theme at a time so you can identify the cause. If the site still loads but something looks wrong:

WordPress rollback can help in some failed plugin auto-updates, especially when an update causes a PHP fatal error. A PHP fatal error means WordPress hit a server-side code failure it could not recover from. But rollback does not prove the site works. It may not catch a broken form, shifted mobile header, JavaScript error, checkout problem, or page builder layout change.

If the update involved a performance plugin, use a performance checklist to separate cache issues from real plugin regressions. The update finishing is not the same as the update being safe.

Conclusion

WordPress auto update plugins and themes are worth using, but only with judgment. Enable them for low-risk, well-maintained plugins and themes. Test or schedule updates for anything tied to revenue, leads, logins, layouts, user data, or custom code.

The best setup is simple: automate the boring updates, test the expensive ones, and keep restore close. Native WordPress controls are enough for some sites. If the site is important to your business or your clients, use a WordPress maintenance workflow like BlogVault so updates happen with backups, checks, staging, and a clear way back.

FAQs

Do WordPress plugins automatically update by default?

Most plugin auto-updates are opt-in. You can enable them from Plugins > Installed Plugins in the Automatic Updates column.

How do I auto update WordPress themes?

Go to Appearance > Themes, open Theme Details for the theme, and click Enable auto-updates. Repeat this for each theme.

Should I enable auto-updates for all plugins?

No. Enable auto-updates for low-risk plugins first. Test or schedule updates for checkout, forms, bookings, memberships, page builders, SEO plugins, multilingual plugins, and anything that handles user data.

How do I disable auto updates for WordPress plugins and themes?

For plugins, go to Plugins > Installed Plugins and click Disable auto-updates, or use the bulk action. For themes, go to Appearance > Themes > Theme Details and click Disable auto-updates.

Are WordPress auto-updates safe?

They are safe for many low-risk plugins and simple sites when backups and monitoring are in place. They are risky for business-critical plugins, custom themes, and complex sites unless updates are tested or managed first.