Introduction
Have you ever woken up to find your WordPress site broken after an update? Or worse, ignored updates for months and then had your site hacked? You’re not alone. Managing WordPress updates is a daily dilemma for millions of site owners.
On one hand, not updating leaves your site open to critical security flaws. On the other, updating without care can break your site, your plugins and your theme. It’s an impossible choice between security and stability.
Since WordPress 5.5 (August 2020), automatic updates have become a granular option. But should you turn them on? For what? Under which conditions? That’s exactly what this article covers.
The short answer? Yes for some updates, no for others. But the real answer depends on your setup, your resources and your tolerance for risk. According to a 2025 study, 60% of hacked WordPress sites were running an outdated version of the core, plugins or themes. Yet 23% of sites ran into problems after a badly configured automatic update.
In this article, you’ll learn exactly which updates to automate, which ones to handle manually, and how to set up a safe update system that protects your site without breaking it.
Understanding the different types of WordPress updates
WordPress core updates
WordPress releases three types of core updates, and it’s crucial to understand the difference:
Major updates (e.g. 6.4 → 6.5) bring new features, interface changes and sometimes significant changes to the code. They come out about 3 times a year. These updates can potentially break compatibility with some plugins or themes, especially ones that are poorly coded or poorly maintained.
Minor updates (e.g. 6.4.1 → 6.4.2) fix bugs and security flaws without adding new features. They are generally very safe and have been switched on automatically by default since WordPress 3.7. These updates are essential for security.
Security updates are urgent minor updates that fix critical vulnerabilities. They are always automatic by default and should stay that way. Never switch them off.
Plugin updates
Plugins are the main source of vulnerabilities on WordPress. According to Wordfence, 95% of security flaws come from plugins, not from the WordPress core. Plugin updates can be:
Security fixes: urgent and critical. A popular plugin such as Elementor or WooCommerce can have millions of installations. When a flaw is discovered, hackers automatically scan every site using that plugin. You have a window of a few hours to a few days before you become a target.
New features: less urgent, but important to keep up with changes in WordPress and web technologies.
Bug fixes: they improve stability and performance.
The problem? Not every plugin developer tests their updates rigorously. One badly coded plugin can break your site in a single click.
Theme updates
Themes matter less for security than plugins (they account for around 3% of vulnerabilities), but a theme update can still break your design, your CSS customisations or your widgets.
Well maintained premium themes (such as Divi, Astra, GeneratePress) release regular, tested updates. Free or abandoned themes may never be updated at all, which creates security risks.
The benefits of automatic updates
Stronger security and faster response
The main benefit of automatic updates is speed of response. When a critical security flaw is discovered (what’s known as a “zero-day”), every hour counts. Hackers use bots that automatically scan millions of sites to exploit the flaw.
With automatic updates switched on, your site is protected as soon as the fix is released, even if you’re on holiday, ill or simply busy. You don’t need to keep a constant eye on security announcements.
According to a Sucuri study, sites with automatic updates switched on are 78% less likely to be compromised than those relying on manual updates. Why? People forget, put things off or underestimate the risk. Automation never sleeps.
Time saved and peace of mind
If you manage several WordPress sites (agencies, freelancers, entrepreneurs with several projects), manual updates can take hours every week. Multiply that by 52 weeks and you’re spending several working days a year just clicking “Update”.
Automatic updates free you from this repetitive task. You can focus on what really matters: creating content, growing your business, serving your clients. That’s the very essence of the freedom we value at BLACKT.
Peace of mind has a value too. Knowing your site is always up to date and protected, without having to think about it, takes a weight off your mind and lets you sleep soundly.
Better compatibility
WordPress is constantly evolving. Each new version of the core improves performance, accessibility and security. Modern plugins and themes are built to work with recent versions of WordPress.
If you stay on an old version (say WordPress 5.8 when the current version is 6.5), you gradually risk losing compatibility with new plugins, new features and even some third-party services (such as payment gateways that require recent versions for security reasons).
Automatic updates make sure you stay within the current ecosystem, benefit from the latest performance optimisations (WordPress 6.5 is 30% faster than WordPress 5.0) and don’t build up “technical debt”.
The risks of automatic updates
Incompatibilities and broken sites
The number one risk of automatic updates is incompatibility. Here’s a classic scenario:
You use a page builder plugin (Elementor, Divi, Beaver Builder). A major WordPress update changes the way blocks are handled. The plugin hasn’t yet been tested with this new version. The automatic update runs overnight. The next morning, your site shows the white screen of death (WSOD) or your pages are completely broken.
According to a WP Engine study, 23% of WordPress sites experienced at least one malfunction after an automatic update over a 12-month period. The most common problems:
- White screen (fatal PHP error)
- Broken design (CSS/JS conflicts)
- Features that stop working
- A slower site
- Database errors
If you don’t have a recent backup or a staging environment, repairs can take hours, even days. And all that time, your site is offline and you’re losing traffic, sales and credibility.
Lost customisations
If you’ve made changes directly in the theme or plugin files (what are known as “hacks”), an automatic update will overwrite all your customisations. You end up with a site that works, but without your customisations.
That’s why it’s essential to use child themes for theme changes and never to edit plugin code directly. But many site owners don’t know this and end up redoing all their work after every update.
Lack of control and visibility
With automatic updates, you lose control over timing. An update can run in the middle of the day, during a traffic peak or just before an important presentation. If something breaks, you won’t necessarily be there to react straight away.
What’s more, you don’t always get a clear notification of what has been updated. You have to check the logs or the history to find out what changed. If a problem appears a few days after an update, it can be hard to connect the two.
The best strategy: a hybrid, granular approach
What you should ALWAYS automate
Here’s my recommendation, based on 10+ years of managing WordPress sites and 2025 best practice:
Minor WordPress core updates: ALWAYS automatic. They are tested, safe and critical for security. WordPress switches them on by default and you should never switch them off. The risk of breaking something is close to zero; the risk of not running them is huge.
Urgent security updates: ALWAYS automatic. When WordPress releases a critical security update, it means a serious flaw has been found and has probably already been exploited. Every minute counts.
Security and backup plugins: automatic. Wordfence, Sucuri, UpdraftPlus and the like need to be up to date to detect the latest threats and vulnerabilities. These plugins are generally very well tested and rarely cause problems.
What you should automate WITH CARE
Popular, well maintained plugins: automatic, but with a staging environment. Plugins with 1M+ active installations and regular updates (Elementor, WooCommerce, Yoast SEO, Contact Form 7) are generally safe. But test them on a staging environment first if you can.
Maintained premium themes: automatic if you use a child theme and have no direct customisations. Astra, GeneratePress, Divi and the like are well tested. But make sure you have a recent backup.
What you should handle MANUALLY
Major WordPress core updates: manual, with testing on staging. Major updates (6.4 → 6.5) can introduce significant changes. Test on a staging environment first, check that everything works, then deploy to production.
Business-critical plugins: manual. If you use a membership, LMS or booking plugin, or any plugin that handles transactions or sensitive data, always test on staging before updating in production.
Poorly maintained or abandoned plugins: manual (or better still, replace them). If a plugin hasn’t been updated for 6+ months, it has probably been abandoned. Never automate it, and consider finding an alternative.
Heavily customised themes: manual. If you have a lot of custom CSS, hooks or modifications, always test before updating.
How to set up automatic updates properly
Method 1: from the WordPress dashboard (simple)
Since WordPress 5.5, you can switch on automatic updates plugin by plugin and theme by theme, straight from the dashboard.
Step 1: go to Plugins > Installed Plugins
Step 2: for each plugin, you’ll see an “Enable auto-updates” or “Disable auto-updates” link
Step 3: click to enable them only for the plugins you consider safe (see the strategy above)
Step 4: repeat under Appearance > Themes
This is the simplest method, perfect if you run a single site and want granular control without touching any code.
Method 2: via wp-config.php (advanced)
For finer control and to automate across several sites, you can use constants in the wp-config.php file.
Enable all automatic updates:
define( 'WP_AUTO_UPDATE_CORE', true );
add_filter( 'auto_update_plugin', '__return_true' );
add_filter( 'auto_update_theme', '__return_true' );Enable minor core updates only (recommended):
define( 'WP_AUTO_UPDATE_CORE', 'minor' );Disable all automatic updates (not recommended):
define( 'WP_AUTO_UPDATE_CORE', false );
add_filter( 'auto_update_plugin', '__return_false' );
add_filter( 'auto_update_theme', '__return_false' );Enable them for specific plugins:
function auto_update_specific_plugins ( $update, $item ) {
$plugins = array ( 'akismet', 'wordfence' );
if ( in_array( $item->slug, $plugins ) ) {
return true;
} else {
return $update;
}
}
add_filter( 'auto_update_plugin', 'auto_update_specific_plugins', 10, 2 );Method 3: with a management plugin (recommended for beginners)
Plugins such as Easy Updates Manager or Advanced Automatic Updates give you a visual interface to fine-tune every update without touching any code.
You can:
- Choose which types of update to automate
- Exclude specific plugins/themes
- Schedule updates for off-peak hours
- Receive email notifications
- Turn on automatic backups before each update
It’s the ideal solution if you’re not comfortable with code but want granular control.
Essential precautions before you automate
1. Set up daily automatic backups
This is non-negotiable. Before switching on any automatic update, make sure you have a daily automatic backup system that stores backups off-site (not on the same server as your site).
Recommended plugins:
- UpdraftPlus (free/premium): backs up to Google Drive, Dropbox, S3
- BackWPup (free): very comprehensive
- BlogVault (premium): real-time backups + staging
Set up daily database backups and weekly full backups (files + database). Keep at least 30 days of history.
2. Create a staging environment
A staging environment is an exact copy of your live site that only you can access. You can test updates there before applying them to the real site.
Staging options:
- WP Engine, Kinsta, Flywheel: one-click staging included
- WP Staging plugin: creates a staging site on the same server (free)
- Local by Flywheel: a local environment on your own computer (free)
Recommended workflow:
- Automatic update on staging
- Manual testing (navigation, forms, checkout for e-commerce)
- If everything works, deploy to production
- If there’s a problem, investigate and fix it before deploying
3. Turn on email notifications
WordPress can send you an email after each automatic update. Turn this option on so you know what’s changing on your site.
By default, WordPress sends emails for core updates. For plugins and themes, use a plugin such as Easy Updates Manager to get detailed reports.
Create a filter rule in your email so these notifications don’t clutter your inbox but are still there if something goes wrong.
4. Monitor your site’s health
Use monitoring tools to spot straight away if an update breaks something:
Uptime monitoring: Pingdom, UptimeRobot or Site24x7 alert you if your site goes down.
Performance monitoring: Google PageSpeed Insights and GTmetrix to check that performance isn’t slipping.
Error logging: switch on WordPress logging to capture PHP errors. Recommended plugin: WP Log Viewer.
If an automatic update breaks something, you’ll know within the hour and can restore from a backup.
Special cases and specific situations
E-commerce sites (WooCommerce, Easy Digital Downloads)
For e-commerce sites, stability is critical. An update that breaks the checkout process can cost you thousands of euros in lost sales.
Recommendation:
- Minor core updates: automatic
- WooCommerce and critical extensions: manual, tested on staging
- Payment gateways: manual, rigorously tested
- E-commerce theme: manual
Plan a monthly maintenance window (for example, the first Monday of the month at 2am) to test and deploy important updates.
Multilingual sites (WPML, Polylang)
Translation plugins are complex and can clash with certain WordPress updates or other plugins.
Recommendation:
- WPML/Polylang: manual, tested on staging
- Check specifically that no translations are lost after the update
Sites built with page builders (Elementor, Divi, Beaver Builder)
Page builders change the way WordPress works at a deep level. They’re generally well maintained, but a major update can break your designs.
Recommendation:
- Page builder: automatic if you have staging + backups, manual otherwise
- Always test your key pages after an update (homepage, landing pages, sales pages)
High-traffic sites
If your site gets 10,000+ visitors a day, even the slightest downtime has a significant impact.
Recommendation:
- All updates: manual, tested on staging
- Deploy during off-peak hours (use Google Analytics to find them)
- Real-time monitoring during and after deployment
FAQ: WordPress automatic updates
1. Can automatic updates break my site?
Yes, it can happen, especially if you have badly coded plugins, unmaintained themes or direct customisations in the files. That’s why daily automatic backups and, ideally, a staging environment are essential. With these precautions in place, even if an update breaks something, you can restore your site in a few minutes.
2. How do I know whether my plugins are compatible with the latest version of WordPress?
Before each major WordPress update, check the plugin’s page on wordpress.org. Look at the “Tested up to WordPress X.X” section. If the plugin hasn’t been tested with the latest version, wait a few weeks after the new release so the developers can update it. You can also check the plugin’s support forums to see whether users are reporting problems.
3. Should I switch on automatic updates if I’m not technical?
Yes, but with care. At the very least, keep minor core updates and security updates switched on (that’s the WordPress default). For plugins and themes, switch them on only for popular, well maintained ones. Above all, set up daily automatic backups with a plugin such as UpdraftPlus. If you’re not technical, avoid automatic updates for critical plugins (e-commerce, membership) and bring in a professional to manage them.
4. How often should I run manual updates?
If you handle some updates manually, check at least once a week. Critical security updates should be applied within 24 to 48 hours of their release. For major core updates, wait 2 to 3 weeks after the release so the initial bugs get fixed, then test on staging before deploying.
5. My host offers automatic updates. Should I use them?
Some managed WordPress hosts (WP Engine, Kinsta, Flywheel) offer automatic updates with staging and automatic rollback if something goes wrong. It’s an excellent option, because they test updates on thousands of sites before rolling them out. If your host offers this service, use it. It’s often safer than doing it yourself.
Conclusion: security AND stability are possible
The question isn’t “should you switch on automatic updates in WordPress?” but “which updates should you automate, and how do you do it safely?”.
The best strategy in 2025 is a hybrid, granular approach:
- Automate minor core updates and security updates (always)
- Automate well maintained, non-critical plugins (with backups)
- Handle major updates and critical plugins manually (with staging)
With this approach, you get the security of fast updates without sacrificing your site’s stability. You save time, you sleep soundly and you drastically reduce the risk of being hacked.
Never forget: 60% of hacked WordPress sites were running an outdated version. The average cost of a hacked site is €5,000 (clean-up, lost data, lost traffic, damage to your reputation). The cost of a good update strategy? A few hours of initial setup, and peace of mind for years to come.
Need help securing your WordPress site?
At BLACKT, we handle WordPress maintenance for dozens of client sites. We put in place tailored update strategies, automatic backups, 24/7 monitoring and responsive support when something goes wrong.
Book your free WordPress security audit and find out how to protect your site without sacrificing stability or your time.
Because your site deserves to be secure, fast and always online. And you deserve the freedom to focus on your business, not on technical maintenance.
Internal links:
References:
- WordPress.org. “Configuring Automatic Background Updates”. 2025.
- Wordfence. “WordPress Security Report 2025”.
- WP Engine. “State of WordPress Updates Study”. 2025.
- Sucuri. “Website Security Statistics 2025”.
Further reading
- website maintenance: why updates get tested before they’re applied.
- website security: what keeps you protected, and what to do when it’s too late.
