Languages: English • Deutsch • Français • Italiano • 日本語 Español • (Add your language)
Automatic background updates were introduced in WordPress 3.7 in an effort to promote better security, and to streamline the update experience overall. By default, only minor releases – such as for maintenance and security purposes – and translation file updates are enabled on most sites. In special cases, plugins and themes may be updated.
In WordPress, there are four types of automatic background updates:
Core updates are subdivided into three types:
By default, every site has automatic updates enabled for minor core releases and translation files. Sites already running a development version also have automatic updates to further development versions enabled by default.
Automatic updates can be configured using one of two methods: defining constants in wp-config.php, or adding filters using a Plugin.
Using wp-config.php, automatic updates can be disabled completely, and core updates can be disabled or configured based on update type.
The core developers made a conscious decision to enable automatic updates for minor releases and translation files out of the box. Going forward, this will be one of the best ways to guarantee your site stays up to date and secure and, as such, disabling these updates is strongly discouraged.
To completely disable all types of automatic updates, core or otherwise, add the following to your wp-config.php file:
define( 'AUTOMATIC_UPDATER_DISABLED', true );
To enable automatic updates for major releases or development purposes, the place to start is with the WP_AUTO_UPDATE_CORE constant. Defining this constant one of three ways allows you to blanket-enable, or blanket-disable several types of core updates at once.
define( 'WP_AUTO_UPDATE_CORE', true );
WP_AUTO_UPDATE_CORE can be defined with one of three values, each producing a different behavior:
Note that only sites already running a development version will receive development updates.
For development sites, the default value of WP_AUTO_UPDATE_CORE is true. For other sites sites, the default value of WP_AUTO_UPDATE_CORE is minor.
Using filters allows for fine-tuned control of automatic updates.
The best place to put these filters is in a must-use plugin.
Do not add add_filter() calls directly in wp-config.php. WordPress isn't fully loaded and can cause conflicts with other applications such as WP-CLI.
You can also disable all automatic updates using the following filter:
add_filter( 'automatic_updater_disabled', '__return_true' );
To enable all core-type updates only, use the following filter:
add_filter( 'auto_update_core', '__return_true' );
But let's say rather than enabling or disabling all three types of core updates, you want to selectively enable or disable them. That's where the allow_dev_auto_core_updates, allow_minor_auto_core_updates, and allow_major_auto_core_updates filters come in.
There are two shorthand functions built into WordPress that will allow you to enable or disable specific types of core updates with single lines of code. They are __return_true and __return_false. Here are some example filters:
To specifically enable them individually (for disabling, use false instead of true):
add_filter( 'allow_dev_auto_core_updates', '__return_true' ); // Enable development updates add_filter( 'allow_minor_auto_core_updates', '__return_true' ); // Enable minor updates add_filter( 'allow_major_auto_core_updates', '__return_true' ); // Enable major updates
For Developers: To enable automatic updates even if a VCS folder (.git, .hg, .svn etc) was found in the WordPress directory or any of its parent directories:
add_filter( 'automatic_updates_is_vcs_checkout', '__return_false', 1 );
By default, automatic background updates only happen for plugins and themes in special cases, as determined by the WordPress.org API response, which is controlled by the WordPress security team for patching critical vulnerabilities. To enable or disable updates in all cases, you can leverage the auto_update_$type filter, where $type would be replaced with "plugin" or "theme".
Automatic updates for All plugins:
add_filter( 'auto_update_plugin', '__return_true' );
Automatic updates for All themes:
add_filter( 'auto_update_theme', '__return_true' );
You can use __return_false instead of __return_true to specifically disable all plugin & theme updates, even forced security pushes from the WordPress security team.
The auto_update_$type filters also allow for more fine-grained control, as the specific item to updated is also passed into the filter. If you wanted to enable auto-updates for specific plugins only, then you could use code like this:
function auto_update_specific_plugins ( $update, $item ) {
// Array of plugin slugs to always auto-update
$plugins = array (
'akismet',
'buddypress',
);
if ( in_array( $item->slug, $plugins ) ) {
return true; // Always update plugins in this array
} else {
return $update; // Else, use the normal API response to decide whether to update or not
}
}
add_filter( 'auto_update_plugin', 'auto_update_specific_plugins', 10, 2 );
Automatic translation file updates are already enabled by default, the same as minor core updates.
To disable translation file updates, use the following:
add_filter( 'auto_update_translation', '__return_false' );
When an automatic update either succeeds or fails, WordPress sends a notification email to the email address provided at Settings -> General from wordpress@yourdomain.com.
To disable these update notification emails, use the following filter:
add_filter( 'auto_core_update_send_email', '__return_false' );
This filter can also be used to manipulate update emails according to email $type (success, fail, critical), update type object $core_update, or $result:
/* @param bool $send Whether to send the email. Default true. * @param string $type The type of email to send. * Can be one of 'success', 'fail', 'critical'. * @param object $core_update The update offer that was attempted. * @param mixed $result The result for the core update. Can be WP_Error. */ apply_filters( 'auto_core_update_send_email', true, $type, $core_update, $result );