Should every WordPress update install itself, or should you run them by hand? Our answer about WordPress updates: neither, at least not the way people usually mean it. Manual, once a month, is too slow for security. Automatic with no checks lets through the failures that make no noise. What works is automatic for the routine, with a backup just before and a person who checks just after.
What WordPress already updates on its own
WordPress has installed its own minor updates since version 3.7. Those are the ones that fix vulnerabilities and bugs, and only change the last digit of the version. Translation files too. A site installed since version 5.6 also receives major updates by default. An older site doesn’t, unless someone turned it on.
Plugins and themes don’t update themselves, with one exception: for a critical vulnerability, the WordPress.org security team can trigger a plugin update on every site. Since version 5.5, an “Enable auto-updates” link appears next to each plugin and each theme. The choice is yours, one line at a time.
Since version 6.6, WordPress also rolls back an automatic plugin update that crashes the site. Pay attention to what “crashes” means here. Right after the update, WordPress loads the home page and looks for a PHP fatal error, the kind that shows a white screen or an error message. If it finds one, it puts the old version back.
Why WordPress updates can’t wait for the end of the month
Patchstack, which tracks WordPress vulnerabilities, counted 11,334 new vulnerabilities in 2025, 91% of them in plugins. For the most targeted ones, it measures a median of five hours between disclosure and the first mass attacks. Five hours, not five weeks.
A security update that waits for the end of the month is like knowing the back door is unlocked and waiting for the first of the month to lock it. Most of the time, nothing happens. The day something does, cleaning up a hacked site costs far more than a whole year of updates.
Sites that are never updated add one more problem. After two or three years, a single update catches up on dozens, and the odds that something breaks climb with them. The longer you wait, the higher the step.
What automatic updates don’t see
WordPress’s safety net looks at one thing only: does the home page respond without a fatal error? Everything else slips past it.
A layout that shifts on an inner page. A form that displays perfectly, but whose emails no longer arrive. A payment declined at the last step. An English version that suddenly shows French text. None of these failures produces a white screen. The site looks perfectly healthy, and you find out three weeks later, when a client asks why nobody answered their request.
Two more cases deserve your attention. Paid plugins (forms, fields, translation) only update if their licence is active: an expired licence blocks fixes without any error message. And major updates, the ones that change the first or second digit of the version, sometimes change how a plugin works, WooCommerce for example. They get tested on a copy before reaching the site.
The update nobody runs: PHP
WordPress is written in PHP, the language that runs on the server. Each PHP version receives security fixes for about four years, then nothing. A fully updated site running on an abandoned PHP version remains exposed, and no WordPress update changes that.
The setting lives with your host, often a single click, and that’s exactly the problem: nobody thinks of it. Check your site’s PHP version in WordPress’s Site Health tool (under Tools), then compare it with the supported versions page on php.net. Switching versions is prepared like a major update, on a copy of the site first: an old plugin may not keep up.
Automatic, but checked: our method
On the sites we maintain, the routine is automated, and a person takes over where automation stops. In order:
- A full backup of the site, just before every update.
- The updates for WordPress, plugins and the theme.
- A check right after: key pages, forms and, on a store or a membership site, purchases and sign-ups.
- Major updates go through a test copy of the site first (staging).
- If something breaks, we fix it, with the backup from before the update as a safety net.
The difference between our maintenance plans lies mostly in how far those checks go. On a business website, key pages and forms are enough. On a store, a membership site or a multisite, we also test purchases and sign-ups, and major updates go through staging.
If you manage your site yourself
You don’t need a plan to do better today. Turn on automatic updates for your plugins, starting with the simple, well-maintained ones. Keep a backup outside the site, on separate storage: the one your host keeps sometimes disappears with the account. After every round of updates, send yourself a message through your own contact form. It’s the most cost-effective test there is.
Never edit the code of a plugin or a purchased theme: the next update will wipe out your changes. And clean house. Every plugin removed is one less update to watch, as we explain in our list of essential WordPress plugins.
For an online store or a site that receives requests every day, the question changes in nature. An hour of downtime counts in lost sales or clients, and checking after every update becomes a job in itself. That’s the time to hand it to someone whose job it is.
