How WordPress auto-updates actually work

WordPress has updated itself automatically, at least partly, since 2013 — but the rules about what updates on its own and what waits for you to approve it are more specific than most people realise, and they changed further as automatic updates for major releases and for plugins were introduced in later versions.

What updates itself by default

Minor core releases

Version numbers like 6.4.1 or 6.4.2 — the third number — are minor releases, and WordPress installs these automatically by default, without asking. Minor releases are reserved almost exclusively for security fixes and small bug corrections, which is exactly why they are treated differently: the risk of an unpatched security issue generally outweighs the small risk of an automatic update causing a problem.

Translation file updates

Language files update automatically alongside core, keeping translated strings current without any action needed.

What does not update itself by default

Major core releases

Version numbers like 6.4 to 6.5 — a change in the second number — are major releases, and these are not applied automatically on a default WordPress install. Major releases can include new features, deprecated functionality, and changes with a real chance of affecting how a theme or plugin behaves, so WordPress leaves the decision to update to you rather than making it silently.

Plugins and themes

Neither updates automatically by default. Since 2020, WordPress has included a per-plugin and per-theme toggle for automatic updates, but it has to be turned on deliberately for each one — nothing updates itself simply because the feature exists.

Turning individual plugin and theme auto-updates on

In Plugins, each row has an "Enable auto-updates" link, and the same option exists on the Themes screen for individual themes. Turning this on for a specific plugin means it will update itself whenever a new version is released, without waiting for you to click Update manually.

Controlling this from wp-config.php

Beyond the per-item toggles in wp-admin, a few constants in wp-config.php control automatic updates more broadly:

define( 'WP_AUTO_UPDATE_CORE', true );

Set to true, this extends automatic updates to every core release, major and minor alike — a stronger setting than the default. Set to false, it disables even the default minor security updates, which is rarely a good idea given what those updates are specifically for.

define( 'AUTOMATIC_UPDATER_DISABLED', true );

This switches off WordPress's automatic updater entirely, including minor security releases. It exists for specific situations — a managed hosting environment that handles updates its own way, for instance — rather than for general use, since it also disables the security-fix behaviour most sites benefit from keeping on.

define( 'DISALLOW_FILE_MODS', true );

Prevents any file-based changes at all through wp-admin, including updates, plugin installs, and theme installs. Occasionally used on sites where all deployment happens through a separate process such as version control, but it also blocks the useful parts of the update system along with the ones you might want to avoid.

What happens when an automatic update fails

WordPress does not simply apply an automatic update and hope for the best. Before replacing any core files, it takes a form of internal checkpoint, and if the update process is interrupted or a file fails to write correctly, WordPress attempts to roll the site back to its previous working state rather than leaving it half-updated. This is part of why minor automatic updates are considered low-risk enough to apply without asking: the failure mode is designed to be "nothing changed" rather than "something broke".

This safety net is specific to core updates. Automatic plugin and theme updates do not carry the same built-in rollback behaviour in every case, which is one of the reasons plugin auto-updates are opt-in rather than default — a plugin update that introduces a fatal error can still take a site down even though the update itself completed "successfully" from WordPress's point of view. If you do turn on automatic updates for a plugin, an uptime monitor or a habit of checking the site the morning after updates run is worth having, precisely because nothing will tell you proactively if one has gone wrong.

Automatic updates and hosting-level maintenance

It is worth being clear about where this sits relative to your hosting. WordPress's automatic update system runs entirely within the WordPress install itself — it is a feature of the software, triggered the same way WP-Cron triggers other scheduled tasks, and it has nothing to do with your hosting account's own maintenance or infrastructure. Server software, PHP versions, and the underlying operating system are managed separately by your host, and updating those is not something WordPress's auto-update system touches at all.

This distinction matters because "my host keeps everything updated" and "WordPress keeps itself updated" are two different claims, and neither one covers the other. A host keeping the server environment current does not mean your specific WordPress install, its theme, and its plugins are also current — that half of the job still depends on the settings covered above, whichever way you choose to configure them.

Why any of this matters

A site left entirely on defaults gets security patches automatically, which is genuinely valuable, but it does not get major feature releases or plugin and theme updates without someone actively applying them. A site left unmaintained for a long stretch can therefore still be running current, security-patched core while sitting on plugins that are several versions behind — which is exactly the gap that causes most real WordPress compromises. See updating WordPress without breaking your site for a safe process covering the updates that do not happen automatically, and the monthly WordPress maintenance checklist for keeping on top of all of it as routine.