Updates are good. They’re your friend. They keep your site safe….
But just because updates are an important part of running a WordPress site, that doesn’t necessarily mean that you want your updates running automatically behind your back.
Though the risk is small, updates can go awry sometimes. And when that happens, it’s much more preferable for you to be at your computer instead of off by the pool.
To that end, I’m going to show you two different methods that you can use to turn off automatic updates on your WordPress site.
How Do WordPress Automatic WordPress Updates Work by Default?
There are four different types of automatic updates that WordPress performs. But, by default, not all of them are enabled.
These four overall update types are:
- Core updates
- Plugin updates
- Theme updates
- Translation file updates
The core updates category is further broken down into three different types:
- Core development updates – the latest development version of WordPress, even if it’s not stable.
- Minor core updates – maintenance or security releases (e.g. 4.7.2)
- Major core release updates – a major release like WordPress 4.8
By default, WordPress only enables two types of automatic updates:
- Minor core updates
- Translation file updates
Additionally, the WordPress Security Team does have the ability to force push updates for certain themes or plugins in extreme cases (e.g. a major security vulnerability), but this ability is rarely used. If you’d like, you can turn this ability off as well.
With that being said, that doesn’t mean your site can’t have a different automatic update configuration. Your host might install a different profile or your developer may have tweaked settings. Don’t assume that you always have the default configuration.
Automatic Updates Are Usually a Good Thing
Before I tell you how to disable automatic updates on your WordPress site, I want to lead with an important reminder that automatic updates are a good thing most of the time.
If a new vulnerability comes out, like the REST API vulnerability in WordPress 4.7.2, automatic updates can save your site from any potential trouble.
For that reason, even if you disable automatic updates, you still need to stay on top of things to keep your site safe.
What’s the Problem Then?
Disabling automatic updates is all about control. If you’re running a high-traffic website, you can’t afford to have an automatic update run when you’re away from the computer. Because if something goes wrong, no one is there to correct things.
Don’t get me wrong – most of the time, automatic updates for minor releases go off without a hitch. But as I like to say, “most” is not “always”.
As long as you still regularly update your site manually for at least security releases (this is super important), disabling automatic updates gives you more control without sacrificing any functionality or security.
I’ll first show you how to do it using a plugin because that’s the simplest method. Then, I’ll show you how to disable automatic updates manually using your wp-config.php and/or a custom plugin.
How to Disable Automatic Updates the Easy Way – A Plugin
To disable automatic updates with a plugin, I love the free Easy Updates Manager plugin. Here’s why:
- Over 100,000 active installs
- An impressive 5-star rating
- Regular updates from the developer
- 100% free
In addition, it also gives you detailed control over your updates. You can dig in and even enable/disable automatic updates for specific themes or plugins.
Here’s how to use it:
First, you can install and activate the plugin directly from your WordPress dashboard.
Once you activate the plugin, you can configure it by going to Dashboard → Updates Options.
In the Automatic Updates column, you can see the default automatic update configuration that I mentioned above:
That is, Minor Releases and Translation Updates are turned on, with the others disabled.
If you just want to disable all updates, all you need to do is turn those two off like this:
Configuring Updates for Individual Themes and Plugins
One reason I like this plugin is that you can actually go in and configure automatic updates for individual themes and plugins. For example, you could choose one important plugin to automatically update, while leaving the rest on manual mode.
To configure automatic updates for individual themes or plugins, you first need to choose the Select Individually option in the Automatic Updates column:
Then, you can scroll down to the Plugin and Theme Automatic Updates column and configure each individual plugin and theme:
And that’s all there is to it!
How to Manually Disable Automatic Updates – No Plugin Needed
I think the plugin above is definitely the most beginner friendly way to disable automatic WordPress updates. But if you’re willing to get your hands dirty in your wp-config.php file, you can accomplish the same end results for core updates without needing a plugin.
To edit your wp-config.php file, you can either use your favorite FTP program or cPanel’s File Manager tool.
Anything that will let you edit the file is fine.
For example, to open it with cPanel’s File Manager, you can head to File Manager from your cPanel dashboard, select your wp-config.php file, and click Edit:
The Code You Need to Disable Automatic Updates
The exact code that you need depends on whether you want to disable all updates, or just specific updates.
To blanket disable every single type of automatic update, you just need to add this code snippet to the end of your wp-config.php file:
define( 'AUTOMATIC_UPDATER_DISABLED', true );
To only disable all core updates, you can use this code snippet:
define( 'WP_AUTO_UPDATE_CORE', false );
To only disable major and development updates, you can use this code snippet. Minor updates are still enabled:
define( 'WP_AUTO_UPDATE_CORE', minor );
How to Manually Disable Automatic Updates for Themes and Plugins
If you’d like to disable automatic updates for themes and plugins, you’ll need to do that outside your wp-config.php file. Instead, you need to add these code snippets to either your functions.php file or, more ideally, a custom plugin.
Remember – by default these types of updates are already disabled except for extreme situations.
Personally – I don’t think it’s a good idea to disable these forced emergency security updates because they’re already rare – but I leave the final decision up to you.
To disable all plugin updates (including forced pushes), you can use this snippet:
add_filter( 'auto_update_plugin', '__return_false' );
To disable all theme updates (including forced pushes), you can use this snippet:
add_filter( 'auto_update_theme', '__return_false' );
Updates Are Even More Important When They’re Not Automatic
I want to end with a reminder that updates are massively important. When you disable automatic updates for even minor releases, you’re shouldering the full responsibility of quickly updating your site when a new security release comes out.
If you can’t guarantee that you’ll be there to quickly update your site with new security patches, you need to think long and hard about whether disabling automatic updates is really a good idea.
Running out-of-date core WordPress software is a massive attack vector for malicious actors – don’t let it be you.
But as long as you stay on top of things – you should be fine running manual updates.
