Automatic background updates were introduced in WordPress 3.7 in an effort to promote better security, and to streamline the update experience overall. By default, only minor releases – such as for maintenance and security purposes – and translation file updates are enabled on most sites.
In WordPress, there are four types of automatic background updates:
Core updates are subdivided into three types:
By default, every site has automatic updates enabled for minor core releases and translation files. Sites already running a development version also have automatic updates to further development versions enabled by default.
Automatic updates can be configured using one of two methods: defining constants in wp-config.php, or adding filters using a Plugin.
Using wp-config.php, automatic updates can be disabled completely, and core updates can be disabled or configured based on update type.
The core developers made a conscious decision to enable automatic updates for minor releases and translation files out of the box. Going forward, this will be one of the best ways to guarantee your site stays up to date and secure and, as such, disabling these updates is strongly discouraged.
To completely disable all types of automatic updates, core or otherwise, add the following to your wp-config.php file:
define( 'AUTOMATIC_UPDATER_DISABLED', true );
To enable automatic updates for major releases or development purposes, the place to start is with the WP_AUTO_UPDATE_CORE constant. Defining this constant one of three ways allows you to blanket-enable, or blanket-disable several types of core updates at once.
define( 'WP_AUTO_UPDATE_CORE', false );
WP_AUTO_UPDATE_CORE can be defined with one of three values, each producing a different behavior:
Note that only sites already running a development version will receive development updates. For other sites, setting WP_AUTO_UPDATE_CORE to true will mean that it will only get minor and major updates.
Using filters allows for fine-tuned control of automatic updates.
The best place to put these filters is in a must-use plugin.
Note: Do not add add_filter() calls in wp-config.php - causes conflicts with WP-CLI and possibly other problems.
You can also disable all automatic updates using the following filter:
add_filter( 'automatic_updater_disabled', '__return_true' );
To disable all core-type updates only, use the following filter:
add_filter( 'auto_update_core', '__return_false' );
But let's say rather than enabling or disabling all three types of core updates, you want to selectively enable or disable them. That's where the allow_dev_auto_core_updates, allow_minor_auto_core_updates, and allow_major_auto_core_updates filters come in.
There are two shorthand functions built into WordPress that will allow you to enable or disable specific types of core updates with single lines of code. They are __return_true and __return_false. Here are some example filters:
To specifically enable development (nightly) updates, use the following:
add_filter( 'allow_dev_auto_core_updates', '__return_true' );
To specifically disable minor updates, use the following:
add_filter( 'allow_minor_auto_core_updates', '__return_false' );
To specifically enable major updates, use the following:
add_filter( 'allow_major_auto_core_updates', '__return_true' );
To specifically enable automatic updates even if a VCS folder (.git, .hg, .svn etc) was found in the WordPress directory or any of its parent directories:
add_filter( 'automatic_updates_is_vcs_checkout', '__return_false', 1 );
Automatic plugin and theme updates are disabled by default. To enable them, you can leverage the auto_update_$type filter, where $type would be replaced with "plugin" or "theme".
To enable automatic updates for plugins, use the following:
add_filter( 'auto_update_plugin', '__return_true' );
To enable automatic updates for themes, use the following:
add_filter( 'auto_update_theme', '__return_true' );
Automatic translation file updates are already enabled by default, the same as minor core updates.
To disable translation file updates, use the following:
add_filter( 'auto_update_translation', '__return_false' );
// Disable update emails add_filter( 'auto_core_update_send_email', '__return_false' );
This filter can also be used to manipulate update emails according to email $type (success, fail, critical), update type object $core_update, or $result:
/* @param bool $send Whether to send the email. Default true. * @param string $type The type of email to send. * Can be one of 'success', 'fail', 'critical'. * @param object $core_update The update offer that was attempted. * @param mixed $result The result for the core update. Can be WP_Error. */ apply_filters( 'auto_core_update_send_email', true, $type, $core_update, $result );
Info about wp-cli conflict: https://github.com/wp-cli/wp-cli/issues/1310