WordPress can update its core and at times plugins and themes (if there’s a potential security vulnerability) automatically.

WordPress is open source software and at times there can be critical vulnerabilities and security problems stemming from popular themes or plugins.

When that happens, WordPress software developers that keep the WordPress core up to date will push an automatic update on your WordPress installation. 

In rare instances, these updates can potentially break your website, which is why it’s good to know how to push updates manually yourself. 

There are two ways to disable automatic core updates in WordPress:

Disable updates manually 

If you don’t want to use a third-party plugin, you can disable updates manually by editing the wp-config.php file.

Simply add the following line to your wp-config.php file:

define( 'WP_AUTO_UPDATE_CORE', false );

And it will disable all automatic updates.

If you want to disable theme and plugin updates but still receive minor core updates, you can insert the following filters to the theme’s functions.php file or in a specific plugin:

Theme:

add_filter( 'auto_update_theme', '__return_false' );

Plugin:

add_filter( 'auto_update_plugin', '__return_false' );

Disable updates with a plugin

A more straightforward method to disable updates is by using a free plugin called Easy Updates Manager.

Easy updates manager

Login to your WordPress Dashboard, head to Plugins > Add New, fill in Easy Updates Manager in the search field, and click Install Now:

Click Activate to activate the plugin:

Head to Dashboard > Updates options to configure the update rules.

You can use Disable all updates to disable everything, but we don’t recommend that as it will prevent all update notifications from showing in your WordPress dashboard.

Configure

We recommend configuring these options manually.

For example, you can choose to update the WordPress core automatically but disable plugin and theme updates. 

Keep in mind that if you choose Disable plugin updates/Disable theme updates instead of Disable auto updates, this will remove all update notifications in the plugins and theme lists.

If anything breaks during the update, you can always roll-back to the previous version as Easy Updates Manager keeps a log of all changes.

Head to your Dashboard > Updates options and click the Logs tab to revert the update.

Final words

Most users forget to do updates on their own, so automatic updates are helpful to maintain good WordPress security.

If you have many websites, automatic updates can save you a lot of time, plus you have the added advantage of knowing that your websites are updated in case there’s a potential security vulnerability. 

However, there’s a possibility automatic updates can break your website, especially if your site is heavily customized and you’ve modified WordPress core files at some point.

This usually rarely happens, but it’s possible an update has a conflict with a plugin or theme you’re using.

In the end, it’s really up to you. We recommend keeping WordPress core updates enabled, especially when you’re starting out and your site isn’t too complex.

When you’re running a store or any type of complex website using a higher number of plugins, it could be advantageous to run updates manually on a staging site and pushing those updates live once tested thoroughly.