Control WordPress automatic updates

You can control when WordPress, plugins and themes are updated, but it is wise to keep a way to apply security fixes. If you need to test an update, decide who will review it and when it will be applied; an indefinite pause builds up risk and pending work.

Limit the core to minor updates

Keep a copy of wp-config.php and change the existing constant, or add it before WordPress loads if it is not defined:

define('WP_AUTO_UPDATE_CORE', 'minor');

Not every possible fix is released for every old branch. Keeping 'minor' is no substitute for upgrading to a maintained branch.

Plugins, themes and other managers

The constant above does not by itself control plugin and theme updates. Review their options in WordPress and also in WordPress Manager or WP Toolkit if you use them.

An external manager can run its own update even if you have changed the core policy. Avoid contradictory settings and check which one performs each task.

Pause the whole updater

The AUTOMATIC_UPDATER_DISABLED constant set to true disables WordPress's automatic updater more broadly. Do not use it as a permanent fix for an incompatibility without setting up a manual update and follow-up process.

If a piece of work requires a pause, keep the previous setting, record the failing component and set a review date. Test the fix on a clone and remove the pause when the work is finished. There is no universal period that makes any pending vulnerability safe.

Check the policy

Review Dashboard > Updates, the plugin/theme preferences and the manager's notices. Then check which version ended up installed and the essential features. The options can be affected by filters, permissions or external automation.

Follow the dependency-based update guide to rehearse the whole set and prepare a recoverable backup before major changes.