Keeping plugins up to date is fundamental to WordPress security: the majority of hacks occur via a known, already-fixed vulnerability in an outdated plugin. Since version 5.5 of WordPress, automatic updates for plugins and themes can also be enabled from the admin dashboard.

Enabling one by one

1. Log in to your WordPress admin dashboard and go to Plugins > Installed Plugins.
2. In the ‘Automatic updates’ column, click the ‘Enable automatic updates’ link next to the extension.

You can also disable this feature there if you prefer to update a plugin manually.

Bulk activation

Select the extensions on the left-hand side of the list, choose ‘Enable automatic **updates’ from the **‘Bulk actions’ list, then click the ‘Apply’ button.

Templates and the WordPress core

• Templates: On the Appearance > Templates page, you can enable automatic updates by clicking on the template.
• WordPress core: minor (security and bug-fix) releases are installed automatically by default. You can enable automatic updates for major versions on the control panel > Updates page.

Using WP-CLI

If you have SSH access, you can also configure this via the command line:

wp plugin auto-updates enable --all
wp plugin auto-updates status

The comparison of update methods shows when to update via WP Toolkit, via the admin interface and via WP-CLI.

How does it work?

WordPress checks for updates twice a day using its built-in scheduler (WP-Cron) and sends an email about updates to the administrator’s email address. Since version 6.6, if the site crashes with a fatal error following an automatic plugin update, WordPress will revert to the previous version of the plugin.

If you have replaced WP-Cron with a genuine cron job (steps for replacing WP-Cron), please check that the cron job is running regularly; otherwise, updates will not be carried out.

When should you not enable it everywhere?

In the case of payment and invoicing integrations, bespoke or heavily customised plugins, or high-traffic online shops, a faulty update can immediately result in a loss of revenue. It is advisable to update these manually, first in a test environment; the article on the WP Toolkit staging function explains how to set up a test environment. Paid plugins are only updated automatically if they have a valid licence.

WP Toolkit: smart updates

On our WordPress and cPanel hosting plans, the ‘WP Toolkit Deluxe Smart Update’ toggle (at the bottom of the website’s details page) enables pre-update testing: WP Toolkit clones the website, performs the update on the clone, and then runs tests to check whether anything has gone wrong. Based on the test results and the test site, you can decide whether to update the live site. There is a separate article on basic WordPress settings in WP Toolkit, and another on the automatic updating of vulnerable plugins in the article about vulnerable plugins.

Backup before updating

Even with automatic updates, you should have a recent backup so that you can quickly restore your site to a working state following a faulty update. Read more about updates on our blog: Updating WordPress plugins.