How to Set Up Automatic Plugin Updates in WordPress (Admin, Filters, WP-CLI)

This article is a localized edition of the Japanese original. Read the Japanese original

Since WordPress 5.5, you can turn automatic updates on or off for each plugin from the admin. For example, you can auto-update plugins whose security fixes you want applied quickly, and update plugins whose behavior tends to change only after checking them by hand.

This article covers three methods (the admin screen, PHP filters (hooks) and WP-CLI), plus how automatic updates work and what to watch for. The filters and constants were checked against the developer.wordpress.org reference as of November 2026.

Set it up in the admin

1. Open "Plugins → Installed Plugins"
2. In the "Automatic Updates" column of the list, click "Enable auto-updates" for the plugin
3. Once enabled, the same spot changes to "Disable auto-updates" and shows when the next automatic update is scheduled

To change several at once, select plugins with the checkboxes on the left of the list, choose "Enable Auto-updates" (or "Disable Auto-updates") from "Bulk actions", and click "Apply".

Auto-updates are available for plugins distributed on WordPress.org and for plugins, such as some premium plugins, whose update system works with WordPress's update mechanism. Other plugins (such as ones you wrote yourself) are not auto-updated. Themes can be set the same way, per theme, under "Appearance → Themes".

Control auto-updates with a filter

To lock in a policy for your site in code, use the auto_update_plugin filter. Put the code in a child theme's functions.php or in your own plugin (in mu-plugins it stays active even if you change themes).

The value this filter returns takes priority over the setting in the admin. Return true to auto-update and false to skip auto-updating. To leave things unchanged, return the $update value you received.

Auto-update all plugins, or none

<?php
// Auto-update all plugins
add_filter( 'auto_update_plugin', '__return_true' );

// Never auto-update plugins (use only one of these two lines)
// add_filter( 'auto_update_plugin', '__return_false' );

Auto-update only specific plugins, or exclude them

The second argument, $item, is an object with the update details, and $item->slug holds the plugin's slug (the name used in its WordPress.org URL).

<?php
// Always auto-update the listed plugins. Others follow the admin setting
add_filter( 'auto_update_plugin', function ( $update, $item ) {
	$always = array( 'akismet', 'wordfence' );
	if ( isset( $item->slug ) && in_array( $item->slug, $always, true ) ) {
		return true;
	}
	return $update;
}, 10, 2 );

// Never auto-update the listed plugins. Others follow the admin setting
add_filter( 'auto_update_plugin', function ( $update, $item ) {
	$excluded = array( 'woocommerce', 'contact-form-7' );
	if ( isset( $item->slug ) && in_array( $item->slug, $excluded, true ) ) {
		return false;
	}
	return $update;
}, 10, 2 );

If your code returns false for everything not on the list, plugins you enabled in the admin also stop auto-updating. In the examples above, unlisted plugins return $update, so the admin setting still applies to them.

Remove the auto-update controls from the admin

If your policy is not to use plugin auto-updates and you don't want the "Automatic Updates" column shown in the admin either, use the plugins_auto_update_enabled filter.

<?php
add_filter( 'plugins_auto_update_enabled', '__return_false' );

What the wp-config.php constants mean

The constants in wp-config.php affect automatic updates as a whole or core updates, not just plugins. Make sure you don't confuse what they do.

WP_AUTO_UPDATE_CORE controls core auto-updates and has nothing to do with plugin or theme auto-updates. To stop only plugin auto-updates, use the filter from the previous section.

Setting AUTOMATIC_UPDATER_DISABLED to true also stops core security updates from being installed automatically. Use it only if you have a process for updating by hand.

Set it up with WP-CLI

With WP-CLI's wp plugin auto-updates, you can change the same settings as in the admin from the command line.

# Enable auto-updates for a specific plugin
wp plugin auto-updates enable contact-form-7

# Enable auto-updates for all plugins
wp plugin auto-updates enable --all

# Disable auto-updates for a specific plugin
wp plugin auto-updates disable woocommerce

# Show the status for all plugins
wp plugin auto-updates status --all

# Show only the names of plugins with auto-updates enabled
wp plugin auto-updates status --all --enabled-only --field=name

The default output of wp plugin list also includes an auto_update column (on or off).

wp plugin list --fields=name,version,update_version,auto_update

Change the notification emails

When automatic updates run, the results are emailed to the administrator address. Use filters to stop these emails or change where they go.

<?php
// Don't send plugin auto-update notification emails
add_filter( 'auto_plugin_update_send_email', '__return_false' );

// Change the recipient of plugin and theme auto-update emails
add_filter( 'auto_plugin_theme_update_email', function ( $email, $type, $successful_updates, $failed_updates ) {
	$email['to'] = 'dev@example.com';
	return $email;
}, 10, 4 );

In auto_plugin_theme_update_email, $email is the array passed to wp_mail(), with to (recipient), subject, body and headers. $type is one of success, fail or mixed (both). If you stop the notifications, failed updates become easy to miss, so changing the recipient is the better option.

How auto-updates run, and what to watch for

• They run on WP-Cron: Automatic updates run through WordPress's scheduled tasks (WP-Cron), alongside the update checks that happen twice a day. WP-Cron is triggered by visits to the site, so on low-traffic sites, or sites that set DISABLE_WP_CRON to true without configuring a server cron job, updates can be delayed or never happen.
• Rollback on failure: Since WordPress 6.6, after a plugin auto-update WordPress checks for PHP fatal errors, and if it finds one, it restores the previous version and emails the administrator. Problems that don't cause a fatal error (broken layouts or changed behavior) are not rolled back.
• Plugins that are poor candidates for auto-updates: E-commerce and membership plugins such as WooCommerce may change the database or their behavior in an update. It is safer to test them on a staging site and update them by hand.
• Plugins that are good candidates for auto-updates: For security plugins and plugins whose vulnerability fixes you want applied quickly, auto-updates keep fixes from being delayed.
• Backups: Auto-updates can still cause problems. Take daily backups and make sure you know how to restore them.

Related articles

• How to update WordPress safely
• How WP-Cron works and how plugins use it
• How to check plugins for vulnerabilities

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)