How to Disable Automatic Updates in WordPress

Decide what you actually want before switching anything off. Most people asking this want to stop a plugin updating itself and breaking a page, not to stop security patches. Those are different settings, and turning off the wrong one leaves the site exposed.

What updates automatically by default

So on a stock install, the only thing updating itself is core security fixes and translations. If plugins are updating on their own, someone enabled it.

Turn off plugin and theme auto-updates

In the admin, go to Plugins → Installed Plugins. The Automatic Updates column shows the state per plugin, with a link to disable it. Themes have the same control on their detail screen under Appearance → Themes.

Site-wide in code, in a small custom plugin:

<?php
add_filter('auto_update_plugin', '__return_false');
add_filter('auto_update_theme', '__return_false');

Selectively, which is usually the better answer — keep automatic updates for well-behaved utilities and hold back the ones that touch your layout:

<?php
add_filter('auto_update_plugin', function ($update, $item) {
    $hold_back = [
        'page-builder/page-builder.php',
        'critical-forms/critical-forms.php',
    ];

    return in_array($item->plugin, $hold_back, true) ? false : $update;
}, 10, 2);

Control core updates

Keep security releases and block feature releases — the setting most production sites want:

<?php
// wp-config.php, above the "stop editing" line.
define('WP_AUTO_UPDATE_CORE', 'minor');

Accepted values:

• true — everything, including major releases;
• 'minor' — security and maintenance only (the sensible default);
• false — nothing automatic.

To disable the whole automatic update system, including translations:

<?php
define('AUTOMATIC_UPDATER_DISABLED', true);

Do that only when a deployment pipeline manages updates, or when the file system is read-only by design. On a normal site it means nothing is patched until a human remembers.

Stop the update emails

<?php
add_filter('auto_core_update_send_email', '__return_false');
add_filter('auto_plugin_update_send_email', '__return_false');
add_filter('auto_theme_update_send_email', '__return_false');

Consider keeping failure notices even if you silence success ones — a failed update is the message worth reading. Pass through the type instead of returning false unconditionally:

<?php
add_filter('auto_core_update_send_email', function ($send, $type) {
    return $type !== 'success';
}, 10, 2);

Why an update broke something, and what to do instead

Automatic updates get blamed for failures that were really caused by no staging environment and no backup. Before disabling them, consider whether the actual gap is process:

• take a backup before updates, per how to back up a WordPress site;
• test on staging first;
• update in small batches so you know what broke;
• keep a rollback plan.

The full routine is in how to update WordPress plugins safely.

If updates are disabled, replace them with something

Whatever you switch off has to be covered by a human process:

1. Check for updates on a fixed schedule — weekly is reasonable for most sites.
2. Subscribe to security advisories for the plugins you depend on, so an urgent patch is not waiting for next Tuesday.
3. Apply security releases immediately, even outside the schedule.
4. Keep a list of plugins that are pinned and why. "Nobody remembers why this is on 2.1" becomes an outage eventually.
5. Remove plugins you no longer need, per how to delete a plugin completely — the smallest attack surface is the one you removed.

An unpatched plugin is the most common route into a WordPress site. If updates are off and nobody is watching, the outcome is covered in how to fix a hacked WordPress site — a much worse afternoon than a layout that shifted after an update.

Verify the configuration

Tools → Site Health reports what automatic updates are doing, including when core updates are disabled by a constant or a filter. Check it after making changes, because a filter registered too late — or in a theme that gets switched — silently stops applying.