WordPress has a feature built in that automatically updates or replaces outdated or deprecated code and files in WordPress core without user permission.

While this feature is great for security purposes, version upgrades can sometimes cause compatibility issues and resulting breakages that could result in hours (and/or dollars) lost from downtime. No one wants that.

In this post, I will show you how you can enable/disable various WordPress Auto Updates to suit your needs without using a plugin (which, again, may cause its own issues with site configuration).

Before we begin, you’ll need a working knowledge of WordPress updates, which can be divided as following:

  • Core

o    Development Updates
o    Minor Updates
o    Major Updates

  • Plugins
  • Themes
  • Translations

Now with your wp-config.php open and ready, we can get started:

  • WordPress Core Updates

Core updates are only automatic for development and minor updates. For instance, if you’re working on a development version and a new version is available, WordPress automatically updates the core. It does the same when the new version is a minor update (e.g. Version 4.3.1, 4.2.3 etc.).

WordPress won’t update automatically if the version is a major release (e.g. Version 4.3, Version 4.4 etc.) or if it detects version control.


WordPress constant WP_AUTO_UPDATE_CORE defines how automatic core updates are to be handled. You can set it on one of three possible values:

  • False: Disables all core updates
  • True: Enables all core updates
  • Minor: Default value, only updates on minor releases and when you are running development version.
  • You can disable all auto core updates by adding this to your code:

define( ‘WP_AUTO_UPDATE_CORE’, false );

Note: You can replace ‘false’ with ‘true’ to enable all core updates, including major releases WordPress names after jazz celebrities. It is not recommended since major upgrades can cause a lot of unforeseen complications with your current themes and plugins.

  • You can further specify which core updates you want to automate (or not) by adding one of the following three filters and setting their return value to true:
    • allow_dev_auto_core_updates: Automates updates when you are running development version
    • allow_minor_auto_core_updates: Automates updates to minor version releases only
    • allow_major_auto_core_updates: Automates updates to major version releases only

The return values for these functions are:

  • Enable: __return_true
  • Disable: __return_false

For example, for disabling automatic updates to all major version upgrades, you add this (after defining

add_filter( ‘allow_major_auto_core_updates’, ‘__return_false’ );

You can enable or disable core updates to dev, minor, and major releases like that.

  • The final filter is called AUTO_UPDATE_CORE and it is run after you define the constant and the filters. This filter can be used to enable/disable all core updates at once:

add_filter( ‘auto_update_core’, ‘__return_false’ );    

Plugin Updates

Plugins update automatically only when API response from WordPress.org returns a non-empty autoupdate property. This happens when the WordPress developer team updates a plugin and uses API response to issue auto-update command.

New plugin updates can break the site. To disable automatic plugin updates, use the following filter:

add_filter( ‘auto_update_plugin’, ‘__return_false’ );

You can enable it by changing ‘__return_false’ to ‘__return_true’.

Theme Updates

Themes are also updated automatically when WordPress core developers issue auto-update command through API response. And again, this can spell catastrophe for sites.

To disable automatic theme updates, use the following filter:

add_filter( ‘auto_update_theme’, ‘__return_false’ );

You can enable it by changing ‘__return_false’ to ‘__return_true’.

Translation Updates

Translations for core files are managed separately and updated automatically. To prevent this, add:

add_filter( ‘auto_update_translation’, ‘__return_false’ );

All WordPress Updates

If you want to disable automatic updates of all kinds instead of selectively enabling and disabling certain types, WordPress has you covered too. You can define a value (true or false) for the constant AUTOMATIC_UPDATER_DISABLED through your wp-config.php with:


This disables all automatic updates. You can enable them back again by setting the value to false.

After this constant comes the filter automatic_updater_disabled. You can set one of two return values for this function:

add_filter( ‘automatic_updater_disabled’, ‘__return_true’ );

This disables all automatic updates, regardless of any previous configuration. You can replace __return_true with __return_false or simply remove the filter from the file to enable them back on.
Another significant way to disable all auto updates is disallow_file_mods.

define( ‘DISALLOW_FILE_MODS’, true );

Set to true, this constant can disable all previously mentioned auto updates, installation of new themes and plugins, and the theme and plugin editors. It will also prevent users from updating anything (core, themes, and plugins), hide theme/plugin update notifications, and immediately override any auto-update related constants and filters (as mentioned above). If you have hired a WordPress development outsourcing company to maintain your website, this is how they will most likely manage updates. The WordPress core update notifications will still appear in the admin dashboard, but it will simply ask the users to notify their site administrator. If you have professional developers maintaining your site 24×7, they will usually disable them.


I know it may look that way, but trust me, it’s not rocket science. Just remember to define the constant first and then write the filter (wp-config.php is very keen on running in order), and you’re golden.

Author Bio: Lucy Barret is a WordPress developer and a blogger by hobby. She works for a leading WordPress Development Company, HireWPGeeks Ltd. and has a team of expert developers to assist her in every project. You can even follow her company, HireWPGeeks on Facebook.