How to Disable Auto Update Plugins in WordPress Safely

Why Controlling Automatic Plugin Updates Matters for Your WordPress Site

If you need to know how to disable auto update plugins in WordPress, here is the quickest way to do it:

Quick answer — 3 ways to disable automatic plugin updates:

WordPress Dashboard: Go to Plugins > Installed Plugins, then click “Disable auto-updates” next to each plugin (introduced in WordPress 5.5).
Bulk action: Select multiple plugins using the checkboxes, then choose “Disable auto-updates” from the Bulk Actions dropdown.
Code method: Add add_filter('auto_update_plugin', '__return_false'); to your functions.php file to disable all plugin auto-updates at once.

WordPress automatically updates plugins in the background to keep your site secure. Most of the time, that is a good thing. But if you run a business website that depends on specific plugin versions — or you have custom code that could break after an update — those automatic changes can cause real problems.

A plugin update that conflicts with your theme or another plugin can take your site down without any warning. For a small business relying on its website for sales and customer inquiries, even an hour of downtime has a direct cost.

Disabling automatic plugin updates puts you in control of when and how changes happen to your site.

I’m Kevin Gallagher, founder of wpONcall, and over more than fifteen years managing hundreds of WordPress websites, I’ve seen how uncontrolled automatic updates can disrupt otherwise stable sites — which is why how to disable auto update plugins in WordPress is one of the most important things a site owner can learn. In this guide, I’ll walk you through every method available, from simple dashboard toggles to code-level controls.

Quick look at how to disable auto update plugins in wordpress:

Risks and Benefits of Disabling Automatic WordPress Updates

When we talk about managing a WordPress site, updates are always at the center of the security and stability conversation. By default, modern WordPress installations are configured to handle many updates automatically. While this hands-free approach works beautifully for simple blogs, it can introduce significant business risks for more complex websites.

To make an informed decision for your site, it is vital to weigh the pros and cons of turning off this default behavior. Let us explore the risks and benefits of disabling automatic updates, and see how they compare.

The Benefits of Disabling Auto-Updates

The primary benefit of turning off automatic updates is gaining complete control over your website environment. When updates occur automatically in the background, you have no way of knowing exactly when a change is made. If a plugin update introduces a bug or a conflict, your site might break while you are asleep, during a high-traffic marketing campaign, or over a busy holiday weekend.

By taking control of your update schedule, you can:

Prevent Site Breakage: You can test updates in a safe staging environment before applying them to your live site, ensuring that no active features or layouts break.
Protect Custom Code: If you or a developer have made modifications to a plugin’s code (which is generally discouraged but sometimes happens in legacy environments), an automatic update will completely overwrite those changes. Disabling auto-updates protects your custom work.
Maintain E-commerce Stability: For online stores, even a minor checkout glitch caused by a plugin conflict can cost thousands of dollars in lost revenue. Manual updates allow you to run tests and schedule maintenance during your lowest-traffic hours.
Coordinate Troubleshooting: If you apply updates manually, you know exactly which plugin was updated and when. If something goes wrong, you can immediately identify the culprit and roll it back.

For a deeper dive into managing these update schedules, you can read our guide on WordPress Update Management.

The Risks of Disabling Auto-Updates

While control is highly desirable, disabling automatic updates is not without its dangers. In fact, security experts often warn against turning off auto-updates because of the human element involved. If you disable the automatic system, the responsibility of keeping your site secure falls entirely on your shoulders.

The primary risks include:

Security Vulnerabilities: Outdated plugins are the number one entry point for hackers and malicious scripts. If a critical security patch is released for a plugin you use, and you do not install it manually right away, your site remains exposed to exploitation.
Increased Maintenance Time: Instead of letting WordPress handle updates in the background, you must regularly log in, review available updates, perform backups, test changes, and apply them. This can become a time-consuming chore.
Compatibility Lag: Over time, if you neglect your updates, your plugins will fall far behind the core WordPress version. This lag can lead to performance degradation, broken dashboard features, and eventual site failure.

Automatic vs. Manual Updates: At a Glance

To help you decide which approach is best for your business, we have compiled a direct comparison of both strategies:

Feature	Automatic Updates	Manual Updates
Security Responsiveness	Excellent. Patches are applied immediately as they are released.	Dependent on human action. Vulnerabilities remain open until patched manually.
Site Stability	Moderate to Low. Untested updates can conflict with themes or other plugins.	High. Updates are tested in staging before being pushed to the live site.
Time Investment	Zero. The system handles everything in the background.	High. Requires regular monitoring, testing, and manual execution.
Custom Code Safety	Poor. Automatic updates will overwrite any direct modifications to plugin files.	Good. Allows you to preserve, document, or port custom code before updating.
Troubleshooting Difficulty	Hard. It can be difficult to pinpoint which background update caused a sudden issue.	Easy. Since you apply updates one by one, you know exactly what caused the bug.

The choice depends on your technical comfort level and the complexity of your website. If your site is a critical business asset, manual updates paired with a strict testing protocol are almost always the safer bet.

Understanding the WordPress Ecosystem and Update Architecture

To truly appreciate why automatic updates behave the way they do, it helps to understand the underlying architecture of WordPress. WordPress is built on a modular system where the core software, themes, and plugins interact dynamically. When an update is released, it is not just a simple file replacement; it often involves database migrations, changes to hook and filter executions, and updates to third-party API integrations.

When you allow automatic updates, you are trusting that the developers of every single plugin on your site have perfectly anticipated how their code will interact with every other plugin you have installed. In reality, with over 60,000 plugins available in the official repository, testing for every possible combination is impossible. This is why a seemingly minor update to a contact form plugin can sometimes conflict with your page builder or e-commerce checkout system, leading to unexpected layout shifts or broken functionality.

By shifting to a manual update strategy, you respect the complexity of this ecosystem. You acknowledge that your website is a unique software stack that requires deliberate, human-supervised maintenance to remain stable and secure over the long term.

How to Disable Auto Update Plugins in WordPress Using the Admin Dashboard

For most website owners, the easiest and safest way to manage automatic updates is directly through the WordPress admin dashboard. WordPress introduced per-plugin automatic update controls in version 5.5, making it incredibly simple to toggle this feature on or off without writing a single line of code.

To use these built-in controls, you must be logged in as an Administrator. This native interface gives you the flexibility to handle updates on an individual basis or apply changes to your entire plugin library at once.

For official documentation on how these screens operate, you can check out the WordPress Plugin Management Documentation. If you are looking for a quick visual walkthrough of this process, we also recommend reading our dedicated guide on How to Stop Auto Update Plugins in WordPress.

Let us break down the exact steps for both selective and bulk modifications within the WordPress dashboard.

Step-by-Step: How to Disable Auto Update Plugins in WordPress for Specific Add-ons

Sometimes, you do not want to turn off automatic updates for every single plugin. You might have a simple, highly reliable plugin that is perfectly safe to keep on auto-pilot, while a complex plugin like WooCommerce or a custom-built extension needs to be locked down.

Here is how to disable automatic updates for specific plugins:

Log in to your WordPress dashboard.
Navigate to the Plugins menu in the left-hand sidebar and click on Installed Plugins.
Look at the plugin table. On the far right, you will see a column labeled Automatic Updates.
Find the specific plugin you want to modify. If automatic updates are currently active, you will see a green link that says Disable auto-updates.
Click the Disable auto-updates link.
The page will refresh briefly, and the text will change to a gray link that reads Enable auto-updates.

This individual control is excellent for managing legacy extensions or plugins that you know are prone to compatibility issues. By selectively disabling updates for your most complex tools, you keep your site stable while still benefiting from hands-free security patches on your simpler add-ons.

To learn more about how to safely manage these individual updates when you are ready to apply them, refer to The Lazy Developer’s Guide to Automatic WordPress Plugin Updates.

Bulk Actions: How to Disable Auto Update Plugins in WordPress Globally

If you have dozens of plugins installed, clicking the toggle link for each one individually can be tedious. Fortunately, WordPress allows you to change the auto-update status of multiple plugins simultaneously using bulk actions.

Follow these steps to disable automatic updates globally across your site:

Navigate to the Plugins > Installed Plugins screen in your WordPress admin area.
Tick the checkbox at the very top of the table (next to the “Plugin” column header) to select all plugins on the page. Alternatively, you can manually check the boxes next to only the plugins you want to modify.
Locate the Bulk Actions dropdown menu at the top or bottom of the table.
Click the dropdown and select Disable auto-updates.
Click the Apply button next to the dropdown menu.

Once the page reloads, you will see that all the selected plugins now display the gray “Enable auto-updates” text, confirming that automatic updates have been turned off for those items. This is a highly efficient way to instantly halt background updates across your entire site, giving you a clean slate to establish a manual maintenance routine.

For more information on handling your plugins once you have turned off global updates, check out our resource on WordPress Plugin Updates.

Advanced Methods: Disabling Auto-Updates via Code and Configuration Files

While the WordPress dashboard toggles are incredibly convenient, they are not always the best solution for developers, agency owners, or administrators managing multiple client sites. In professional environments, you often want to enforce update rules globally so that client users or junior editors cannot accidentally re-enable updates through the admin interface.

To achieve this level of absolute control, we can use code-based methods. By editing the configuration files of your WordPress installation, you can hard-code your update preferences. This ensures consistent behavior across staging and production environments, and keeps your settings secure from accidental dashboard clicks.

If you want to read community discussions regarding these advanced methods, take a look at the Stack Exchange Discussion on Disabling Core and Plugin Updates. For more technical ways to manage your site configuration, you can also read our guide on how to Turn Off WordPress Auto Update.

Note: Before making any direct modifications to your site’s files, always ensure you have a complete, working backup of your database and website files.

Using wp-config.php to Disable All Automatic Updates

The wp-config.php file is the heart of your WordPress configuration. It resides in the root directory of your WordPress installation and controls database connections, security keys, and developer options. We can add specific PHP constants to this file to disable automatic updates site-wide.

To edit this file, you will need to connect to your server using an FTP client (like FileZilla) or use the File Manager provided by your hosting control panel.

Once you have opened the wp-config.php file in a text editor, locate the line that says:

/* That's all, stop editing! Happy publishing. */

You must place your custom code snippets directly above this line to ensure they execute correctly.

1. Disable All Automatic Updates Globally

If you want to completely disable every single automatic background update on your site — including plugins, themes, WordPress core updates, and translation files — add the following line:

define('AUTOMATIC_UPDATER_DISABLED', true);

This constant acts as a master kill-switch. It overrides all other settings, including dashboard toggles and theme filters, turning off the automatic update engine entirely.

2. Disable Only WordPress Core Updates

If you want your plugins and themes to continue auto-updating, but you want to stop WordPress from updating its own core software automatically, use this constant instead:

define('WP_AUTO_UPDATE_CORE', false);

Alternatively, if you want to allow minor security and maintenance core updates (which are generally very safe) but block major feature releases, you can set this constant to minor:

define('WP_AUTO_UPDATE_CORE', 'minor');

3. Restrict All File Modifications

For maximum security on production environments, you can prevent any file modifications from occurring through the dashboard. This blocks plugin and theme updates, installations, and direct file editing:

define('DISALLOW_FILE_MODS', true);

This is an excellent option for highly secure, developer-managed sites where all updates are deployed via Git or version control. It completely hides the update and installation options from all dashboard users, including administrators.

Using Filters in functions.php for Granular Control

If you want to disable automatic updates programmatically but prefer not to touch the wp-config.php file, or if you want to apply more granular logic, you can use WordPress filters. These filters are typically added to your active theme’s functions.php file or packaged into a custom, must-use (MU) plugin.

Using filters is highly recommended because it keeps your configurations within the WordPress execution flow, allowing you to write conditional logic if needed.

1. Disable All Plugin Auto-Updates

To disable automatic updates for all plugins while leaving core and theme updates untouched, add this filter to your functions.php file:

add_filter('auto_update_plugin', '__return_false');

This simple line intercepts the automatic update check for plugins and tells WordPress to skip them every time.

2. Disable All Theme Auto-Updates

Similarly, if you want to stop WordPress from automatically updating your active and inactive themes in the background, add this filter:

add_filter('auto_update_theme', '__return_false');

3. Selectively Exclude Specific Plugins via Code

What if you want to allow auto-updates for almost all your plugins, but explicitly block updates for one or two specific add-ons using code? You can write a custom filter function that checks the plugin’s path or slug before allowing the update.

WordPress passes an object containing plugin details to the auto_update_plugin filter. We can use this to build an exclusion list. Here is an example of how to write this in your functions.php file:

function custom_selective_plugin_updates($update, $item) { $excluded_plugins = array('woocommerce/woocommerce.php', 'contact-form-7/wp-contact-form-7.php'); if (in_array($item->plugin, $excluded_plugins)) { return false; } return $update; } add_filter('auto_update_plugin', 'custom_selective_plugin_updates', 10, 2);

In this snippet, we define an array of plugin file paths that we want to exclude. When WordPress checks for an automatic update, our function intercepts the request. If the plugin matches an entry in our exclusion list, it returns false, blocking the update. For all other plugins, it allows the default behavior.

For community insights on implementing this exact programmatic approach, check out the discussions on the Stack Exchange thread about excluding plugins from automatic updates and the guide to turning off auto-update for a single plugin.

Creating a Must-Use (MU) Plugin for Permanent Configuration

When you add filters to your theme’s functions.php file, those filters are tied directly to that specific theme. If you switch themes in the future, or if your theme receives an update that overwrites your custom modifications, your auto-update filters will be lost. To prevent this, developers use Must-Use (MU) plugins.

Must-Use plugins are installed in a special directory (wp-content/mu-plugins) and are automatically loaded by WordPress before normal plugins or themes. They cannot be disabled from the WordPress dashboard, making them incredibly secure and permanent.

To create an MU plugin to disable plugin auto-updates:

Connect to your server using FTP or your hosting File Manager.
Navigate to the /wp-content/ directory. If a folder named mu-plugins does not exist, create it.
Inside the mu-plugins folder, create a new file named disable-auto-updates.php.
Open the file in a text editor and add the following code:
Save and upload the file.

Once uploaded, this code will run continuously in the background, completely independent of your active theme. If you log into your WordPress dashboard and navigate to Plugins > Must-Use, you will see your new plugin listed there, ensuring your configuration remains locked down and tamper-proof.

Best Practices for Manually Managing WordPress Updates

Once you have successfully disabled automatic updates, you are in the driver’s seat. However, this means you can no longer ignore your website’s maintenance. Outdated plugins are a massive security risk, so you must establish a reliable, manual update routine to keep your site safe, fast, and fully functional.

At wpONcall, we have managed thousands of manual updates for businesses in Santa Rosa, CA, and beyond. Over the years, we have developed a strict set of best practices that eliminate the risk of site breakage.

To implement a professional manual update workflow, follow these essential steps:

Create a Dedicated Schedule: Do not update plugins randomly whenever you happen to log in. Set aside a recurring window — such as every Tuesday morning or bi-weekly — to perform your updates. This ensures updates are handled regularly and allows you to warn your team of scheduled maintenance.
Always Perform a Full Backup First: Before clicking “Update” on any plugin, ensure you have a fresh, complete backup of both your database and your website files. If an update fails or causes a critical error, you need to be able to restore your site immediately.
Utilize a Staging Environment: For business-critical sites, never update plugins directly on your live production site. Set up a staging site (a private clone of your live website), apply the updates there first, and thoroughly test your site’s functionality. Only push the changes to your live site once you are 100% sure everything works perfectly.
Update Plugins Individually: It is tempting to use the bulk update feature, but doing so makes troubleshooting incredibly difficult. If you update ten plugins at once and your site breaks, you will have to spend hours figuring out which one caused the issue. Update them one by one, checking your site’s front-end after each update.
Review Changelogs and Release Notes: Before updating a major plugin, read its changelog. Look for notices about major database migrations, deprecated features, or compatibility requirements. If a plugin release ends in .0 (such as version 5.0.0), it is often wise to wait a few weeks for minor bug patches (like 5.0.1 or 5.0.2) before updating.
Monitor Site Health and Security: Keep a close eye on security bulletins. If a plugin you use is found to have a critical, active vulnerability, you must update it immediately, regardless of your scheduled maintenance window.

For a detailed look at the different ways to execute manual updates, check out our guide on How to Update WordPress Plugins: 5 Quick Methods. To learn more about managing version compatibility, you can also read our resource on WordPress Plugin Version Management.

Setting Up a Local Development Environment for Testing

For advanced users and developers, testing updates on a live staging server is excellent, but testing locally on your own computer is even faster and more secure. A local development environment allows you to clone your production website onto your local machine, where you can run updates, modify code, and debug errors without needing an active internet connection or risking server resources.

Tools like LocalWP, DevKinsta, or Lando make it incredibly easy to spin up a local copy of your WordPress site in minutes. Once your local site is running, you can import a backup of your live site, apply all pending plugin updates, and use developer tools like the Chrome DevTools console or PHP debugging extensions to catch any silent errors or deprecated notices.

By integrating local testing into your manual update workflow, you add an extra layer of defense. You can confidently resolve conflicts, refactor custom code, and verify layout integrity before any changes ever touch a public-facing server. This level of rigor is what separates amateur site management from professional, enterprise-grade web operations.

Frequently Asked Questions About WordPress Auto-Updates

Managing WordPress updates can raise a lot of questions, especially when you start editing configuration files or modifying default behaviors. Here are answers to some of the most common questions we receive from website owners.

How do I re-enable automatic updates after disabling them?

Re-enabling automatic updates is just as simple as turning them off. The method you use depends on how you disabled them in the first place:

If disabled via the Dashboard: Go to Plugins > Installed Plugins, select the plugins you want to update automatically, and click Enable auto-updates in the right-hand column. You can also use the bulk actions dropdown to enable them for all plugins at once.
If disabled via wp-config.php: Open your wp-config.php file and locate the constant you added. You can either delete the line entirely or change its value to false (or remove AUTOMATIC_UPDATER_DISABLED entirely to restore default behavior).
If disabled via filters: Open your theme’s functions.php file and remove the filter lines, such as add_filter('auto_update_plugin', '__return_false');. Once removed, WordPress will revert to its default background update behavior.

How do I stop receiving email notifications for automatic updates?

By default, WordPress sends an email notification to the site administrator every time a plugin or theme successfully updates in the background. If you have auto-updates enabled for some plugins, these emails can quickly clutter your inbox.

To disable these notification emails completely, you can add a simple filter to your theme’s functions.php file:

add_filter('auto_plugin_update_send_email', '__return_false');

If you want to stop receiving notification emails for theme updates as well, add this line:

add_filter('auto_theme_update_send_email', '__return_false');

For core WordPress updates, you can use:

add_filter('auto_core_update_send_email', '__return_false');

To learn more about managing your inbox and configuring these settings, read our guide on How to Stop WordPress Plugin Update Emails.

Can I disable automatic updates for themes and core as well?

Yes, you have complete control over all aspects of WordPress updates.

For themes, you can disable auto-updates directly from the dashboard. Go to Appearance > Themes, click on your active theme’s thumbnail to open the details modal, and click the Disable auto-updates link located just below the theme author’s name.

For WordPress core, the safest approach is using the wp-config.php constants we discussed earlier. Setting define('WP_AUTO_UPDATE_CORE', false); will block all automatic core updates. However, we highly recommend keeping minor updates enabled (by setting the constant to 'minor') so that your site continues to receive critical security patches automatically without risking major layout or feature disruptions.

For more detailed information on how WordPress handles theme and core auto-updates, refer to the WordPress.org Guide on Plugin and Theme Auto-Updates. You can also explore alternative approaches in the WPBeginner guide on disabling automatic updates or the Brizy.io tutorial on WordPress updates.

Conclusion

Taking control of your website’s updates is a major step toward building a highly stable, professional online presence. Whether you choose to use the built-in WordPress dashboard toggles, apply bulk actions, or write custom filters in your configuration files, disabling automatic updates ensures that no unexpected changes can take your site down without your knowledge.

However, as we have discussed, disabling auto-updates comes with a serious trade-off: you must now commit to a rigorous, manual maintenance schedule. For busy business owners, finding the time to perform weekly backups, manage staging environments, test plugin updates individually, and monitor security bulletins is incredibly difficult.

That is where we come in. At wpONcall, based in Santa Rosa, CA, we specialize in comprehensive WordPress website security and support. We provide daily updates, professional backups, and unlimited support to keep your site running flawlessly. Our expert team takes the burden of manual update management completely off your shoulders, ensuring your site remains secure, fast, and fully optimized — giving you absolute peace of mind to focus on growing your business.

Ready to secure your website and leave the stress of updates behind? Explore our wpOncall WordPress Maintenance and Support Services today and let our experts handle the heavy lifting.