How to Disable WordPress Automatic Updates for a Stable Site

Quick summary

Disabling WordPress automatic updates can be a sound strategy for businesses that want stability and control. Since WordPress 5.6, major updates have been enabled by default, which means the core of the system can update itself with no manual intervention. That improves security, but the same automation can create incompatibilities between plugins, themes and PHP versions, sometimes causing critical errors or a site nobody can reach.

The risks include the white screen of death, functional bugs, reset configurations and data loss. On high-traffic sites and WooCommerce stores, one untested update can mean serious financial losses. Several methods let you keep these updates under control: settings in the dashboard, constants in the wp-config.php file, filters through functions.php, or dedicated plugins.

That said, switching automatic updates off entirely leaves you exposed to vulnerabilities if no maintenance protocol is in place. A balanced approach allows only minor security releases while major versions are scheduled after testing.

At CyberPerformance, we favour structured maintenance with compatibility testing before every deployment. We also offer alternative architectures built on NextJS and NodeJS, which reduce plugin dependency and minimize the risks tied to automatic updates, while improving performance and security.

Quick links by section

1. Why disable WordPress automatic updates
   
   
2. How to disable WordPress core automatic updates
   
   
3. How to stop WordPress plugin automatic updates
   
   
4. How to disable theme automatic updates
   
   
5. A more stable alternative: NextJS and NodeJS sites with CyberPerformance
6. Conclusion
   
   
7. FAQ

Disabling WordPress automatic updates can be a sound strategy for businesses that want stability and control. Since WordPress 5.6, major updates have been enabled by default, which means the core of the system can update itself with no manual intervention. That improves security, but the same automation can create incompatibilities between plugins, themes and PHP versions, sometimes causing critical errors or a site nobody can reach.

The risks include the white screen of death, functional bugs, reset configurations and data loss. On high-traffic sites and WooCommerce stores, one untested update can mean serious financial losses. Several methods let you keep these updates under control: settings in the dashboard, constants in the wp-config.php file, filters through functions.php, or dedicated plugins.

That said, switching automatic updates off entirely leaves you exposed to vulnerabilities if no maintenance protocol is in place. A balanced approach allows only minor security releases while major versions are scheduled after testing.

At CyberPerformance, we favour structured maintenance with compatibility testing before every deployment. We also offer alternative architectures built on NextJS and NodeJS, which reduce plugin dependency and minimize the risks tied to automatic updates, while improving performance and security.

1. Why disable WordPress automatic updates
   
   
2. How to disable WordPress core automatic updates
   
   
3. How to stop WordPress plugin automatic updates
   
   
4. How to disable theme automatic updates
   
   
5. A more stable alternative: NextJS and NodeJS sites with CyberPerformance
6. Conclusion
   
   
7. FAQ

Disabling WordPress automatic updates is becoming a necessity for many site owners who keep running into unexpected problems. Since WordPress 5.6, automatic major updates have been enabled by default, and our experience shows that these background updates can occasionally break your site in rare cases. At CyberPerformance, we build websites with NextJS and NodeJS, an approach that reduces the odds of finding your site down after a forced update. Our maintenance service includes robust security protocols with deployments scheduled after compatibility testing, so your site stays stable and your exposure to known vulnerabilities goes down.

At CyberPerformance, we are a firm specialized in artificial intelligence automation development, serving the entire province of Quebec, mainly in the Lévis and Québec City regions. Our expertise lets us integrate custom AI solutions that improve productivity and reduce operating costs. With close to 42% of the Canadian workforce needing to reskill to keep pace with the growth of AI over the next three years, our unique prototyping methodology (MVP) helps businesses adopt these technologies effectively. Digital automation also increases productivity, quality and safety across many sectors, which explains why more than 70% of Canadian organizations are already exploring or deploying AI initiatives. We use Google Meet for screen sharing and Asana to keep our clients informed of progress at every stage of the project, which gives complete transparency to our intelligent process automation work.

Why disable WordPress automatic updates

The risk of incompatibilities between plugins and themes

WordPress rests on an ecosystem where every plugin and theme comes from a different developer working to their own coding standards. That independence creates potential conflicts between plugins, between a plugin and your theme, or between those elements and the WordPress core. One plugin may use an older version of a JavaScript library while another relies on a newer one, producing errors that stop certain features from working.

These incompatibilities often surface right after an automatic update. Plugin X and theme Y worked well together, but once Ivan changed his code, the two no longer get along. In practice, with automatic updates you do not control when those changes land.

WordPress site broken after an automatic update

The main risk of automatic updates is still the conflict or bug that makes your site unreachable. We have seen real cases where a client lost access to their site for two days because an extension updated itself automatically and was no longer compatible with the PHP version running on their host. That situation caused a loss of traffic and required emergency work.

From a simple bug to a site that is completely down, the common problems include the white screen of death, critical error messages, and broken layouts. With automatic updates, several plugins can update within the same window, which means extra testing to identify the culprit. Without a testing phase, updates apply straight to your production site.

Data loss and reset configurations

Some plugins tied to forms, security or caching wipe custom settings during automatic updates. Your CSS changes can disappear if you made them directly in your theme code. WordPress core files can overwrite your custom modifications during an update.

On top of that, some extensions add third-party service integrations, user tracking or privacy compliance changes. In automatic mode, these changes go unnoticed and you expose your site or your users without knowing it.

WordPress updates itself without my permission

Since WordPress 5.6, automatic major updates have been enabled by default. That version quietly turned on automatic updating for the main WordPress core versions, moving from 5.6 to 5.7, for example. You do not always receive an automatic notification when your site has been updated.

For WordPress maintenance companies and web developers looking after many client sites, there should be a testing process before a new update is applied by default. Automatic updates do not take compatibility warnings into account, so they install bugs unintentionally.

Impact on high-traffic sites

For high-traffic sites that cannot afford any downtime, automatic updates carry major risks. An update that causes even a small problem can mean lost sales or fewer visitors. If you run a WooCommerce online store and do not want to lose orders to a broken site, you should turn these automatic updates off.

A WooCommerce install that is never updated can produce cart or checkout errors, but an untested automatic update can produce exactly the same problems. Downtime has costly consequences when it hits large volumes of visitors or leaves checkout pages losing you revenue every second you are offline.

How to disable WordPress core automatic updates

Several methods let you disable WordPress core automatic updates, each offering a different level of control. We do have to point out, though, that switching these updates off completely creates security holes that attackers can exploit. At CyberPerformance, we build websites on NextJS and NodeJS, an approach that proves more secure once certain security protocols are in place and reduces the odds of finding a website offline after a forced update.

Disable through the admin interface

Go to Dashboard, then Updates. A link lets you switch between two states: enable automatic updates for all new versions of WordPress, or switch to maintenance and security releases only. This simple method requires no code changes and gives you immediate control over update behaviour.

By choosing maintenance and security releases only, WordPress will no longer apply major versions automatically. You keep the security patches while avoiding the major changes that could break your site.

Block major updates with wp-config.php

To stop WordPress from updating itself to major versions, add this line to your wp-config.php file:

define( 'WP_AUTO_UPDATE_CORE', false );

This constant disables every core update, including development, minor and major versions. In practice, you completely block the WordPress auto-update for the system core. Note that some hosting providers may update the core automatically after a certain period, but this constant prevents that behaviour.

Enable minor updates only

The 'minor' value is a balanced compromise between security and stability. Add this line to your wp-config.php file:

define( 'WP_AUTO_UPDATE_CORE', 'minor' );

This configuration enables minor updates while disabling development and major updates. Minor releases such as 6.1.1 or 6.1.2 generally contain security fixes without changing core functionality. This approach reduces the risk of incompatibility while keeping your site protected against known vulnerabilities.

Disable all automatic updates

To block automatic updates on WordPress completely, use this constant:

define( 'AUTOMATIC_UPDATER_DISABLED', true );

This line disables every type of automatic update, including the core, plugins, themes and translations. Ultimately, this method gives you total control but demands constant vigilance to apply security patches by hand.

Our service offering at CyberPerformance includes maintenance, where we deploy updates at strategic times planned with our clients after compatibility testing. This approach with NextJS and NodeJS keeps your site working with no unpleasant surprises.

How to stop WordPress plugin automatic updates

Disabling automatic updates for WordPress plugins creates security holes that attackers can exploit, but the approach is still necessary if you want control over your environment. At CyberPerformance, we build websites on NextJS and NodeJS. Our experience has shown that this is more secure once certain security protocols are in place, and it reduces the odds of finding a website offline because a forced update was deployed.

Disable plugin automatic updates from the dashboard

WordPress natively includes automatic update management for each extension. Go to Plugins, then note the Automatic Updates column, which contains an Enable auto-updates action link. Use this link to turn automatic updates on or off plugin by plugin. Once enabled, automatic updates can be turned off at any time using the Disable auto-updates link.

Bulk actions let you manage several plugins at once. Select the plugins you want to enable or disable using the checkbox in the first column of the table that lists the extensions. Then choose the action to perform and click the Apply button.

Use a mu-plugin to block updates

The [plugins_auto_update_enabled](https://wpchannel.com/wordpress/tutoriels-wordpress/desactiver-mises-jour-automatiques/) filter was introduced with WordPress 5.5. It makes it easy to enable or disable the automatic update management interfaces for plugins and themes. You can copy these lines of code into a mu-plugin or, if you must, into your theme's functions.php file, although that is not recommended.

Must-use plugins (mu-plugins) are plugins installed in a specific /wp-content/mu-plugins directory, and they are activated automatically on every site when the WordPress loading script runs. They cannot be deactivated any other way than by deleting the file in the must-use plugins directory.

Manage updates plugin by plugin

Easy Updates Manager lets you change the settings individually for each plugin. The free Disable All WordPress Updates plugin completely disables theme and plugin updates as well as the WordPress core update check system. The plugin also stops WordPress from checking for updates, cron jobs included, and prevents any notification to users.

With NextJS and NodeJS, our service offering includes maintenance and we deploy updates at strategic times planned with our clients after compatibility testing.

How to disable theme automatic updates

The process for themes is similar to the one for plugins, with a few specifics of its own. Blocking automatic updates on WordPress for your themes creates security holes that attackers can exploit; on the other hand, the practice protects you against unplanned changes to your visual appearance.

Disable through the Appearance interface

Go to your back office under the Appearance > Themes tab. Hover over a theme to reveal the Theme Details button, then click it. You will find the same link as for plugins, letting you toggle between enabling and disabling automatic updates. Click Enable auto-updates to turn the feature on, or Disable auto-updates to turn it off.

This user interface method offers individual control theme by theme. If you enabled automatic updates by mistake, simply reverse the state by clicking the link again.

Block with a filter in functions.php

To disable the WordPress dashboard user interface for theme automatic updates, add this filter to your site:

add_filter( 'themes_auto_update_enabled', '__return_false' );

The themes_auto_update_enabled filter was introduced with WordPress 5.5 and makes it easy to enable or disable the automatic update management interfaces for themes. You can paste these lines of code into a mu-plugin, but you can also add them through your functions.php.

An alternative is to use the following filter in your functions.php file:

add_filter( 'auto_update_theme', '__return_false' );

Prevent WooCommerce automatic updates

To block the update of one specific plugin such as WooCommerce, add this code to your functions.php file:

function block_plugin_update( $value )

add_filter( 'site_transient_update_themes', 'block_plugin_update' );

Replace "theme-slug" with the name of your theme folder, which you will find by connecting to your server over SFTP or in the style.css file next to "Theme name".

At CyberPerformance, we build websites on NextJS and NodeJS. Our experience has shown that this is more secure once certain security protocols are in place, and it reduces the odds of finding a website offline because a forced update was deployed.

A more stable alternative: NextJS and NodeJS sites with CyberPerformance

Why NextJS and NodeJS reduce the odds of a site going down

Sites built with NextJS deliver performance up to 10 times higher thanks to server-side rendering and static generation. Pre-generated pages load instantly from a CDN, with no connection to an exposed database. This architecture removes the unexpected outages caused by plugin conflicts or forced updates.

Security protocols and planned maintenance

NextJS shrinks the attack surface by removing the vulnerable admin panel and the direct database connections. Our protocols include regular backups and continuous monitoring to catch the signs of failure early. Systematic maintenance strengthens reliability and protects the continuity of your business.

Compatibility testing before deployment

We verify functionality, performance and compatibility across different browsers and devices before every deployment. Testing surfaces the specific problems and guarantees a consistent user experience. Every feature is validated so bugs never reach production.

Updates at strategic times with our clients

Our updates require only monthly npm dependency updates. Unlike WordPress, everything is tested before it goes live, with no downtime and no surprises. We plan these interventions with you to keep the impact on your business to a minimum.

Conclusion

Disabling WordPress automatic updates gives you back control over your site, but in reality this approach creates security holes that attackers can exploit. At CyberPerformance, we build websites on NextJS and NodeJS, a more secure solution once certain security protocols are in place.

Our service offering includes maintenance, with updates deployed at strategic times planned with our clients after compatibility testing. This approach dramatically reduces the odds of finding a website offline because a forced update was deployed, while keeping security at its best.

Request your free quote

FAQ

Q1. How do I disable WordPress automatic updates? You can disable automatic updates in several ways: through the WordPress dashboard by going to the Updates section, by adding constants to the wp-config.php file, or by using specific filters for plugins and themes. Each method offers a different level of control depending on what you need.

Q2. Why should I disable automatic updates on my WordPress site? Automatic updates can create incompatibilities between plugins and themes, sometimes leaving a site nobody can reach. On high-traffic sites and online stores, one untested update can cost you revenue. Disabling these updates lets you test the changes before they are applied in production.

Q3. How do I block only the major WordPress updates? Add the line define( 'WP_AUTO_UPDATE_CORE', 'minor' ); to your wp-config.php file. This configuration keeps the minor security updates while blocking the major versions that could introduce significant changes and incompatibilities.

Q4. Is it risky to disable automatic updates entirely? Yes. Disabling automatic updates entirely creates security vulnerabilities that attackers can exploit. It is best to keep at least the security updates active, or to put a regular maintenance protocol in place so the necessary patches are applied by hand.

Q5. How do I manage plugin automatic updates individually? In the WordPress dashboard, go to the Plugins section, where you will find an "Automatic Updates" column. You can enable or disable automatic updates for each plugin individually by clicking the matching link, or use bulk actions to manage several extensions at once.