Yes for small, well-kept plugins whose updates are mostly fixes; no for the store, the page builder and anything with add-ons, which should be updated by hand after testing. Either way, someone checks afterwards.

Updates nobody presses

WordPress installs its own minor security releases automatically, and has since 2013. Plugins are different. Unless something is set up to do it, they wait for someone to press update.

On plenty of sites that wait is long. The dashboard fills with notices nobody reads, and plugins with known security holes sit there for months.

So some sites are set to update plugins automatically, through a line of code, a management plugin or a service from whoever looks after the site. Fixes then arrive within a day, with nobody involved.

That is the attraction, and also the risk.

What automatic updates get right

Most plugin updates are small: a bug fixed, a security hole closed, a change to keep up with the latest WordPress. Applying them promptly is almost always right.

Attacks on WordPress sites mostly use flaws that have already been fixed, aimed at sites that never installed the fix. A plugin that updates itself the day a fix appears closes that gap.

For a site whose owner rarely logs in, automatic updates on the right plugins are far safer than none.

What can go wrong overnight

The second is the one that catches online stores. A store plugin and its payment or shipping add-ons often come from different authors, and for a few days the newest version of one may not work with the other.

Nobody is watching at night

Automatic updates run whenever WordPress next checks, which can be any hour, and unless someone has set up a report, nobody is told a plugin has changed.

A problem caused at three in the morning is found by whoever next looks at the right page. On a quiet site, that might be a customer, days later.

And the cost depends on the page. A broken blog post is an embarrassment. A broken checkout or booking form loses business every hour until somebody notices.

Which plugins can update themselves

Small plugins that do one contained job are the safest to automate: a spam filter, a redirect manager, a plugin that makes backups.

Look for a long record of uneventful updates, an author who releases regularly, and a plugin that changes neither how pages look nor how money is taken.

Security plugins belong here as well. A fix to the thing guarding the site is exactly the update that should not sit in a queue.

Which plugins need a person

Some plugins carry too much of the site to update unseen. The store plugin and every add-on attached to it. The page builder that lays out every page. Booking, membership and payment forms.

Anything the theme has customised belongs here too. Many themes carry their own copies of a store plugin's page templates, and those copies can break when the plugin changes beneath them.

These are updated on purpose: on a staging copy of the site first, a private duplicate where breakage costs nothing, then on the live site at a quiet time with a fresh backup.

Major versions deserve the most care. The release notes usually say when an update is a big one, and that is the one to test hardest.

A worked example

A ski and snowboard shop sells boards, boots and outerwear in store and through an online shop on its WordPress site. Nearly all its online sales fall between October and March.

Its developer had set every plugin to update automatically, which kept the site patched through a busy season without anyone logging in.

One night last November, the store plugin updated itself to a new major version. The theme's copies of the product templates were written for the old one, and the size selector vanished from every product page.

Boots and jackets could not be added to the cart. The shop found out two days later, when a customer phoned to ask how to order a size.

The developer rolled the store plugin back the same day and rewrote the templates the following week, on a staging copy.

Now the store plugin, its add-ons and the page builder are updated by hand, staging first, while the small plugins still update themselves. This year's big updates are being done in July, when there are fewest orders to lose.

Someone still has to look

Automatic or not, every update needs a person to look at the site afterwards. That is the part automation does not replace.

The check is short: the home page, a product or service page, the contact form sent for real, and the cart or booking taken as far as payment. Five minutes, the morning after.

An uptime monitor, which requests the home page every few minutes and emails when an error comes back, catches the worst failures at any hour. It will not notice a missing button, which is why the person stays.

Backups you can actually restore

Any update plan rests on being able to undo it. A nightly backup of files and database, kept somewhere other than the server, is the minimum.

Restoring the entire site to undo one plugin also loses any orders taken since the backup, so being able to roll back a single plugin matters as well.

Ask whoever maintains the site how long a restore takes, and when they last tried one.

The counter-case

A very simple site, with a handful of small plugins and no store or bookings, can reasonably update everything automatically, as long as someone looks at it each week.

A site maintained by someone who logs in several times a week may not need automation at all. Prompt manual updates do the same job with a person present.

What no site can do safely is update its most important plugins unseen and never check. Automate the small ones, update the big ones by hand, and make sure someone looks.

Sorting your plugins

  1. List every plugin on the site.
  2. Mark the ones that take money or build pages.
  3. Update those by hand, on a staging copy first.
  4. Let small, well-kept plugins update themselves.
  5. Delete plugins nobody uses any more.
  6. Check key pages the morning after updates.
  7. Test a restore before you need one.

Step two is the decision the whole arrangement rests on. Anything that can lose an order or wreck a layout goes on the manual list, and the rest can look after itself.

The same caution applied to major WordPress releases is covered in WordPress 4.8 arrives with new widgets.

Frequently asked questions

Does WordPress update plugins automatically?

Not by default. It installs its own minor security releases automatically, but plugins wait for someone to press update unless code, a plugin or a service is set up to do it.

Which plugins are safe to update automatically?

Small plugins that do one contained job, with a long record of uneventful updates, such as spam filters and redirect managers. Nothing that builds pages or takes money.

Which plugins should be updated by hand?

The store plugin and its add-ons, the page builder, and booking, membership or payment forms. Test them on a staging copy first, and only then on the live site.

Why do store add-ons cause trouble?

A store plugin and its payment or shipping add-ons often come from different authors, and for a few days the newest version of one may not work with the other.

What should be checked after updates?

The home page, a product or service page, the contact form sent for real, and the cart or booking taken as far as payment. Five minutes, the next morning.

Is uptime monitoring enough on its own?

No. Monitoring catches a site that returns errors, at any hour, but it will not notice a missing button or a form that quietly fails. A person still has to look.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Plugins updating with nobody watching?

Send us your plugin list. We will sort which can update themselves and which need testing first.

Start a Conversation