Reference guide · wordpress · Published 2026-08-16 · 3 min read
Configuring WordPress core auto-updates
Set up WordPress core auto-updates: what installs by default, how WP_AUTO_UPDATE_CORE and AUTOMATIC_UPDATER_DISABLED behave, and how version control changes the rules.
- ·What updates on its own
- ·The WP_AUTO_UPDATE_CORE constant
- ·Version control changes the default
What WordPress updates on its own
WordPress has installed minor core releases automatically in the background since version 3.7. A minor release is the third number in the version: moving from 6.5.1 to 6.5.2 applies a bug fix or security patch without changing the feature set. These releases are designed to be safe without a test pass, and they install the same day they publish if the update mechanism can reach wordpress.org and write to the site files.
By default a fresh install from WordPress 5.6 onward also applies major core releases automatically, unless WordPress detects the site lives in a version control checkout. An install that predates 5.6 keeps the older behaviour: only minor releases and translation files update on their own. Because the default differs by install age, the correct move is to set your policy explicitly rather than rely on what the site happened to inherit.
The WP_AUTO_UPDATE_CORE constant
Define the WP_AUTO_UPDATE_CORE constant in wp-config.php, above the "stop editing" line, to state the policy in one place:
// Security and maintenance releases install automatically; major releases stay manual.
define( 'WP_AUTO_UPDATE_CORE', 'minor' );The constant takes three values:
| Value | Behaviour |
|---|---|
true | Minor, major, and development updates all install automatically |
'minor' | Only minor and security releases install automatically |
false | No core updates install automatically at all |
When the constant is set, it overrides the automatic-update toggles shown on the Updates screen in wp-admin, so it is the single source of truth for the site. For most production sites the 'minor' value is the practical middle ground: security patches arrive without waiting for a human, while a major release waits because it is a feature change that deserves a test pass first.
Plugins and themes are separate
WP_AUTO_UPDATE_CORE affects only core. Plugin and theme auto-updates are controlled separately, through the settings screens and through the auto_update_plugin and auto_update_theme filters. In most cases WordPress only auto-updates a plugin or theme automatically when the directory flags a security or compatibility issue, and the UI lets you opt in per item. If you want nothing to update on its own, plugin or theme included, you need the AUTOMATIC_UPDATER_DISABLED constant set to true; that flag overrides core, plugin, and theme updates together, so treat it as the off switch for the whole background updater.
If a major release does auto-apply and breaks the site, the update on a 500 guide covers recovery, and the release-notes checklist helps you prepare for a manual major update. The wp-config advanced constants reference lists the other constants that guard file modifications and update access.
Version control changes the default
A hidden .git directory (or Subversion metadata) changes the rules. When WordPress detects a version control checkout, it disables automatic core updates by default as a safety measure, because a background write to files under version control can leave the working tree out of sync with what is committed. The repo-based deployment guide describes the workflow that keeps that state correct. If your site is built from a repository, let the deployment pipeline own the update, so the automatic updater and the repo never fight over the same files.