WordPress auto-updates: what I leave on automatic and what I don't, so I never wake up to a dead site

Automatic updates in WordPress are one of the best and one of the most dangerous settings in the whole admin panel. Good, because they close security holes without you lifting a finger. Dangerous, because one morning you can open your site and find a white screen, a dead checkout, or a wrecked layout — without having touched a thing.

The truth is that not everything carries the same risk. A core security patch is a completely different category from a big jump in Elementor or WooCommerce. This article gives you a simple, component-by-component rule: what to leave on auto with peace of mind, what to keep on manual, and what safety net has to exist before you rely on automation. No jargon, no needless fear.

The basic rule: how much does it hurt if it breaks

Before any setting, run each component through three questions: does it touch money, does it touch the look, or does it touch the whole site?

• Touches money — the cart, checkout, payments (WooCommerce and its related plugins). A mistake here means lost orders. Keep on manual.
• Touches the look — page builders (Elementor, WPBakery), themes, design plugins. An update can move or break entire sections. Keep on manual or test first.
• Touches the whole site — WordPress core major versions and the PHP version. High risk, but rare.

The rest — small plugins, utilities, security — are usually safe on auto. The short rule: automate what's minor and has no visible impact, keep on manual anything that touches money, layout, or the entire site.

WordPress core: minor YES, major with care

WordPress splits updates into minor and major, and the difference matters enormously.

Minor versions (for example 6.4.1 to 6.4.2) are almost always security and bug fixes. They're small, well tested, and hard to break. Leave these on auto with confidence — in fact WordPress applies them automatically by default, and that's a good thing.

Major versions (6.4 to 6.5) bring new features and changes that can conflict with plugins or your theme. Don't put these on auto for a site that makes money. Wait a week or two after release, check on a test environment, then update manually. The PHP version is not a WordPress update — your host manages it and it's tested separately, never blindly.

Plugins: the green list and the red list

This is where most battles are fought, because a single badly updated plugin can take down the whole site.

Green list (auto is fine): small, mature plugins with one clear job — security, a simple form, an SEO utility, anything that doesn't draw the page. The popular, actively maintained ones patch holes quickly and rarely break anything.

Red list (keep on manual): WooCommerce and its extensions, page builders, caching plugins, and anything the look or the checkout depends on directly. These have many moving parts, and they're exactly the ones that hit your sales if they break.

A good compromise: turn on auto-update only for the green-list plugins, keep email notifications on for the rest, and reserve one day a month for the red-list ones.

Themes: rarely a problem, with one exception

Themes update far less often than plugins, so they're not the main headache. With one important exception: if someone edited the main theme's files directly instead of using a child theme, an update will wipe out those changes and the site can suddenly look different.

If you have a properly built child theme, updating the parent theme is usually safe and you can leave it on auto. If you're not sure how the site was built, treat themes as red list and update manually, with a backup taken beforehand. It's the kind of detail a poorly built site hides until the day it costs you.

The safety net without which auto-update is a lottery

Automatic updating is only safe if you have something to fall back on when something breaks. Without this net, you're automating the risk, not the work.

• A daily automatic backup, stored somewhere other than the server, with one-click restore.
• A test (staging) environment for big changes, so you're not experimenting on the live site.
• Uptime monitoring that messages you when the site goes down, so you find out first, not your customers.
• Email notifications for every applied update, so you know what changed and when.

That's what our approach at MPO Web Studio looks like: we build on infrastructure with backup and monitoring included, we work fully remotely across the whole country, and we keep the small things on auto and the money-touching ones on manual. If you're not sure what's safe to leave automatic on your site, send us a message on WhatsApp and we'll tell you honestly, component by component.