Title: Auto Updates?
Last modified: August 21, 2016

---

# Auto Updates?

 *  [Marj Wyatt](https://wordpress.org/support/users/marjwyatt/)
 * (@marjwyatt)
 * [12 years, 3 months ago](https://wordpress.org/support/topic/auto-updates/)
 * I was just alerted that one of my sites updated. I understand I can disable this
   but, frankly, I’m alarmed that this feature was implemented.
 * I do not allow any software to update automatically in my home office. I maintain
   the websites of many clients and I always perform a backup before updating their
   sites so I have a recovery path if a plugin fails or something else.
 * Thanks to this new “feature” I now have a lot of unplanned work to do because
   I have to modify the wp-config file to disallow this function for every site 
   that I maintain.
 * I understand that old code is high risk, and I have educated my clients to understand
   this too. But the fact of the matter is that there have been WP upgrades which
   have NOT gone smoothly and I’ve been very glad that I waited a couple of weeks
   for the bugs to be worked out.
 * This, in my professional opinion, is NOT a good idea … not at all a good idea.
 * I take responsibility for not reading through the 3.8 release notes and taking
   action then to stop this intrusive functionality.
 * <end_rant>

Viewing 15 replies - 61 through 75 (of 98 total)

[←](https://wordpress.org/support/topic/auto-updates/page/4/?output_format=md) [1](https://wordpress.org/support/topic/auto-updates/?output_format=md)
[2](https://wordpress.org/support/topic/auto-updates/page/2/?output_format=md) [3](https://wordpress.org/support/topic/auto-updates/page/3/?output_format=md)
[4](https://wordpress.org/support/topic/auto-updates/page/4/?output_format=md) 5
[6](https://wordpress.org/support/topic/auto-updates/page/6/?output_format=md) [7](https://wordpress.org/support/topic/auto-updates/page/7/?output_format=md)
[→](https://wordpress.org/support/topic/auto-updates/page/6/?output_format=md)

 *  [Andrew Nevins](https://wordpress.org/support/users/anevins/)
 * (@anevins)
 * WCLDN 2018 Contributor | Volunteer support
 * [12 years, 3 months ago](https://wordpress.org/support/topic/auto-updates/page/5/#post-4538059)
 * > Since when did it become WordPress’ or **your** responsibility to insure that
   > everyone’s site was “up to date?
 * Who do you think I am?
 * The idea of automatic updates is that WordPress think it’s their responsibility
   to ensure sites are up-to-date in terms of security.
 *  [Chip Bennett](https://wordpress.org/support/users/chipbennett/)
 * (@chipbennett)
 * [12 years, 3 months ago](https://wordpress.org/support/topic/auto-updates/page/5/#post-4538060)
 * All:
 * Personally, I agree with you that WordPress should expose options for ALL automatic
   updates, without needing to use a Plugin to expose those options. But the core
   dev team disagrees, so you’ll have to expose (or manage) those options yourself,
   via the filters provided by core.
 * If you want to go the Plugin route, I maintain the [Update Control Plugin](http://wordpress.org/plugins/update-control/)
   first written by George Stephanis.
 * If you want simple control on your own end, well, you’ll still need to go the
   Plugin route, but you can use a site-functionality Plugin. I’ve written one here.
   Just add it to `wp-content/plugins` (or drop the code in an existing site-functionality
   Plugin), and enable (uncomment) whichever filters you want to apply. The code
   is too long to embed in a support forum reply, so I’ve put it in a Gist:
    [https://gist.github.com/chipbennett/8619087](https://gist.github.com/chipbennett/8619087)
 *  [pdavisnwa](https://wordpress.org/support/users/pdavisnwa/)
 * (@pdavisnwa)
 * [12 years, 3 months ago](https://wordpress.org/support/topic/auto-updates/page/5/#post-4538061)
 * [@andrew](https://wordpress.org/support/users/andrew/) Nevins
 * > Who do you think I am?
 * It really is irrelevant who you are. At this point you are an apologist for the
   inexcusable conduct of the WordPress team.
 * That makes you every bit as bad as they are with regard to this matter.
 * You may be a fine individual in every other respect, but don’t apologize or rationalize
   the inexcusable breach of the most basic rules of computer usage:
 * 1. Never take control from the user.
    2. Never do anything to a user without 
   their permission.
 * These two unwritten codes of conduct have been around since the earliest days
   of computing. Only the unscruplous and arrogant violate these rules.
 * Man, I work as a Network Tech in a company with over 400 users. I never touch
   a users profile without their permisson, unless they have first violated company
   policy and are under investigation.
 * Moreover, we tell them upfront in the Computer User Policy that the PC and network
   they use are subject to change, and updates will be done from time to time without
   warning.
 * Now, compare that relationship to the relationship WordPress users have with 
   WordPress. Just where does WordPress get off determining that MY SITE needs to
   be updated without MY EXPRESS PERMISSION?
 * In your vernacular: **Dude, get real.**
 *  [keeperbay](https://wordpress.org/support/users/keeperbay/)
 * (@keeperbay)
 * [12 years, 3 months ago](https://wordpress.org/support/topic/auto-updates/page/5/#post-4538063)
 * Here is an interesting note. I purchased 2 themes this morning for 2 different
   clients.
    As I’m reading through the “Setup Instructions” BOTH themes give instructions
   and Strongly Suggest that Automatic Updates from WordPress be DISABLED and both
   have instructions on how to do so.
 * I work with many CMS, I LOVE WP and feel it’s the Best of the Best of the BEST–
   SIR! PLEASE don’t become a weird combination of Congress and the NSA. Just say’n.
 *  [Andrew Nevins](https://wordpress.org/support/users/anevins/)
 * (@anevins)
 * WCLDN 2018 Contributor | Volunteer support
 * [12 years, 3 months ago](https://wordpress.org/support/topic/auto-updates/page/5/#post-4538064)
 * [@pdavisnwa](https://wordpress.org/support/users/pdavisnwa/), Sounds like you
   need to use another CMS.
 *  [pdavisnwa](https://wordpress.org/support/users/pdavisnwa/)
 * (@pdavisnwa)
 * [12 years, 3 months ago](https://wordpress.org/support/topic/auto-updates/page/5/#post-4538065)
 * [@andrew](https://wordpress.org/support/users/andrew/) Nevins
 * Drink the Kool-aid, bud.
 * I may leave WordPress, and never recommend them again. However, it would be a
   more desirable outcome for them to respect their users, don’t you think?
 * Or is it that you are fully invested in the People’s Temple?
 *  [Chip Bennett](https://wordpress.org/support/users/chipbennett/)
 * (@chipbennett)
 * [12 years, 3 months ago](https://wordpress.org/support/topic/auto-updates/page/5/#post-4538066)
 * > Sounds like you need to use another CMS.
 * I think that attitude is unnecessarily dismissive. The WordPress _decisions not
   options_ philosophy, at its extreme ends (i.e. when it overrides user decisions),
   is antithetical to true free software philosophy, which places the end-users 
   purposes and freedoms above all else.
 * From a truly free software philosophy perspective, even if the default behavior
   is to perform updates, the correct implementation would be to expose options 
   for the user to override that core decision.
 * Google Chrome is the oft-cited example. On a Windows box, Google Chrome updates
   on its own in the background. Google Chrome in Windows is a nearly, but not fully,
   open-source/free software package. I’m working in Linux right now. Chromium (
   the fully open-source/free version of Chrome) does not update without end-user
   interaction/authorization.
 * I’m perfectly fine with automatic updates. I encourage them. But the point is:
   as the end user, I have the right to make that decision. It is a valid criticism
   that the options are not exposed by default by core, and I don’t think it is 
   helpful to treat such criticism dismissively.
 *  [Andrew Nevins](https://wordpress.org/support/users/anevins/)
 * (@anevins)
 * WCLDN 2018 Contributor | Volunteer support
 * [12 years, 3 months ago](https://wordpress.org/support/topic/auto-updates/page/5/#post-4538067)
 * >  and I don’t think it is helpful to treat such criticism dismissively.
 * Chip, I don’t work for core. Criticism of core is not something I can take onboard
   or dismiss.
 * I have been posting to attempt to help with the issue (and suggesting another
   CMS is still an option) because these forums are still support forums.
 *  [pdavisnwa](https://wordpress.org/support/users/pdavisnwa/)
 * (@pdavisnwa)
 * [12 years, 3 months ago](https://wordpress.org/support/topic/auto-updates/page/5/#post-4538068)
 * [@andrew](https://wordpress.org/support/users/andrew/) Nevins
 * So, who deleted part of the conversation where you told me I needed to go to 
   another CMS?
 * If you didn’t like my reply, you should not have been dismissive toward me.
 * Kindly put my posts back up, as I was contributing to the topic until you, Andrew,
   decided to treat me like a child.
 * WordPress violated basic rules of computing and software. All I did was point
   that out, and say that it was inexcusable. You then decided to dismiss me as 
   if my concerns were groundless.
 *  Moderator [Samuel Wood (Otto)](https://wordpress.org/support/users/otto42/)
 * (@otto42)
 * WordPress.org Admin
 * [12 years, 3 months ago](https://wordpress.org/support/topic/auto-updates/page/5/#post-4538069)
 * [@pdavisnwa](https://wordpress.org/support/users/pdavisnwa/)
 * > Just where does WordPress get off determining that MY SITE needs to be updated
   > without MY EXPRESS PERMISSION?
 * You updated to WordPress 3.7. Indeed, that was the **main feature** of WordPress
   3.7. It was front-and-center. Top of the list. Immediately after upgrading, that
   was the big name feature presented right at the top of the about screen.
 * See [http://wordpress.org/news/2013/10/basie/](http://wordpress.org/news/2013/10/basie/)
 * If you want to disable the automatic updates, then there are several configuration
   options, including even _more updates_ if you so desire. And for the most common
   use-cases for disabling updates are even being auto-detected and handled automatically.
 * More information here: [http://make.wordpress.org/core/2013/10/25/the-definitive-guide-to-disabling-auto-updates-in-wordpress-3-7/](http://make.wordpress.org/core/2013/10/25/the-definitive-guide-to-disabling-auto-updates-in-wordpress-3-7/)
 * The correct way to disable automatic updates is simply to add this to the top
   of your wp-config.php file:
 * `define( 'WP_AUTO_UPDATE_CORE', false );`
 * And while you’re perfectly free to criticize the decision, on these forums, you
   will please keep it civil. There is no cause for using the terms “unscruplous
   and arrogant” or telling people to “get real”. If you want to criticize, use 
   your words, not your emotions.
 *  [pdavisnwa](https://wordpress.org/support/users/pdavisnwa/)
 * (@pdavisnwa)
 * [12 years, 3 months ago](https://wordpress.org/support/topic/auto-updates/page/5/#post-4538070)
 * [@samuel](https://wordpress.org/support/users/samuel/) Wood (Otto)
 * > You updated to WordPress 3.7. Indeed, that was the main feature of WordPress
   > 3.7. It was front-and-center. Top of the list. Immediately after upgrading,
   > that was the big name feature presented right at the top of the about screen.
 * I do not know what your life is like, but mine is extremely busy (like a lot 
   of other folks). I do not have time to read fully about every update. If it doesn’t
   readily appear (and it didn’t) then I miss it (like a lot of other folks, obviously).
   I barely remember October.
 * That said, auto-updating carries security risks in an of itself. If WordPress
   creates a backdoor to update my site, then who else can exploit that backdoor?
   I have enough security issues to deal with, without another access into my server
   space.
 * Simply changing the wp-config file does not shut that backdoor. Apparently I 
   am going to have to plug that hole in other ways as hackers are certain to exploit
   it in the future. Even if the data sent is in a secure tunnel, or encrypted, 
   IPs and hostnames can be spoofed.
 * > And while you’re perfectly free to criticize the decision, on these forums,
   > you will please keep it civil. There is no cause for using the terms “unscruplous
   > and arrogant” or telling people to “get real”. If you want to criticize, use
   > your words, not your emotions.
 * Kindly tell me what is uncivil about calling a spade, a spade? I have, over the
   years, worked with programmers that had the exact attitude displayed by both 
   the WordPress core dev. team and Andrew Nevin. It was an ugly attitude to behold
   then, and it certainly is not any more attractive now.
 * You know, from time to time, I get emails from Matt Mullenweg and others concerning
   things they see as important to WordPress users. Why could not I have gotten 
   an email about this? It is a big deal, and not just to me.
 * I handle my own updates through SFTP and access the backoffice through HTTPS.
   I am quite capable of handling my own affairs. However, I apparently placed unreasonable
   trust in WordPress to respect me as a site owner and user of their software.
 * That will not happen again.
 *  Thread Starter [Marj Wyatt](https://wordpress.org/support/users/marjwyatt/)
 * (@marjwyatt)
 * [12 years, 3 months ago](https://wordpress.org/support/topic/auto-updates/page/5/#post-4538072)
 * [@andrew](https://wordpress.org/support/users/andrew/) Nivens wrote:
 * > “Before 3.7 by default people did have the choice to update minor (and major)
   > releases in WordPress, giving them an informative message to update. I don’t
   > think that worked, as there were too many WordPress websites without fundamental
   > security fixes.
   > Is your issue instead about developers? As in developers may have 50 sites 
   > automatically updating, causing massive stress?”
 * If this was directed at my answer to you about what I wanted, Andrew, I was clear
   about my concerns when I opened this thread. I consciously chose the Requests
   and Feedback section because I knew how to disable the feature already but I 
   still wanted to provide feedback about a functionality that I felt was risky.
 * **Risky because there is no site backup performed on that installation prior 
   to the upgrade.**
 * As for my issue, if you were asking me what that was again, **I have no issues
   now because I was up until 4 A.M. going through every site that I own and client
   sites that I maintain** verifying functionality after an unplanned upgrade and
   altering wp-config.php to prevent any future automatic upgrade. I did not charge
   clients for this service specifically because I have setup an environment with
   my clients that obligates me to manage their sites. For me, this was unplanned
   work, and I felt overwhelmed by that prospect the night I opened the thread, 
   consciously choosing the Requests and Feedback section of the forum.
 * I do understand that WordPress, as a CMS, has taken a lot of criticism in the
   past about security issues that can easily be remedied and/or avoided if someone
   takes the time or hires a professional developer to assist them in setting up
   their site to begin with. And, no, this is not a self-promotion statement.
 * I didn’t intend for this thread to become a battle between developers and the
   community when I opened it the other night, so I’m a little saddened at the defensive
   and confrontational tone that has manifested between some of the developers and
   some of the community members. Between the angst the message seems clear, however.
   The rollout of an automatic update without my specific request was disconcerting.
   At first, I thought my sites had been hacked!
 * This thread has drawn enough attention to suggest that the community wants to
   be able to choose the time for their updates, be those major or minor, and most
   of us prefer to follow the Credo that WordPress, itself, has stressed: **BACKUP,
   BACKUP, BACKUP before making any changes**.
 * We can disable the feature to facilitate that but, if WordPress Core Developers
   want to take that out of our hands eventually, they had better have a method 
   for creating a restore point sort of feature that permits us to back out these
   changes if something fails.
 *  [Chip Bennett](https://wordpress.org/support/users/chipbennett/)
 * (@chipbennett)
 * [12 years, 3 months ago](https://wordpress.org/support/topic/auto-updates/page/5/#post-4538073)
 * [@marj](https://wordpress.org/support/users/marj/)
 * > Risky because there is no site backup performed on that installation prior 
   > to the upgrade.
 * While I agree with your underlying premise (core should expose an option to disable
   all automatic core updates), the above statement is not _entirely_ true. Making
   a backup is not the only viable means of risk mitigation. In fact, the core update
   routine does include various failsafe mechanisms, including aborting if certain
   criteria are not met, and some ability to rollback on failure.
 * Generally speaking, the failsafes in place are suitable risk mitigation for minor
   updates, for the vast majority of update attempts (as demonstrated by update 
   statistics). Failures are exceedingly rare. And if a minor-version update results
   in a Theme/Plugin conflict, in close to 100% of such instances, the Theme/Plugin
   is at fault.
 * Automatic core updates for minor versions are very, very safe, and have very,
   very low risk.
 *  [pdavisnwa](https://wordpress.org/support/users/pdavisnwa/)
 * (@pdavisnwa)
 * [12 years, 3 months ago](https://wordpress.org/support/topic/auto-updates/page/5/#post-4538074)
 * [@marj](https://wordpress.org/support/users/marj/) Wyatt
 * I think the heart of the issue here is that some in both of the developers and
   in the community have forgotten certain core principles that originally drove
   WordPress to be open source and GPL in the first place.
 * I place a certain trust in the open source community that I do not place in the
   commercial side of the business. Generally, that trust has not been misplaced.
   However, in a zeal for security, the developers and their defenders have spent
   currency they did not have. They have forgotten that developers SERVE the community,
   and not the other way around.
 * WordPress is a good product. I like it and have recommended it to others. However,
   I see an attitude rising here among the developers and their defenders that is
   not good. They need to honestly evaluate why they are doing what they are doing.
   If the answer is not satisfactory, then the best thing to do is move on.
 * I was particularly disturbed by Andrew Nevin’s “go find another CMS” reply to
   me. That is an invitation for people to leave WordPress and reduce it’s user 
   base. It is a counter-productive answer.
 * I would dearly love to see the chips fall the right way in this matter. I will
   be disappointed if they do not.
 *  Moderator [Samuel Wood (Otto)](https://wordpress.org/support/users/otto42/)
 * (@otto42)
 * WordPress.org Admin
 * [12 years, 3 months ago](https://wordpress.org/support/topic/auto-updates/page/5/#post-4538075)
 * [@pdavisnwa](https://wordpress.org/support/users/pdavisnwa/)
 * > I do not know what your life is like, but mine is extremely busy (like a lot
   > of other folks). I do not have time to read fully about every update.
 * Oddly enough, that’s exactly the sort of reasoning people use to have automatic
   updates in the first place.
 * Essentially, WordPress previously had a single-click button to update sites. 
   Now, for the case of minor updates, it pushes that button for you.
 * Along with that automated-button-press, a whole bunch of other stuff was added
   to WordPress 3.7 to actually make updates a lot safer:
    – The API now uses SSL-
   only, and the relevant root certificates are included in WordPress. Spoofing 
   that would be most difficult because it’s not relying on the network to validate
   the SSL certificates. – The upgrade process was overhauled to add loads of error
   checking and handling. If it can’t safely upgrade, for a bunch of possible reasons,
   then it actually won’t upgrade and will instead send you an email saying that
   an upgrade is available. – Speaking of emails, it emails you now when upgrades
   are available or completed. Didn’t do that before. So you’re notified of possible
   security problems instead of having to wait and find out weeks later.
 * As for “backdoors”, it’s not the system injecting an upgrade into your site. 
   The site’s code itself checks for upgrades, same as it did before. Turning it
   off via the “WP_AUTO_UPDATE_CORE” define does exactly what it says on the box.
   The code is in WordPress itself, not in a server somewhere, hidden from view.
 * [@marjwyatt](https://wordpress.org/support/users/marjwyatt/)
 * > so I’m a little saddened at the defensive and confrontational tone that has
   > manifested between some of the developers and some of the community members.
 * No core developers have thus far responded in this thread. Everybody here is 
   a “community member”. I’m the closest you get to a core developer here, and I
   prefer to think of myself as a “contributor” only. 🙂
 * > most of us prefer to follow the Credo that WordPress, itself, has stressed:
   > BACKUP, BACKUP, BACKUP before making any changes.
 * While I will never, ever dismiss the importance of backing up your sites, I’d
   modify this a little bit.
 * Mainly, I would suggest that you shouldn’t backup _only_ when you make changes.
   If a site is important, you should back it up on a regular and timed basis. Now,
   while I use VaultPress to backup my systems, there are dozens of good solutions
   for doing this, some free, some not. Having a good backup strategy is certainly
   very important.
 * That said, the wrong message about backups seems to have certainly been sent 
   across here. We do always tell people to make backups, because the truth is that
   you never know. But the reality is that I don’t backup my site before pressing
   that upgrade button, and I never have. Primarily this is because I already know
   that I have a backup, made on a regular basis. But secondarily, upgrades have
   gotten to the point where I’d consider them safe, safe, safe. I know some people
   would disagree with that, and that’s a fair point.
 * The importance of safety cannot be stressed enough. Part of the automatic update
   discussion (back mid-last year) was ensuring that upgrades don’t “break sites”.
   And while obviously that’s a moving target, the core team is extremely confident
   in the checks and balances here. Limiting it to minor updates only is part of
   this strategy.
 * For example, version 3.8.1 introduced 31 relatively minor bugfixes. For minor
   upgrades, we’ve long been pushing out only differential upgrades. That means 
   that when the upgrade from 3.8 to 3.8.1 happened, we don’t send a complete fresh
   new install anymore, but only the files that changed. This is much smaller and
   quicker and only updates the relatively few files in WordPress that have the 
   bugfixes. Much less chance of anything going wrong.
 * Even so, the upgrade process now detects for a lot of cases where it won’t update.
   Any detected failure point anywhere along the way halts the process and leaves
   the site as-it-was.
 * – It detects sites that use version-control (svn, git, that sort of thing) and
   refuses to update because that site might have some other update process in place.
   –
   It detects if the wp-cron process isn’t working, and refuses to update because
   it cannot be assured of being able to background properly. – It detects if secure
   SSL communication with the API servers is not possible, and refuses to update
   because it cannot be assured of the download file being legitimate. – It checks
   that the files were received properly, unpacked properly, have no errors in them,
   and that they can all be replaced into the installation with the proper file 
   permissions and ownership before it copies even the first file. If not, then 
   it stops and refuses to self-update.
 * And so on. The core team (and me too) think it’s quite robust and incredibly 
   safe. Even if you don’t have backups. Which you totally should, but not just 
   for changes.. backup on a regular basis.

Viewing 15 replies - 61 through 75 (of 98 total)

[←](https://wordpress.org/support/topic/auto-updates/page/4/?output_format=md) [1](https://wordpress.org/support/topic/auto-updates/?output_format=md)
[2](https://wordpress.org/support/topic/auto-updates/page/2/?output_format=md) [3](https://wordpress.org/support/topic/auto-updates/page/3/?output_format=md)
[4](https://wordpress.org/support/topic/auto-updates/page/4/?output_format=md) 5
[6](https://wordpress.org/support/topic/auto-updates/page/6/?output_format=md) [7](https://wordpress.org/support/topic/auto-updates/page/7/?output_format=md)
[→](https://wordpress.org/support/topic/auto-updates/page/6/?output_format=md)

The topic ‘Auto Updates?’ is closed to new replies.

 * In: [Requests and Feedback](https://wordpress.org/support/forum/requests-and-feedback/)
 * 98 replies
 * 17 participants
 * Last reply from: [esmi](https://wordpress.org/support/users/esmi/)
 * Last activity: [12 years, 3 months ago](https://wordpress.org/support/topic/auto-updates/page/7/#post-4538125)
 * Status: not a support question

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics