Automatic WordPress update. How to prevent plugins from updating in WordPress
It happens that you are faced with the need to protect the functionality of a plugin from updating. This, for example, can happen when you modify someone’s old and rarely updated plugin, and you don’t want to lose the changes you made all at once if the author suddenly decides to roll out an update. Here, for example, there is a similar example. This is exactly what I will take to describe further.
It also happens that an update brings serious changes (this happens periodically with WooCommerce), and until the site is ready for them, updates should be temporarily prohibited.
Of course, it’s better not to push the ban on updating plugins, because updates are often released for a reason and, perhaps, close newly discovered security holes. And, if you decide to take such a step, you should be aware of the possible consequences of such decisions.
Way to prevent plugin updates #1: change the version number
The simplest, fastest and effective way. It does not require special knowledge, you can even do it through the regular editor in /wp-admin/
You can add strictly defined numbers, for example, I add several 9999 and separate them with a dot from the current version. Thus, if necessary, you can painlessly return everything back.
Now the WordPress updater will not touch your plugin even if you force update all plugins in a row, and no errors will occur.
Way to prevent plugin updates No. 2: write code
The option is a little more complicated for those who know how and like to write code. True, I personally don’t like it, because when updating any plugins, notifications like
Warning: Attempt to modify property of non-object in /home/XXXXXX/public_html/wp-content/themes/XXXXXXX/functions.php on line 21
If they don't bother you, use the option below.
Add_filter("site_transient_update_plugins", "sheensay_site_transient_update_plugins"); // We hang the function on a special filter function sheensay_site_transient_update_plugins ($value) ( unset($value->response["webmaster-yandex/webmaster-yandex.php"]); // The relative path to the main plugin file is indicated here return $value; )
Strictly speaking, we disable notifications about the need to update the plugin. At the same time, the update is disabled.
Sometimes we are not satisfied with the basic functionality of WordPress or existing plugins. In this case, you can resort to editing system files, and anyone with minimal skills in programming in PHP, using a site like ours as a reference, can solve almost any problem that arises.
But this approach entails one significant problem - any inexperienced user with administrator rights (for example, a customer of a commercial website) can update WordPress (or a modified plugin). All your changes will be lost, which may lead to the site not working.
Sometimes, in order to get problems when updating, you don’t even need to change anything in system files CMS. For example, when updating the engine, a conflict may arise with installed version plugin. In this case, you will either have to abandon the functionality that the plugin carries and wait for the release of a version compatible with the version of the engine. Or mess around with WordPress rollback.
And the fact that starting from version 3.7, technical (3.7.1, 3.7.2, etc.) versions of WordPress are updated automatically only complicates the situation.
So, let's look at how to disable updates completely and how to manage automatic updates:
Disable updates completely.
Requires a change to function.php
Prohibiting WordPress updates:
add_filter("pre_site_transient_update_core",create_function("$a", "return null;")); wp_clear_scheduled_hook("wp_version_check");
add_filter( "pre_site_transient_update_core" wp_clear_scheduled_hook ( "wp_version_check" ) ; |
Prohibiting plugin updates:
remove_action("load-update-core.php", "wp_update_plugins"); add_filter("pre_site_transient_update_plugins", create_function("$a", "return null;")); wp_clear_scheduled_hook("wp_update_plugins");
remove_action ("load-update-core.php" , "wp_update_plugins" ) ; add_filter( "pre_site_transient_update_plugins", create_function ("$a" , "return null;" ) ) ; wp_clear_scheduled_hook ( "wp_update_plugins" ) ; |
Prohibition of updating templates:
remove_action("load-update-core.php","wp_update_themes"); add_filter("pre_site_transient_update_themes",create_function("$a", "return null;")); wp_clear_scheduled_hook("wp_update_themes");
remove_action ("load-update-core.php" , "wp_update_themes" ) ; add_filter( "pre_site_transient_update_themes", create_function ("$a" , "return null;" ) ) ; wp_clear_scheduled_hook ( "wp_update_themes" ) ; |
This method has only one drawback - when changing the template, all prohibitions are canceled. You need to remember this.
Managing automatic updates using a plugin
Update Control plugin. The plugin settings appear in the Settings/General section if you scroll to the bottom of the page. Using this plugin you can disable automatic updates WordPress itself, plugins, templates and translations. 
Managing automatic updates using a configuration file.
A ban on automatic updating can be set in the wp-config.php configuration file using special constants.
For example, to completely disable automatic updates, you need to use the AUTOMATIC_UPDATER_DISABLED constant:
define("AUTOMATIC_UPDATER_DISABLED", true);
define ("AUTOMATIC_UPDATER_DISABLED" , true ) ; |
Please note that this will also disable automatic updates of plugins, templates, and language packs.
Using the WP_AUTO_UPDATE_CORE constant, you can control automatic updates of the WordPress core.
Minor value - allow automatic updates only for technical releases (for example from 3.7 to 3.7.1, etc.)
False will disable automatic kernel updates
Value true - will enable automatic updates for all releases.
Recently one of our readers asked how to automatically update WordPress plugins. Many users are annoyed by the fact that they have to update plugins almost every day. In today's article we will show you how to enable automatic updates for WordPress plugins. We'll also show you how to exclude some plugins from automatic updates.
When and why you need to enable automatic updates of WordPress plugins
By default, WordPress can update itself automatically when a minor release or engine security patch becomes available. You will need to update to major releases yourself. You have to do the same with installing updates to plugins and themes.
Keeping your site up to date is critical to the security and stability of your site.
The same goes for all plugins and themes installed on your site. Updates are needed to receive new features and fixes.
However, you may have noticed that some of them are updated much more often than others. Many popular plugins are updated almost weekly.
Some users find it discouraging that every time they log into the admin panel they are greeted with a notification that an update is available for one or more plugins.
It would be nice if it were possible to allow trusted plugins to update automatically like WordPress itself does.
Let's see how you can automatically update plugins in WordPress.
Setting up automatic updates for all WordPress plugins
You can set WordPress to automatically update all plugins by simply adding code to your theme's functions.php file or to:
Add_filter("auto_update_plugin", "__return_true");
This filter tells WordPress's automatic update system to install updates for plugins as soon as they become available.
In the same way, you can configure the update for your themes, but using different code:
Add_filter("auto_update_theme", "__return_true");
How to Automatically Install Updates for Certain Plugins in WordPress
If you have several plugins that are updated quite often, then you will probably want to enable auto-updates only for them.
Or there may be a situation where you don't need to update certain plugins.
Here's how to enable or exclude plugins from automatic updates.
First of all, you will need to install and activate the Automatic Plugin Updates plugin.
After installation, go to the page Settings » Automatic Plugin Updates to configure plugin settings.
You can select plugins that do not need to be updated automatically. You can also enable email notifications for automatic updates. After completing the settings, click on the save changes button.
That's it, the plugin will automatically update all plugins except the ones you excluded.
Note: If you use this plugin, you do not need to use the previous method of adding the auto_update_plugin filter.
Item not found:
"automatic-plugin-updates"
does not exist.
How to roll back to the previous version of the plugin after updating?
Plugin or theme incompatibility can add problems to your website. Even though most good developers test their plugins, rare bugs still arise that can break your site.
The first step you should take to protect your site from these types of problems is to install some kind of solution to create backup copies WordPress.
However, restoring your site from a backup will add a lot of extra work to you. If you know which plugin or theme caused the problem, it will be easier to simply roll back the update.
Here's how to easily rollback a plugin or theme update. Simply install and activate the WP Rollback plugin.
After activation, go to the plugins page of your site. You will see a new Rollback option under each plugin installed on your site.
Clicking Rollback will allow you to rollback your plugin to any previous version you wish. It can also restore theme updates. You can read more about how the plugin works in our article about
Constantly updating the WordPress core, as well as plugins and themes, is an important part of improving site security and speed. But alas, auto-update is not always a good idea. Let's see the pros and cons.
Why are updates needed?
First, let's look at why updates are needed at all.
There are two main reasons for updating.
1.Input of additional functions. Developers, including WordPress, are constantly improving this management system and constantly introducing new functions.
I’ll also include the removal of unnecessary functions here. Yes, this also happens, although much less often.
2. Elimination of bugs and vulnerabilities. Often, this is the main reason for updating. Programmers are constantly looking for bugs and vulnerabilities that will allow hackers to do bad things.
Typically, updates are installed manually. But it also happens that WordPress installs the update automatically. WordPress has the ability to automatically update updates, and thus, it can update your site itself.
- But this is good! – you might think – then the site will be safe, all important updates will be installed themselves!
Not really.
Why Automatic WordPress Updates Are Not a Good Idea for Your Website?
Since version 3.7, WordPress has the ability to automatically update in case of major changes or due to security patches.
Indeed, there are two main advantages of automatic updating:
It ensures that your site always has the latest and greatest better version all software, which means the site will work as well and safely as possible.
And the second advantage is reduced work for the webmaster. The system does everything it needs on its own, and no human intervention is needed.
However, there are also disadvantages. There is a possibility that your site will crash as a result of auto updates. Imagine what this could mean for a large site that decides to auto-refresh at midnight. As a result, the site will not work all night, which will lead to large, including financial, losses. And the webmaster won’t even know that the site is not working. And he finds out about it only in the morning.
But not only that, often automatic updates occur without notification at all. And so, the webmaster sits down at his computer, checks the statistics, and in response there is silence. The site crashed. In such a situation, you can be sure that the reason for the site failure—Wordpress update—will be the last thing that comes to the webmaster’s mind. Most likely, he will think that the reason for the site failure is a hacker break-in.
So you have to choose, either you will update wordpress a little later, but calmly, or one morning you will wake up and see that your site is not working.
Disable WordPress updates and you will be sure that the site always works flawlessly.
Or
Enable automatic updates and hope that conflicts between core, plugins and/or themes break the site during automatic updates.
If you're still not sure whether to disable WordPress auto-updates best choice, let me tell you about something that happened in 2016 that will most likely scare you forever:
Wordfence auto-update
WordPress uses api.wordpress.org to handle the release of automatic updates to users. Here's how the process works:
Although this procedure makes the process of automatically updating sites much easier for WordPress, it is not a completely fault-tolerant system. Think about it:
When a site has automatic updates set, it means that it recognizes api.wordpress.org as a reliable source and accepts all updates from it. But what happens if malicious code gets into the kernel?
This is what this script would look like:
Since WordPress is open source, and since the auto-update API is publicly hosted by GitHub, the development team must be very careful about what goes into the code on the server. That's why GitHub content goes through a rigorous review process before it reaches the server.
Even though security is strong here, Wordfence has discovered a serious vulnerability in one of its weak webhook hashing algorithms .
Essentially a poorly designed hashing mechanism made it much easier for an attacker to hack the code and get inside api.wordpress.org. If a hacker could do this, any information infected on the server would be distributed to every site with automatic updates enabled. And very quickly.
And although the WordPress developers quickly fixed this problem, in fact, there is no one hundred percent guarantee that there are no other security holes left in the code. Moreover, taking into account the fact that the WordPress core is also constantly being modified.
Why you should prevent WordPress from updating
Since in the vast majority of cases, sites have themes and plugins from different developers, then there is always a chance that the code is in one software will conflict with others. And this could be due to a plugin or theme that you installed months or even years ago. The imbalance between these two elements alone can bring down your site.
Turning off WordPress automatic updates is a necessary solution.
Once you disable automatic WordPress updates, you have complete control over the process. This means testing every new core, plugin, or theme update in a safe test environment away from your WordPress site.
If something happens, then there is nothing to do. Your test site took the brunt of the failure, and you will know that it is not worth updating the working site.
If the update went smoothly and no bugs popped up, then you will only need a few clicks to update your working site.
There are two ways to disable auto updating: with some changes to the WordPress code and using a plugin. But since I have some problems using the code, it’s easier for me to use a plugin. And to disable auto updates, the Easy Updates Manager plugin is well suited, which you can download from the official wordpress repository
I hope you don't have any problems installing plugins on wordpress. Installation of this plugin is also standard. At the end of the installation, it should appear among your installed plugins.
When you go to the plugin settings, you will see something like the following.
The plugin has several tabs: main, plugins, themes, advanced.
On the main tab, you can adjust everything at once. Enable or disable update everything. Here I recommend that you turn on updates. After all, updates are an important procedure, and by not doing so at all, you risk your site becoming an easy target for hackers.
Secondly, you can disable auto-updates.
In addition, using this plugin, you can change other update settings. Enable/disable updates for all themes, enable/disable plugin updates. You can also enable/disable individual plugins and themes.
In general, this plugin has enough capabilities.
Conclusion
As you can see, there are very good reasons to disable automatic WordPress updates. And since it's really easy to do, why not do it? Yes, this is additional work, yes, you will need to log into the admin panel regularly. It is also highly advisable to test updates on twin sites. Also, perhaps you have several sites.
But all the same, it’s easier to do this than to be nervous if the site suddenly freezes and you won’t be able to understand the reason, and even more so, you won’t know what to do.
The release of WordPress 3.7, released in October 2013, gave us access to features that were to the taste of some and were completely unnecessary for others. On the agenda is automatic updating of minor releases of the WordPress core. When a new minor release (version 3.9.1, for example) is released, WordPress can now automatically update the system core - great news for most WordPress users, but, as it turns out, not for all.
Why disable automatic updates?
If you are using a dedicated server, then your host probably does the updates for you. Before implementing the update, they need to ensure that their environment new version works stably (the chances that something will work wrong are extremely small, but it’s still better to test in advance - before you start using these updates, especially if we are talking about large sites for which dedicated servers are usually used ).
If you are using something other than a dedicated server, then you are probably responsible for updating your software yourself, and thus have more control over how automatic updates occur.
If you use a lot of plugins or a custom theme, you may want to hold off on upgrading your WP version until the plugin developers are confident that their extensions work reliably with the new release.
You may be in one of those situations where you have a good reason to disable the auto-update feature on your site. So, how can you do this? There are two ways to do this trick:
- Using a plugin
- Add a piece of code
Since using the plugin seems to us the most in a simple way achieve your goal, then let's start there.
Note: If you are using a version control system such as Git, Subversion, Mercurial or Bazaar, this feature will be disabled automatically in WordPress, so you don't have to worry.
And here is the plugin for this
In the WordPress repository you will find a plugin called Advanced Automatic Updates. After installation, go to the plugin settings page, where you can disable unwanted automatic updates, including major releases of the core, plugins and themes, as well as default minor releases, for which the function was developed.
And as an added bonus, you can also disable the auto-notifications that WordPress automatically sends to the site admin or overwrite the admin email address with your own if you prefer not to see them and not be an eyesore to your client.
Note: The theme update feature will only work if it is downloaded from the official WordPress repository.
If you are using a paid or premium theme that was downloaded from another resource, such as a theme store or design site, then you will have to update the template yourself when a new version becomes available.
Remember that you should always make a backup before updating anything. Moreover, this rule also applies when you manipulate the code described below.
Disable auto update feature
But what if you don’t want to install an extra plugin on your website? Since the WordPress user interface doesn't have any toggle to disable this functionality, you'll have to roll up your sleeves and dig into the code. Trust me, it's not that difficult. All you need to do is add this piece of code to your wp-config.php file:
I suggest placing this code, and other pieces of code that we will consider further, here, right above this inscription in wp-config.php:
/* That's all, stop editing! Happy blogging. */
(Suggestion here - one simple and quick rule: I like to keep all my custom versions of the wp-config file here so I can find them easily. But it's up to you where you keep them.)
Enabling updates for major releases
If you want to enable kernel updates for both major and minor releases, then add this line of code to the wp-config.php file:
/* turn on both minor and major WordPress automatic core updates*/ define("WP_AUTO_UPDATE_CORE", true);
Plugin and theme updates
If you want your themes and plugins downloaded from the WordPress repository to update automatically, the code for this is quite similar to the one we just used, but this time you also need a filter to enable updates (Read note above, which talks about the relationship between automatic updates and the repository).
To automatically update plugins, use this code:
add_filter("auto_update_plugin", "__return_true");And to do the same for themes, use this code
Add_filter("auto_update_theme", "__return_true");
Disable all updates
Let's say you decide that your site doesn't need automatic updates at all. You are the guru of your domain (and website, and maybe email...but that's beside the point) and have decided to handle updates entirely on your own. Here's how you can do it:
/* I am the captain of this ship, I’ll do my own updates thanks*/ define (‘ AUTOMATIC_UPDATER_DISABLED’, true);
Don't forget, folks, that this piece of code disables all and overwrites some options you may have enabled, so use this power wisely.
Now, having all these pieces of code at our disposal, we can mix them with each other. For example, you can disable kernel updates but allow themes and plugins to enjoy all the benefits of auto-updates. So, let's start by disabling kernel updates by adding this code:
/* Disable WordPress automatic updates */ define("WP_AUTO_UPDATE_CORE", false);
Then we’ll add the code to enable theme and plugin updates:
Add_filter("auto_update_plugin", "__return_true"); add_filter("auto_update_theme", "__return_true");
Email notifications
One last trick - we're going to disable the email notifications you receive when the update is complete. This time, instead of adding the code to wp-config.php, we'll paste it into your active theme's functions.php file.
/** * Disable the auto generated email sent to the admin after a core update */ apply_filters("auto_core_update_send_email", false, $type, $core_update, $result);
And now, we have achieved complete control over how automatic mode the kernel, plugins and WordPress themes-site. You can also turn off email notifications.
