Are WordPress Auto-Updates Safe for Business?

Are WordPress auto-updates safe?

Mostly yes for security, with limits. Updates close known holes, and attackers move fast, so waiting is usually the bigger risk. But an automatic update can break a page, a form or a checkout, and nobody tells you. Auto-updates are a good floor, not a complete plan.

For a business site, the safest setup is automatic updates plus a backup, a quick check afterward and a person who is told when something fails.

Why do updates matter so much?

Because exploitation is quick. Patchstack's 2026 report found 11,334 new vulnerabilities in 2025, 91 percent of them in plugins, and a median time to mass exploitation of 5 hours. About half of high-impact flaws were exploited within 24 hours. That speed is why waiting weeks to update is risky.

A site that updates once a month spends most of that time exposed. This is why leaving updates to chance is a real risk, not a theoretical one.

What do auto-updates actually cover?

WordPress can update its own core automatically, and you can turn on updates for plugins and themes. In July 2026 a serious core flaw chain called wp2shell was fixed in versions 7.0.2, 6.9.5 and 6.8.6, pushed as a forced automatic update per a secondary report. CISA listed both flaws as exploited on July 21, 2026.

Core is the easy part. Most trouble is in plugins, and that is where automation helps and hurts the most.

What do auto-updates not protect against?

Several things, and the table below shows the gaps. Auto-updates install new code without anyone checking the result, so they cannot tell you whether a form, checkout or layout still works afterward. They also do not replace a backup you can restore.

The "no patch yet" row is the one most owners miss. An update cannot install a fix that does not exist. That calls for monitoring and, sometimes, removing the plugin.

Does updating WordPress fix PHP2Shell?

No. The php2shell flaws are in PHP, the software under WordPress, which your host controls. Updating WordPress does not change the server's PHP version. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, listed on the PHP news page. See our php2shell explainer.

Check your version with the free PHP version checker. Also note that newer plugin versions can require a newer PHP, so the two layers need to move together.

When can an automatic update break my site?

Most updates go smoothly. Problems tend to show up with sites that have many plugins, a custom theme, a store or a plugin that has not been updated by its author. Typical symptoms are a blank screen, a missing form or a checkout that fails quietly.

• • A plugin conflicts with another. Two updates land the same night and clash.
• • A theme depends on old code. A custom theme stops working with a new release.
• • A form or checkout quietly stops. The site looks fine, but leads and sales are lost.

If a site breaks after a PHP change specifically, read My Site Broke After a PHP Upgrade.

What is a safer way to run updates?

Use automation for the routine, and add human checks where the risk is. For most business sites, that looks like the list below. The idea is simple: let low-risk updates flow, review the risky ones, and always keep a fresh backup so a bad update can be undone quickly.

• • Automatic updates on for core security releases and low-risk plugins.
• • A fresh backup before updates, and a restore you have tested.
• • A staging copy for big changes and for stores.
• • A check of forms, logins and checkout after updates.
• • Alerts to a person, not to an inbox no one reads.
• • A review of plugins that have not been updated in a long time.

If you only do one of these, make it the backup. It is the difference between a ten-minute fix and a lost weekend.

Do I need someone to do updates, or can I trust auto-updates alone?

It depends on what the site does for you. A small brochure site with few plugins can often rely on automatic updates and a good backup. A store, a booking site or a site that holds customer data is worth a person watching, since a silent failure costs money.

That is what a website care plan is for: tested updates, monitoring and someone who knows your site. If the site has already been hit, start with WordPress security and read Why Does My WordPress Site Keep Getting Hacked?.

What does Cuanto Labs do?

For care plan clients we apply updates in a tested order, check the pages that matter, track the PHP version and keep a record of changes. For a one-time job, our Security Update Sprint is $295: backup, staged update of core, plugins and themes, a vulnerability check and a rollback plan, in 1 to 2 business days.

We cannot promise a site will never be attacked, but we can make sure updates are done carefully and noticed.

Frequently asked questions

How often should plugins be updated?

Security updates as soon as they can be tested, which in practice means within days. Given the speed of attacks, a month is too long for a serious flaw.

Are auto-updates enough for WooCommerce?

For a store, add a backup and a checkout check. A silent checkout failure is costly.

Can I turn auto-updates off for one plugin?

Yes. For a fragile plugin, update it by hand after a backup.

Next step

If you are unsure what your site is doing on its own, book a call. We will look at your plugins, PHP version and backups and tell you what to change.

This article is general information, not legal or compliance advice. Written by Eliran Yihye, founder of Cuanto Labs, on October 27, 2026.