For most local service sites the answer is yes, with one rule: turn them on plugin by plugin, not all at once. WordPress ships with plugin auto-updates switched off, so nothing is updating itself tonight unless somebody already turned it on. Switch them on for the plugins you would have updated by hand anyway, and leave the ones that draw your pages or take your leads until you can look at the site afterward.
What WordPress already does without asking
WordPress has updated parts of itself on its own for years, but not the parts most owners assume.
The Upgrading WordPress page in the Advanced Administration Handbook on developer.wordpress.org lists four kinds of automatic background update: core, plugins, themes, and translation files. That page was first published March 28, 2023 and last updated July 1, 2026.
Before WordPress 5.6, sites got automatic updates for minor core releases and translation files by default. From 5.6 on, new installs get both minor and major core releases by default, unless WordPress spots a version control checkout. Sites that already existed kept the old behavior unless an admin, a constant, or a filter changed it. A site built in 2019 and left alone may still be on minor-only core updates today.
Plugins are the part people worry about, and the handbook is blunt. By default, automatic background updates “only happen for plugins and themes in special cases, as determined by the WordPress.org API response, which is controlled by the WordPress security team for patching critical vulnerabilities.” That is a narrow emergency lane, not a routine. Your plugins are not quietly keeping themselves current.
Why plugins are the part that gets picked on
Patchstack, a firm that tracks WordPress vulnerabilities, publishes a yearly count. Its report State of WordPress Security in 2026, data updated February 25, 2026, says 11,334 new vulnerabilities were found across WordPress in 2025, a 42 percent rise on the year before. Of those, 91 percent were in plugins and 9 percent in themes. WordPress core itself had 6, which the report calls low priority issues.
Read that number honestly. It counts published vulnerabilities, not attacks on your site, and some of the rise is simply more researchers looking. It still points one way. The risk sits in the plugins folder, not in WordPress itself.
Every plugin you carry is another door. Going through the list and removing the ones you no longer run is the cheapest security work available, and it is worth doing before you start flipping switches.
Where the switch is, and how often it runs
Per plugin auto-updates arrived in WordPress 5.5, released to the public on August 11, 2020. The WordPress.org documentation page for Version 5.5 carries that date.
The developer note on Make WordPress Core, dated July 15, 2020, says it plainly: “Plugin and theme auto-updates are disabled by default. Administrators and site owners need to enable this feature to receive automatic plugin and theme updates.”
Here is where to click. The WordPress.org documentation article “Plugin and themes auto-updates”, first published July 24, 2020 and last updated January 13, 2023, says the Plugins screen carries an “Automatic update” column with a link for each plugin. You can also tick several plugins and use the bulk action selector above the table. Themes work the same way, one at a time, from the theme box under Appearance.
Two things from that page you can go and check for yourself. WordPress runs auto-updates twice per day by default, and when an update is waiting, the time until the next run is shown under the toggle and again under Dashboard, Updates. And WordPress emails the site owner after each attempt, whether everything updated, some failed, or all of it failed. If you have never seen one of those emails, that is worth chasing on its own.
What happens when an auto-update breaks the site
This is the real fear, and for years it was a fair one.
WordPress 6.6, released July 16, 2024, added rollbacks for plugin auto-updates. The WordPress.org documentation page for Version 6.6 was published July 16, 2024 and last modified August 5, 2024.
The merge proposal on Make WordPress Core, “Merge Proposal: Rollback Auto-Update”, dated April 19, 2024, spells out the mechanism. After an automatic plugin update, WordPress makes a loopback request to your homepage to check for PHP fatal errors. If it finds one, the previously installed version of the plugin is restored, and a notification goes to the site’s administration email.
Now the limit, and it matters more than the feature. That check looks at the homepage for a fatal error. It does not look at your quote form, your service pages, your booking calendar, or your layout. An update that leaves the site loading fine while sending your form emails nowhere will pass the check and roll nothing back. The rollback catches a dead site. It does not catch a quiet one.
So the dull step comes first. Know that you can put the site back. Not that a backup exists somewhere, but that you have restored one and watched it come up.
The plugins to leave switched off
Auto-updates are not a product, and this is not a reason to buy anything. The switch is free, it is already in your admin, and turning it on takes about a minute. If someone quotes you a monthly fee whose main promise is keeping plugins updated, ask what else is in it. That click is not a retainer on its own.
Sort your list into two piles.
Good candidates for auto-update:
- Security and firewall plugins, where a fast patch is the whole point
- Backup plugins
- Small utilities: redirects, cookie banners, image tools
- Anything whose settings you have never opened
Better updated by hand, on a morning you can look at the result:
- Page builders such as Elementor and Divi, which redraw your pages
- Contact form and booking plugins that carry your leads
- Payment plugins
- Anything a developer customized for you
One more honest note. A plugin nobody maintains will never send an update at all, so the switch does nothing for it. Auto-updates keep current plugins current. They cannot revive a dead one.
What to do this week
- Open Plugins in your admin. Check whether the “Automatic update” column is even there. If it is missing, the site is either older than WordPress 5.5 or the feature has been turned off by your host or another plugin. Either way, call your host.
- Delete what you do not use. Deactivated is not deleted, and the code still sits on the server.
- Check your WordPress version under Dashboard, Updates. Below 6.6 there is no rollback behind an auto-update, so switching everything on is a bigger bet.
- Restore a backup onto a test copy and look at it with your own eyes. Do this before step 5, not after.
- Turn auto-updates on for the safe pile only. Leave the page builder, the forms and the payment plugins off.
- Send the update emails to a mailbox a human actually reads. If they land in junk, the whole arrangement is silent.
None of this makes an old WordPress site quick or cheap to keep. It makes it less likely to be broken into while you are up a ladder. If the question underneath is whether the site is worth carrying at all, that is a different conversation, and a site built without plugins has no plugin updates to think about in the first place.