Here’s How to Disable WordPress Plugin Auto-Update Safely

Plugin auto-updates are useful until they choose the worst possible moment. Maybe a lead form goes quiet. Maybe checkout behaves differently. Maybe a page builder changes a layout before anyone has had a chance to look.

If you’re searching for how to disable WordPress plugin auto update, you probably don’t want to abandon updates.

You want control over when the plugin changes.

TL;DR: In your dashboard’s plugin list, use the row-level Disable auto-updates control for the plugin you want to manage manually. If updates keep happening, look outside the plugin screen: hosting rules, update tools, must-use plugins, or custom code may be taking over.

The important distinction is this: don’t disable WordPress maintenance because one plugin worries you. Disable automatic updates for the plugin that needs review, then make manual WordPress plugin updates part of your maintenance routine.

Turn off auto-updates in wp-admin

For most sites, start here.

Open the WordPress dashboard and choose Plugins from the left menu. On the installed plugins list, find the plugin you want to control and look across its row for Automatic Updates. Click Disable auto-updates for that plugin.

The control appears in each plugin row:

After the click, the row should show Enable auto-updates. That wording can feel backwards for a second, but it means auto-updates are currently off and WordPress is offering to turn them back on.

You can still update the plugin manually. WordPress should still show you when an update is available. For sensitive plugins, that’s the useful middle ground: no surprise install, no hidden update.

🧭 Note: Missing the Automatic Updates column? Open Screen Options at the top-right of the Plugins screen and turn it on. WordPress admin tables can hide columns, and this is one of those small settings that can waste ten minutes for no good reason.

Disable several plugins at once

If you already know which plugins should move to manual updates, use the bulk action on the same Plugins screen.

Select the plugins, open the Bulk actions dropdown, choose the option to disable auto-updates, and apply it. Then scan the Automatic Updates column again. I wouldn’t trust a bulk action until I’ve checked the changed rows with my own eyes.

For a first pass, I prefer sorting plugins into two groups:

That split keeps the decision practical. A WooCommerce extension and a tiny admin-column helper don’t need the same level of caution.

Don’t change core update settings for a plugin problem

This is where a lot of advice gets messy.

WordPress core updates, plugin updates, and theme updates are separate decisions. The setting you just changed controls plugin auto-updates from the WordPress plugin screen. It doesn’t mean you’ve disabled minor security updates for WordPress itself.

Be careful with constants in configuration files. WP_AUTO_UPDATE_CORE is for WordPress core, not plugin auto-updates. AUTOMATIC_UPDATER_DISABLED is much broader and can shut down automatic updates at the updater level. DISALLOW_FILE_MODS goes further because it can remove install and update actions from wp-admin for plugins and themes.

Those settings have a place in developer-managed deployments. They are usually the wrong first move for a site owner trying to stop one plugin from updating overnight.

🔒 Note: I would leave WordPress core security updates alone unless you have a real release process. Plugin updates can change checkout, forms, layouts, and integrations. Core security updates are a different risk category.

When code makes sense

Use code only when the rule needs to stick.

For example, an agency may not want client admins turning plugin auto-updates back on by accident. A development team may want plugin updates to move through staging and deployment, not wp-admin. In those cases, WordPress has an auto_update_plugin filter that can control automatic plugin updates.

The safest home for that kind of rule is usually a small must-use plugin. It loads automatically and isn’t tied to the active theme.

I would avoid two common shortcuts. Don’t put filter snippets in wp-config.php; WordPress hasn’t loaded the filter system at that point. Don’t put a long-term update policy in the active theme’s functions.php either, because a theme switch or theme update can remove it.

If you’re not comfortable editing PHP, don’t make this your first experiment. Use the dashboard toggle, or have a developer add the policy cleanly.

Use an update manager when the site needs a process

An update-manager plugin can help when update rules need their own dashboard. It’s especially helpful when several admins can change settings and you want fewer one-off decisions buried in individual plugin rows.

The setting to avoid is anything that hides update notices or stops update checks completely. A quiet dashboard can still be an ignored dashboard. I want automatic installation off for sensitive plugins, but I still want the site telling me what needs attention.

If you manage several WordPress sites, this is also where a tool like WPRemote can fit. WPRemote gives you one place to manage WordPress updates, run visual regression tests before updates go live, create backups before updating WordPress, lock problem plugins or sites, and monitor plugin vulnerabilities from a single dashboard.

It doesn’t remove update risk. Nothing does. It gives you a better routine than logging into sites whenever you remember.

What to do after auto-updates are off

Turning off auto-updates buys you timing. It doesn’t buy safety on its own.

For important sites, check plugin updates weekly. For quieter sites, monthly may be enough when the plugin stack is small and the site isn’t taking payments or leads. Before updating anything that affects money, access, forms, or design, make a fresh backup and test on a staging copy when one is available.

After the update, test the workflow that depends on that plugin. For a payment plugin, run a checkout test. For a form plugin, send a submission and confirm it arrives. For a membership plugin, log in as the kind of user it manages. For a builder, open the pages that rely on it.

A successful update message only tells you WordPress installed files. It doesn’t tell you the business workflow still works.

🧪 Note: WordPress has rollback protection for some failed plugin auto-updates, including cases where a fatal PHP error is detected. That’s helpful, but narrow. It won’t prove your checkout, JavaScript, layout, settings, or emails survived the update.

Why a plugin may still update

If a plugin updates after you disabled auto-updates in WordPress, something else is probably applying the update. Don’t keep clicking the same row and hoping the setting becomes more true. Work through the outside layers like this:

For private, forked, or custom plugins, the issue can also be update identity. WordPress may think the plugin matches a public plugin or another update source. That’s developer territory, but the practical lesson is simple: if the WordPress toggle didn’t control it, another layer did.

FAQs

Where do I turn off plugin auto-updates?

Open the installed plugins list in wp-admin and use Disable auto-updates on the plugin’s row. If the column is missing, enable Automatic Updates from Screen Options.

Can I disable auto-updates for all plugins?

Yes. Use the bulk action on the Installed Plugins screen. I still wouldn’t treat every plugin the same. Put high-risk plugins on manual updates first, then decide whether the rest actually need that control.

Will WordPress still show update notices?

Yes, if you’re using the normal WordPress plugin toggle. It stops automatic installation for that plugin, but update notices should still appear.

Does WP_AUTO_UPDATE_CORE disable plugin auto-updates?

No. WP_AUTO_UPDATE_CORE controls WordPress core updates. It doesn’t control plugin auto-updates.

Is it safe to disable plugin auto-updates?

It can be, if you replace them with manual maintenance. Back up first, update important plugins intentionally, and test the workflow they control. It becomes risky when nobody checks updates anymore.

Why did my plugin update anyway?

Start with your host settings and any update-manager plugin. If those are clean, ask a developer to check must-use plugins, premium-plugin updaters, and custom code.

Conclusion

For most sites, selective control is enough. Turn off auto-updates for plugins that can break revenue, access, leads, or important design work. Keep update notices visible. Leave core security updates alone unless someone is responsible for replacing them with a proper process.

The goal isn’t to freeze the site. It’s to follow a safe WordPress update process where you back up your site, test updates, and verify that critical workflows still work.