Auto-update manager

WordPress out of the box updates minor core releases and translations automatically, and leaves everything else alone. That default suits nobody particularly well: it means security patches for your plugins wait for a human, while you have no say over the core updates that do apply.

This feature puts those decisions on one screen. You can choose whether core updates are off, minor releases only, or major and minor, and switch auto-updates on or off for each plugin and each theme. The plugin and theme switches read and write the same settings as the Enable auto-updates links on the Plugins and Themes screens, so the two always agree.

The useful pattern for most sites is auto-updating everything except the two or three plugins that are load-bearing – a page builder, a booking system, a payment gateway – and reviewing those by hand.

The Maintenance module is off by default on a new install. Switch it on from the Vectro dashboard before this feature can run.

The large majority of compromised WordPress sites are not broken into through a clever exploit against core. They are compromised through a known vulnerability in a plugin, one that was patched weeks or months earlier, on a site where nobody applied the update. The window between a patch shipping and an attack arriving is often measured in days.

The counter-argument is real: an automatic update can break a site unattended. That is exactly why per-item control matters. Auto-update the twenty plugins that would never break anything, and hold back the three that would, rather than choosing between blanket risk in either direction.

For core, Vectro sets the WordPress allow_minor_auto_core_updates and allow_major_auto_core_updates filters from your Core Updates choice. For plugins and themes, your choices are saved straight into WordPress’s own auto_update_plugins and auto_update_themes settings, the same ones behind the Enable auto-updates links, and Vectro never overrides the decision WordPress makes from them.

The updates themselves are still performed by WordPress on its own schedule. Vectro decides what is eligible, not when the check runs, so nothing about the update mechanism is replaced.