Check Dashboard > Updates at least once a week, and install a named security fix the same day it appears. A plugin is an add-on package that adds a feature such as contact forms, SEO tools, or checkout to WordPress. You do not need to check manually every day for new releases. According to the WordPress Developer Handbook, WordPress checks for core, plugin, and theme updates about twice per day through WP-Cron, so releases normally appear in the dashboard within about 12 hours in its upgrade guide.
Table of Contents
- How does WordPress find new releases?
- Should you use automatic updates?
- Why does timing matter for security?
- What is a safe update routine?
How does WordPress find new releases?
WordPress runs the update check in the background and shows available releases under Dashboard > Updates. The site owner still decides when most plugin updates install.
By default, WordPress auto-installs only minor core releases and translations. Plugins and themes auto-update only in special cases set by the WordPress.org API and security team. That means weekly human review remains necessary even on a healthy site.
Should you use automatic updates?
Since WordPress 5.5, you can enable automatic updates for each plugin separately. Go to Plugins > Installed Plugins and use the Automatic Updates column or bulk actions, as described in the WordPress.org Documentation in its guide to updating WordPress.
A practical split works for many sites. Turn auto-updates on for trusted, low-risk plugins from established developers. Leave auto-updates off for checkout, membership, page-builder, and custom-integrated plugins, then update those manually after testing.
Why does timing matter for security?
Most WordPress security issues come from plugins, not core. Patchstack counted 11,334 new WordPress-ecosystem vulnerabilities in 2025, up 42% from 2024, with about 91% in plugins, according to reporting in the WordPress security statistics roundup.
That pattern explains the weekly baseline and same-day rule for security fixes. Weekly checks catch routine bug fixes and improvements. Same-day action limits exposure when attackers can study a disclosed plugin flaw.
What is a safe update routine?
Back up website files and the database before updating. WordPress.org directs owners to make that backup and check plugin and theme compatibility under Dashboard > Updates, because recovery without a prior backup is nearly impossible. Use the same order each week: Rollback helps, but it is narrow.
WordPress 6.6 added automatic rollback for failed plugin auto-updates, restoring the prior stable version when an update breaks the site, according to the Dorsey release announcement. According to Cloudways, that rollback triggers only on detected PHP fatal errors through a homepage loopback check, so it can miss broken layouts, checkout errors, and logic faults in its guide to automatic updates. Keep staging and backups because rollback is not full testing.
- Back up files and database, and keep one copy off the server.
- Review Dashboard > Updates and read what each release fixes.
- Update in staging first when you have it, then production.
- Apply named security releases immediately, even outside the weekly slot.
