Allow auto-updates on a non-managed WordPress site?

Question

I have been setting up a WordPress site for a customer, with a custom template and about 5 plugins (some of which the templade depends on). The thing is, the customer just wants to edit content, and has requested that there will be no maintenance on the site, in order to reduce cost. My intention is to leave them a site that will work "hands off" for as long as possible.

Now the question is which option should be considered best practice in this scenario.

1. Disable WordPress updates (either just core or core+plugins) and risk facing a security threat in the future.
2. Let the core and plugins auto-update, and risk facing compatibility issues (security might still be a problem if a plugin stops being maintained)

Of these two options, what would you choose and why?

Answer 1

the customer does not want to administer the site, and has requested that there will be no maintenance on the site

With these requirements, I usually don't use WordPress but build a good ol' HTML page. You can basically do this with your WordPress site now as well.

Just scrape HTML, JS, CSS and images. If you use a caching plugin, you could even use their generated HTML. With this you get the following benefit

• (almost) no security threats, as there is no more PHP involved
• no updates
• site will always look the same

Now if the customer does want changes, you could spin up the WP instance you have backed up somewhere, make the changes, do the export again. Of course this comes with extra costs. But that is the trade off: either you need maintenance and can make changes quickly, or you don't maintain but each change will cost more.