In my wp-config.php file I have define('DISALLOW_FILE_MODS', true); which stops clients from being able to update plugins or add new ones.

It also stops WP from running its auto update when a security patch is released.

Is there a ways I can stop the plugin updating and adding but allow WP to update itself automatically?

Would additionally having define('WP_AUTO_UPDATE_CORE', 'minor'); override that aspect of DISALLOW_FILE_MODS?

It's a bit of a difficult thing to test since the updates don't happen all that often.

  • I would suggest using the Easy Updates Manager plugin. It would make your life way easier in terms of managing updates.
    – matthew
    Commented Sep 14, 2015 at 16:41
  • Everything is managed through version control and I want to test plugins on a staging server before letting them loose on the production site. If a security update is released in WP core I'm OK with that being updated immediately, for security reasons. I can then bring my version control up to reflect, but plugins need to be locked down.
    – deadlyhifi
    Commented Sep 14, 2015 at 20:18

1 Answer 1


To answer your question directly, you can use the file_mod_allowed filter to override the DISALLOW_FILE_MODS setting for the automatic updates only. Here is an example of how to do it:

add_filter('file_mod_allowed', 'override_file_mod_allowed', 10, 2);

function override_file_mod_allowed($setting, $context){
    if ($context == 'automatic_updater'){
        return true;
    return $setting;

The second option, as someone suggested to me in the Wordpress IRC channel, is to give the client an editor user role rather than an admin, as this seems to be closer to their needs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.