I am running WordPress on Ubuntu with Apache and MySQL. I would like to automatically install minor and security updates to WordPress.

However, as I understand it, the standard auto-update mechanism (see also How exactly do automatic updates work?) is ultimately fired off by a web request, meaning that the update process runs as the apache user (for me it's www-data). So the www-data user has to have permissions to write to WordPress's php files. This makes me uncomfortable - it could let an attacker escalate a "create files" vulnerability to "execute arbitrary code". I would rather keep the WordPress php files and directory owned by someone other than www-data, and leave them read-only to www-data. Thus I would rather not use the standard mechanism.

The only alternative I know of is to run svn sw as documented here. But this requires running a command including the desired new version. So I can't put it in a cron job, since I don't know how the cron job would figure out what the new version number is, without manual intervention. I could create some sort of hack which tries to scrape the latest version number from wordpress.org, but that seems very fragile. Is there a better way, or an existing script I could just use?

Also, the last step in an svn update is to visit wp-admin/config.php with a web browser, logging in as needed. Is there a straightforward way to perform that automatically from a cron job on the server, ideally without hardcoding my admin password into a script?

  • Honestly, I do not see why you would want to have WordPress auto update on its own. If something were to go wrong during the run and no one was around to notice your site(s) would be down until someone got in. Versus manual upgrades where if something goes wrong you can revert to the previous version from a backup. Plugins can be set to auto update by adding add_filter( 'auto_update_plugin', '__return_true' ); to functions.php. There is also one for themes.
    – Cedon
    Mar 24, 2017 at 23:45
  • @belinus: Recent evidence has shown that I am not sufficiently organized to manually check and install updates on a regular basis. I would rather have the site be down than compromised. Mar 24, 2017 at 23:53
  • How often do you check the Admin panel? It's not like WordPress sends out nightly releases.
    – Cedon
    Mar 24, 2017 at 23:54
  • @belinus: Does the auto update for themes and plugins work if the apache user doesn't have write access to the web directory? I assumed it would not. Mar 24, 2017 at 23:54
  • I don't know about the theme/plugin auto updates. I haven't used those features since most of my stuff is custom.
    – Cedon
    Mar 24, 2017 at 23:55

1 Answer 1


I would rather keep the WordPress php files and directory owned by someone other than www-data, and leave them read-only to www-data

Well, why not? Just do it, but after it subscribe by hand to any (from at least two) channel of "Release Notification" (low activity, еasily controlled even by the eyes): mail list or RSS-channel on official site for category "Releases". With these notification you can:

  • login to host with site
  • return permssions|ownership
  • perform "classic" WP-update
  • rollback ownership|persmissions to "strict RO" state
  • Be happy until next release will be releasd

From other side, you can get some automation around ML-messages|Feeds and, having SVN-controlled WP blog, run subversion's update not in cron (wasted time and resources in 99% runs), but on demand (howto on this topic is offtopic here, ask on SuperUser|WebMaster|StackOverFlow)

When you'll convert your current blog into SVN-managed and there will be an event "New Release", launched (have to be written around my dirty idea) SVN-updater can detect latest release rather easy (and switch WC of blog to it): in noted by you "Installing/Updating WordPress with Subversion" article it's just

cd blog
svn sw https://core.svn.wordpress.org/tags/4.7.3/ .

where 4.7.3 is the right version, you just have to get changing "The Right" version semi-automatically. Well, let's se at URL in command and on output of one more SVN-command (used on live WP-core repo)

>svn ls https://core.svn.wordpress.org/tags/

latest string is always the number of latest WP-release (ok, release with greatest number, technically speaking). For good OS with good shell "last string of svn ls" output is just svn ls <URL>|tail -1 and you have target, on which you have to switch

Final note:

Also, the last step in an svn update is to visit wp-admin/config.php with a web browser

No. According to the same page in Codex as above noted

Run the usual wp-admin/upgrade.php and you're done

and this task can be (not tested!!!) executed without client's browser by calling f.e. CURL with URL in server's console (duty of the same SVN-updater script)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.