I have a small hosting company with a few hundred sites hosted on cPanel. All my clients need to use a WordPress plugin from our company for compatibility issues.

So I have the option to make all WordPress installs and plugins automatically update.

I just need to add these two codes in my plugin:

add_filter( 'auto_update_core', '__return_true' );
add_filter( 'auto_update_plugin', '__return_true' );

Doing so would greatly improve the security of the entire hosting.

However, This may cause some inconvenience to my clients. Incompatibilities with themes, websites break for some reason, or simply because they do not like everything updating alone.

Another thing I have to take into consideration is that WordPress itself does security updates alone, including for plugins (and I would have to rely on it).

So, is it better to turn on automatic updates or not?

  • To the people down-voting this question: Please comment why and how OP can make the question better; this is definitely relevant to WP as a software and valuable to people hosting their own site as much as it is people running a hosting company. While I agree there are better places to ask it, I don't think it's an unreasonable question (whether or not you believe OP should be hosting client sites without knowledge of the trade-offs of auto-updating.) OP will not be the first or last person to end up in this position and this question is an opportunity to help the greater ecosystem IMO.
    – DaveLak
    Commented Jul 8, 2018 at 7:55

1 Answer 1


Responsible Note: As always please don't take my response as anything more than thoughts based on the information provided. Do Your Own Research Beyond This Question!

Core auto-updates:

If I was running a "small hosting company with a few hundred sites hosted on cPanel" I would turn auto update WP core on, make it very clear to the users and offer an opt-out option. I'd let them know I was doing that prior to signup and, for existing customers, I'd make a point of getting consent from them prior to enabling it. I'd enable Core auto-updates because they are less likely to break client sites (that's a kind of feature of WordPress) as they should only be security updates. See the Docs.

Plugin auto-updates:

For plugins, I would probably offer that as an opt-in option. From my experience, people often don't understand the implications of plugins and install them with very little forethought. I would make it clear to customers that it's an option and I'd recommend they opt-in but provide "loud" warnings of the implications. Blindly updating third party code can be more likely to break a site (in my experience.)

As for this bit:

Doing so would greatly improve the security of the entire hosting.

I generally agree BUT I think you should strongly reconsider your setup if you want to do this to improve security of neighbor customers. Sandboxing is very important on a shared host, especially when customers can upload and execute arbitrary code. This part of the answer is out of scope for a forum like this however try security.stackexchange.com for more detailed Q&A.

And again, these are only thoughts based on info provided. DO YOUR OWN/MORE RESEARCH.

  • Your response gave me an idea of what I should do, thank you! Commented Jul 8, 2018 at 18:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.