I have been setting up a WordPress site for a customer, with a custom template and about 5 plugins (some of which the templade depends on). The thing is, the customer just wants to edit content, and has requested that there will be no maintenance on the site, in order to reduce cost. My intention is to leave them a site that will work "hands off" for as long as possible.
Now the question is which option should be considered best practice in this scenario.
- Disable WordPress updates (either just core or core+plugins) and risk facing a security threat in the future.
- Let the core and plugins auto-update, and risk facing compatibility issues (security might still be a problem if a plugin stops being maintained)
Of these two options, what would you choose and why?