WordPress Updates: How Do They Work? – WPQuickies

WordPress allows administrators to perform updates within the dashboard. The update process is fast, reliable, and a background task.

WordPress Updates

WordPress will notify administrators when updates are ready to be installed in multiple locations. The admin bar, and the dashboard Updates menu item and notifications and nags.

WordPress Component Updates

Four WordPress components can be updated.

• WordPress Core
• Plugins
• Themes
• Translations

How WordPress Updates Itself

The WordPress update process is relatively easy and happens in the background without user intervention.

When a WordPress core, plugin, theme or translation plugin is updated, the associated source zip file is downloaded from WordPress.org.

The file is downloaded to your site’s /wp-content/upgrade folder and then unzipped to the final destination.

The process loops through all the requested updates until all are finished.

WordPress Maintenance Mode

Because the WordPress update process involves unpacking files that could update existing files, that could cause errors in the PHP if WordPress were allowed to run simultaneously.

To solve this issue, WordPress is “locked” or put in “maintenance mode” when being updated.

A small file called “.maintenance” is created in the WordPress root directory.  The file contains the time stamp of when the update process started.

When a visitor tries to open WordPress in either the front-end or back-end, WordPress will display the default message “Briefly unavailable for scheduled maintenance. Check back in a minute”.

WordPress should automatically remove the file once the update process is complete or ignore it after a few mins to “unlock” the WordPress application.

WordPress Automatically Checks For Updates

How does WordPress know if any updates are available?

WordPress has a built-in scheduler called the WP Cron, which checks component version numbers on WordPress.org twice a day.

WordPress adds a notification message to the dashboard when any updates are found and shows the list of updates in the dashboard area.

WordPress Core Version Numbering

There are three types of WordPress releases:

• Core development (only for development, not production)
• Minor core updates
• Major core updates

Unfortunately, WordPress core versioning does not follow most software development’s semantic versioning standards, where X.Y.Z represents X=major update, Y=minor update and Z = patch.

WordPress core version numbers follow the format X.X.Y, where X.X denotes the major update and Y denotes the minor update.

The project leaders say that patches are not required as the rapid development and release cycle.

Major releases contain significant changes, and minor updates include security patches, cosmetic updates and bug fixes.

For example, version 4.0 is just the next incremental version of WordPress from 3.9. 

As expected with other software updates, there is no major WordPress version “3.0” or “4.0”.

Confused?  Yes, so are lots of other developers and me.

WordPress versioning is a bit pants and IMHO, needs to move to semantic versioning.

But that’s a conversation for another day!

WordPress Automatic Updates

WordPress introduced automatic updates for the WordPress core in version 3.7.

By default, WordPress core updates are only enabled for minor releases.

In recent WordPress versions, administrators can now control automatic updates for plugins and themes.

Automatic Plugin Updates

WordPress allows you to switch automatic updates for plugins from the dashboard view.

Automatic Theme Updates

WordPress allows you to switch automatic updates for plugins from the theme details popup window.

Controlling Background Updates Through wp-config.php

WordPress provides a couple of configuration file constants to change the automatic update behaviour.

Setting the constant AUTOMATIC_UPDATER_DISABLED to true will disable any type of automatic updates.

The line to add to your wp-config.php is:

define( ‘AUTOMATIC_UPDATER_DISABLED’, true );

The configuration constant WP_AUTO_UPDATE_CORE allows you to control core updates (minor, major and development releases). 

This constant can be defined as follows:

# Disables all core updates:
define( 'WP_AUTO_UPDATE_CORE', false );

# Enables all core updates, including minor and major:
define( 'WP_AUTO_UPDATE_CORE', true );

# Enables minor updates (default):
define( 'WP_AUTO_UPDATE_CORE', 'minor' );

There is one more configuration constant that you can use if you want to make sure that no files whatsoever are updated. 

define( 'DISALLOW_FILE_MODS', true );

Controlling Background Updates Using WordPress API Filters

WordPress also provides API filter functions to give granular control over how the automatic background updates work.

The first filter is ‘automatic_updater_disabled’, and setting this to true does the same thing as setting the constant AUTOMATIC_UPDATER_DISABLED to true.

add_filter( 'automatic_updater_disabled', '__return_true' );

If you need to control the updating of the WordPress components, this can be done using the filter auto_update_$type, where $type can be ‘core’, ‘plugin’, ‘theme’ or ‘translation’.

Here are examples of enabling automatic updates for core, plugins, themes and translations.

add_filter( 'auto_update_core', '__return_true' );
add_filter( 'auto_update_plugin', '__return_true' );
add_filter( 'auto_update_theme', '__return_true' );
add_filter( 'auto_update_translation', '__return_true' );

Automatic Update Result Notification Emails

WordPress can notify admins by email, depending on the result of the updates.

There are three result notification emails:

1. a result email – sent after an automatic core update
2. a notification email – sent when WordPress could not run an automatic update
3. a debugging email – sent only on development versions of WordPress

After an automatic update, WordPress will send the administrator a notification email with one of the following subjects.

• Your site has updated to WordPress XX.Y
• WordPress XX.Y is available. Please update!
• URGENT: Your site may be down due to a failed update

The ‘auto_core_update_send_email’ API filter controls result and notification emails. 

Disable these emails by returning false within the filter.

apply_filters( 'auto_core_update_send_email', '__return_false' );

When To Disable WordPress Automatic Updates

Having your entire WordPress website automatically update itself can sound very appealing at first, and it may be possible for a small blog or brochure website.

However, as every WordPress site owner knows, sometimes plugins and themes don’t play nice with the WordPress core and can cause site outages or other problems.

If your WordPress site setup is complex with multiple “big” plugins like WooCommerce, Elementor, BuddyPress, LearnDash etc., or if you just cannot suffer any website downtime, you may choose to disable automatic updates and test updates on a staging server first.

You can also have a mix of enabling automatic updates for small single-use stable plugins and disabling automatic updates for the more extensive plugins like WooCommerce.

The fact that you have this granular control over WordPress updates is excellent.

Automatic Updates For Premium WordPress Themes and Plugins

As WordPress provides API actions and filters for the automatic update process, developers can hook into this functionality to run a private repository for their premium themes and plugins.

If you’d like to start setting up a remote repository for your premium plugin or theme, please read this article on self-hosted plugin updates.

Summary

Automatic updates in WordPress are a fantastic feature for end-users and developers to fine control.

However, if you run many plugins or complex plugins like WooCommerce, you may think twice about allowing major updates to run automatically without testing.

Do you still have questions about WordPress updates?

Ask in the comments below.

#WPQuickies

Join me every Thursday at 1 pm Sydney time for some more WPQuickies – WordPress tips and tricks in thirty minutes or less.

Broadcasting live on YouTube and Facebook.

Suggest a #WPQuickies Topic

If you have a WordPress topic you want to see explained in 30 mins or under, fill out the form below.

https://forms.gle/mMWCNd3L2cyDFBA57

Watch Previous WPQuickies