Part 6, WordPress Automatic Updates – Shield WordPress Security Plugin

By 9th June 2014 March 22nd, 2016 WordPress News and Updates
Shield Plugin Banner

The WordPress automatic updates system has shipped with WordPress since version 3.7.

The Shield plugin helps administrators manage automatic updates to better suit their particular needs.

This automatic updates feature was added after the core WordPress development team opted to not offer a UI (user interface) against this feature.

In this article I’ll outline a what the WordPress automatic updates system is, how it works, and how exactly the Shield plugin assists administrators.

What is the WordPress Automatic Updates System?

When the Automatic Updates system was released, we wrote about it in detail here to help us all understand it a bit better. I suggest taking a read of that and then jumping back here.

In summary, automatic updates is a good thing. It ensures that WordPress minor releases, that typically apply security patches, are applied promptly to as many WordPress sites as possible.

There are many who disagree that automatic updates is a good thing, but for minor releases at least, we can see no harm in it.

How does the WordPress Automatic Updates System actually work?

There are 2 stages to the WordPress automatic updates system, and this causes a lot of confusion. It’s sometimes appears that their site isn’t automatically updating…

  1. WordPress detects the availability of an update
  2. WordPress runs the process to automatically apply detected updates

Both of these stages rely on the WordPress cron, and the WordPress cron relies on people visiting the site.  If no-one visits the site, the WordPress cron never runs.

So first of all, given the schedule that WordPress has created, it will query the availability of updates for the site.  This runs twice daily.

Then, on a separate schedule, it’ll apply any detected updates. This also runs twice daily.

Basically on the outside, it could take up to 24 hours before an update is detected and applied to a site by the automatic updates system (and that’s assuming you have visitors to the site to kick off the crons promptly).

How does Shield assist with WordPress Automatic Updates?

WordPress doesn’t automatically update everything, it only updates WordPress Core minor releases.

WordPress core developers have offered a detailed guide on how to configure the updates system if you want it to update other elements of a site, such as:

  • WordPress major releases
  • WordPress Plugins
  • WordPress Themes
  • Translations

You can also completely disable the automatic updates system if you want complete control over when it’ll run.

The Shield plugin let’s you turn on or off all automatic updates for all elements included in the WordPress background updates system.

Reviewing Shield’s Automatic Updates Options

The default settings of the plugin reflect the current WordPress default settings for automatic updates. In effect, enabling the automatic updates features of the plugin does nothing new except ensure that the plugin itself is kept up-t0-date.

WordPress Simple Firewall Options for Automatic Updates System Management

Options for Automatic Updates Management

Referring to the numbered options on the screenshot provided on the right, I’ll outline what they mean and what are the ideal settings:

Option 0: Turning on or off the whole Automatic Updates management feature

This option refers to the automatic updates management feature on the plugin – it does not refer to the WordPress Automatic Updates system (that’s the next option). If you want to use any of the other options on this page (to manage the WordPress automatic updates) then you need to turn on this option.

Option 1: Enable/Disables WordPress Automatic Updates

If you select this option it will completely turn off the whole WordPress Automatic Updates system. It doesn’t matter where else you might try to tweak settings, or if you use option within this plugin, you will completely disable the whole automatic updates system.

Option 2: Enable/Disable Automatic Plugin Self-Update

This refers to automatically updating the Shield plugin when a new update is released. This is highly recommended as it ensures Shield is running at the latest available secure version.

Option 3: Choose which WordPress core automatic updates are applied

By default, WordPress only applies updates for minor versions. With this option you can choose to never update the WordPress core automatically, or to apply major release updates as well as minor.

Option 4: Choose whether translation updates are automatically applied

Again by default, WordPress translations update automatically. There is no reason to change this behaviour (and the plugin’s default settings reflects this).

Options 5&6: Choose whether plugin and theme updates are automatically applied

When these options are selected, WordPress will automatically update any plugins or themes that it can. You need to use this option with care, as most plugin or theme updates should really be verified before being applied.

Option 7: Option to ignore SVN/GIT

Since WordPress by default doesn’t apply updates automatically when it detects you’re using SVN/GIT, you can force updates on with this option. There’s no need to change this option if the previous sentence doesn’t mean anything to you… you can ignore it.

Option 8: Emails after automatic updates are applied

You can now specify who will, if you enable the option, receive email notifications when automatic updates are applied.

Option 9: Force Run Automatic Updates

This isn’t an option, but rather a task. At any point, by clicking this button, you can run the WordPress automatic updates system instead of waiting for the WordPress cron to run. There are many reasons you might want to do this, including debugging (to ensure it works) and applying updates that have been detected but not yet applied.

Who needs to manage Automatic Updates?

I think everyone should have a say in the updates that are applied to their sites. Not offering an options-interface to this critical feature on the part of the WordPress core development team is another step in the wrong direction. We are again forced under their will and their vision.

With iControlWP, you can also manage WordPress automatic updates, and even down to the granular level of selecting which plugins/themes are automatically updated. This implementation hasn’t made it into Shield due to its complexity. If that level of control is something you’re interested in, please sign-up for the free trial here and give it a go.

Join the discussion 3 Comments

Leave a Reply