WordPress updates: core, plugins, themes, and PHP

Which WordPress updates install themselves, which ones you have to turn on, why PHP matters too, and how to check your PHP version.

Key points

WordPress installs its own security releases automatically. Plugins and themes update themselves only if you turn this on for each one.
PHP, the language WordPress runs on, needs updates too. Your host installs them.
PHP 8.2 gets security fixes only until December 31, 2026. WordPress recommends PHP 8.3 or newer.

What updates itself

WordPress has updated itself in the background since version 3.7. What it updates depends on the kind of update:

Update	Installs itself?
WordPress security and maintenance releases	Yes, on every site by default
New major versions of WordPress	On sites installed with version 5.6 or later, yes by default. Older sites can turn it on under Dashboard › Updates
Plugins and themes	Only if you click “Enable auto-updates” next to each one, possible since version 5.5 of August 2020
PHP	No, your host updates it

The constant WP_AUTO_UPDATE_CORE in wp-config.php controls the core updates: true for all of them, 'minor' for security and maintenance releases only, and false for none. WordPress strongly advises against turning them off.

Why speed matters

The security company Patchstack measured that heavily exploited flaws in WordPress software were first attacked about five hours after they became public. Automatic updates close that gap faster than a weekly look at the dashboard. The guide Why do WordPress sites get hacked? shows where these flaws are.

PHP needs updates too

PHP runs every WordPress site. Each version gets two years of full support and then two years of security fixes only. These are the versions that php.net still supports:

PHP version	Security fixes until
8.2	December 31, 2026
8.3	December 31, 2027
8.4	December 31, 2028
8.5	December 31, 2029

WordPress recommends PHP 8.3 or newer. It still runs on PHP 7.4, but WordPress itself warns that versions this old no longer get security fixes. How quickly a flaw in PHP itself has to be fixed shows the case PHP2Shell.

What you can do

Turn on auto-updates for every plugin and theme in the lists under Plugins and Appearance › Themes.
Check your PHP version under Tools › Site Health › Info, in the section “Server.”
Ask your host for PHP 8.3 or newer if your site runs an older version. Test the site afterward.
Make a backup before every update. WordPress advises backing up the database “always before an upgrade.”
Look at Dashboard › Updates once a week for anything that did not update itself.

Next step

The guide WordPress backups: set them up and test them shows how to keep a copy that you can restore after a failed update.

The figures in this guide come from the archive and change with every data update. As of November 13, 2026.