Does WordPress update itself automatically?

Minor core releases, which include security fixes, update automatically by default. Plugins and themes do not, except in special cases flagged by the WordPress.org security team, so you must switch their auto-updates on.

Is WordPress core itself insecure?

Patchstack counted only 6 reported vulnerabilities in WordPress core in 2025, against thousands in plugins and themes. Most risk sits in the add-ons, not the core.

WordPress security now that AI finds bugs faster

Q: How often should I update WordPress plugins?

As soon as a security update is available. Patchstack reports that about half of the high-impact vulnerabilities it tracked were exploited within 24 hours of disclosure, so waiting a month is a real risk.

WordPress sites are best protected by quick updates, fewer plugins, strong sign-in and a supported PHP version. Patchstack reports that plugins caused 91% of new WordPress vulnerabilities in 2025, so plugin updates and removals come first. This checklist puts the steps in priority order.

Where does WordPress risk actually sit?

Most WordPress risk sits in plugins and themes, not in WordPress itself. Patchstack’s 2026 report counts 11,334 new vulnerabilities in 2025: 91% in plugins, 9% in themes, and 6 in WordPress core.

Speed is the second problem. Patchstack says about half of the high-impact vulnerabilities it tracked were exploited within 24 hours, and that the most heavily exploited ones were under mass attack after a median of 5 hours. It measures this from the moment its protection rule went live at public disclosure. Those are one vendor’s measurements, but they point the same way: the gap between a bug being published and being used is now short.

Because bugs can be found and used quickly, the checklist below favours fast patching and fewer moving parts. The explainer on AI penetration testing describes how automated bug-hunting works.

What is the checklist, in order?

Work through these steps from the top. Each one removes more risk per hour of effort than the one below it.

Update everything now. Update WordPress core, then plugins, then themes, after taking a backup. WordPress.org’s hardening guide notes that old versions stop receiving security updates.
Delete what you do not use. The same guide says to remove unused plugins. An inactive plugin still sits on your server and can still hold a flaw.
Switch on auto-updates for plugins you trust. Per WordPress.org’s update documentation, minor core releases update automatically by default, but plugins and themes update on their own only in special cases flagged by the WordPress.org API. You must enable the rest.
Check your PHP version. WordPress.org recommends PHP 8.3 or newer. The PHP version guide shows how to find yours.
Protect sign-in. Use long, unique passwords and enable two-step authentication, both recommended by the hardening guide. Rate limits and bot checks, covered in the login attack guide, stop automated guessing.
Restrict file editing. Adding define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php removes the dashboard editor for plugin and theme code. WordPress.org says it will not stop uploaded malicious files, but it may block some attacks.
Tighten file permissions. The hardening guide suggests 755 for directories, 644 for files, and 400 or 440 for wp-config.php.
Keep backups you have tested. Store copies off the server, keep older snapshots so you have a pre-compromise version, and practise a restore.

How do you turn on plugin auto-updates?

You turn them on from the Plugins screen in the dashboard, plugin by plugin, or through a code setting your developer can add, as described in the update documentation above. WordPress’s Site Health screen shows the auto-update state of each active and inactive plugin and theme in one place.

Auto-updates carry a small risk that a bad release breaks the site. Balance that against the 24-hour window above. For a business-critical site, enable them and keep daily backups, or ask your developer for a staging copy.

What does Site Health tell you?

Site Health lists the problems WordPress itself can detect, grouped by severity. Open Tools, then Site Health. WordPress.org’s documentation says its critical issues include an outdated PHP version, plugins waiting for updates, and background updates not working. The screen also flags a site that displays errors to visitors, which can reveal sensitive details.

Treat any critical item as a to-do. The Status tab is a quick monthly check, not a full audit. For a wider review, use the website weak-spot check.

How should you read a plugin vulnerability notice?

A vulnerability notice has three parts you can act on: the plugin name, the affected versions and the fixed version. Vulnerabilities often carry a CVE number, a public identifier explained in the glossary. If your installed version is below the fixed one, update. If no fix exists, deactivate and delete the plugin, then look for an alternative.

Confirm the fixed version in the plugin’s own changelog on WordPress.org before you rely on any third-party notice.

What should you do if you cannot update straight away?

If a plugin has a known flaw and no safe update, remove it or switch it off. A temporary fix is a firewall rule from your host or CDN that blocks the vulnerable path, though a rule does not repair the plugin. Put a reminder in your calendar to finish the job. Leaving a flagged plugin in place while waiting is the riskiest choice.

How do you keep the list going?

Security is a routine, not a project. Book a short check each month and run the same four items every time.

Open Site Health and clear any critical item.
Update anything pending, then confirm the site still loads, forms send and checkout works.
Review the user list and remove accounts nobody needs, especially administrators. Site Health’s Info tab shows your user count.
Confirm a recent backup exists and is stored away from the web server.

The WordPress.org hardening guide adds that you should download WordPress, plugins and themes only from wordpress.org or well-known companies. Skip “nulled” copies of paid plugins offered elsewhere, since these come from sources you cannot check.