Managed WordPress sounds like someone else clicks Update on everything while you sleep. Reality is messier: core might auto-patch, plugins might not, and one Tuesday morning your checkout plugin is two versions ahead of your payment gateway docs.
Automatic updates can keep small sites secure. They can also break staging-free shops. Here is how auto-updates work on managed hosting and how to choose a policy that matches your risk tolerance.
What WordPress can update by itself
WordPress core supports automatic background updates for minor releases (security and maintenance). Major versions usually need a deliberate click unless you filter otherwise. Plugins and themes can auto-update individually if you enable it per item or via constants/filters in wp-config.php.
Managed hosts sometimes layer their own update scheduler on top: panel toggles, email digests, or "we update core only." Read the plan card, not the homepage adjective.
What managed hosting often includes
- Core minor/security updates on a schedule with rollback snapshots on better plans
- PHP version nudges when runtime goes end of life (see PHP EOL and your live site)
- Monitoring after updates (uptime checks, sometimes visual regression)
Plugin and theme auto-updates are less universal. Many managed plans offer them as opt-in or billable care plans. What managed hosting includes vs what support covers helps set expectations before you assume plugins are handled.
When auto-updates are a good default
- Small marketing sites with few plugins and no WooCommerce
- Sites with staging and backups tested monthly
- Security plugins and Akismet-style utilities that patch often
- Teams without a developer on retainer who still need CVE response
Minor core updates are low drama for most sites. Letting WordPress patch 6.7.2 to 6.7.3 is usually saner than running known vulnerable core because someone feared change.
When to slow down or disable plugin auto-updates
- WooCommerce stack (gateway, subscriptions, shipping) where versions must move together
- Page builders tied to theme layouts stored in the database
- Custom plugins you maintain (auto-update from wordpress.org does not apply, but dependencies might)
- Membership or LMS plugins with breaking schema changes
- Peak season (retail November, tax season for accountants' marketing sites)
Use staging and a manual checklist. Our plugin updates without breaking production post walks through that rhythm.
Policies that work for agencies
- Auto: WordPress core minor + security releases.
- Manual monthly: everything else on staging first, then production window.
- Pin: payment, membership, and builder plugins until tested.
- Log: who approved production plugin updates (ticket or change log).
Document exceptions per client. "Auto everything" and "never auto" are both easier to explain than mystery breakage.
wp-config levers (know they exist)
Filters like auto_update_core, auto_update_plugin, and auto_update_theme can be tuned by developers or host MU-plugins. Managed platforms may enforce their own rules that override wp-admin toggles. If updates "turn themselves back on," check for host MU-plugins before fighting the UI.
After an auto-update breaks something
Good managed hosting offers backup restore to pre-update snapshot. Know your RTO. Disable auto-updates for the offending plugin, roll back, reproduce on staging, then update deliberately.
If support says application issues are out of scope, that is normal. They should still help with server-level restore if backups are part of the plan.
Canadian SMB takeaway
Data location does not change update policy. Compliance still wants patched core. Auto minor core updates plus disciplined plugin staging is a reasonable default for Canadian businesses without in-house devs.
Bottom line
On managed hosting, expect automatic handling of core security maintenance, not silent immunity from plugin risk. Enable auto-updates where failure is cheap, disable or stage where money moves (WooCommerce, forms, memberships), and align with what your plan actually promises.
Want managed WordPress on Canadian infrastructure with a clear update policy? Talk with Swift Host or see WordPress hosting for how we handle core, staging, and backups.
