Auto updates should be able to be switched off

[sunflower99]

When admin configures WP_AUTO_UPDATE_CORE it should have effect at the update.php page.

[sunflower99]

It would also be nice if people who switch off autoupdates (e.g. because they use their own distribution's wordpress) would not get the update warning window above. Therefore the second patch.

[sunflower99]

let the update warning disappear if automatic updates not wanted

[SergeyBiryukov]

Hi there, welcome to WordPress Trac! Thanks for the ticket.

In my testing, setting the WP_AUTO_UPDATE_CORE constant does affect the WordPress Updates screen. For example, if I set it to false, this message is displayed:

This site will not receive automatic updates for new versions of WordPress.

Note that by design, the constant only controls ​automatic background updates, it does not affect manual updates. For the latter, you may want to look into other options, e.g. overriding the update_core user capability or the transient of the same name using the pre_site_transient_update_core filter, as suggested in ​some articles.

[sunflower99]

As my answer does not seem to appear within that ticket here again:

Hello, thanks for the hint. I could get rid of the message evaluating the
variable in both files, wp-admin/includes/update.php in 2 places:

<?php
function get_core_updates( $options = array() ) {
+       if (!defined('WP_AUTO_UPDATE_CORE'))
+               define('WP_AUTO_UPDATE_CORE', true);
+       if ( false === WP_AUTO_UPDATE_CORE )
+               return array();

        $options   = array_merge(

<?php
function maintenance_nag() {

+       if (!defined('WP_AUTO_UPDATE_CORE'))
+               define('WP_AUTO_UPDATE_CORE', true);
+       if ( false === WP_AUTO_UPDATE_CORE )
+               return array();
+
+       // Include an unmodified $wp_version.
+       require ABSPATH . WPINC . '/version.php';

and wp-admin/update-core.php :

<?php
function core_upgrade_preamble() {
+       if (!defined('WP_AUTO_UPDATE_CORE'))
+                       define('WP_AUTO_UPDATE_CORE', true);
+
+       if ( false === WP_AUTO_UPDATE_CORE )
+               return array();

        global $required_php_version, $required_mysql_version;

Now wordpress does not make any core upgrades in the background and shows only
the actual version without update errors.
That would be a great benefit for admins who install wordpress from a
distribution package, because they only update by the specific update mechanism
(apt, yum, ...), not by wordpress itself.

[chesio]

Hi @sunflower99,

I think what you are looking for is the DISALLOW_FILE_MODS constant. When it is set (in wp-config.php for example) then editing, updating, installing and deleting of plugins, themes and core files via WordPress Backend is disabled:

<?php
define('DISALLOW_FILE_MODS', true);

[sunflower99]

Yes, that looks already good. We have some users who might install plugins
from wordpress directly (not via package manager). Is there also a setting which
does not allow/show core updates, but plugin updates? Thanks.

[chesio]

Is there also a setting which does not allow/show core updates, but plugin updates?

I don't think there is such setting. I recommend to have a look on what Sergey suggested in comment:2 - either changing user capabilities or using dedicated filters.

[knutsp]

Replying to sunflower99:

Yes, that looks already good. We have some users who might install plugins
from wordpress directly (not via package manager). Is there also a setting which
does not allow/show core updates, but plugin updates? Thanks.

This is supported and handled by roles and capabilities. Such users should then have a custom role, like administrator, but without update_core. See ​https://wordpress.org/support/article/roles-and-capabilities/

For further questions, please use the support forums.

[sunflower99]

Yes, I know I could write a hook/plugin. There is even one which fullfills our needs very well (​https://wordpress.org/plugins/stops-core-theme-and-plugin-updates/). The originally intention was that in the understanding of wp admins by setting the variable 'WP_AUTO_UPDATE_CORE' to false 2 things should happen:

• not trying to make updates of the core version
• not sending update nagging, visual clutter in the GUI

(only related to core updates, the plugins are handled separately).

Therefore the above code proposals were made to keep things simple for the community. We ourselves can live with our distribution patches and/or the update plugin mentioned above.