Enable auto-updates for plugins installed from the Plugins Add New Screen

[JosVelasco]

To increase and promote auto-updates usage, we could start by enabling auto-updates by default for plugins installed from the Plugins Add New Screen, with an opt-out switch under the Activate button.

A “Disable auto-updates” link could appear under the Install Now button.
To make it more prominent, we could make it bold or red.

There are many scenarios where this logic would help the ecosystem, for example, when a user gets their WordPress site developed by a professional and then takes complete control of it, installing plugins without enabling auto-updates.

If this suggestion is too bold, we could first detect if most of the installed plugins have auto-updates enabled and calculate if this is the best logical configuration for the site before enabling auto-updates by default.

For already installed plugins with auto-updates disabled, the link could read “Enable auto-updates”. This could promote auto-updates for those plugins as well. Eventually, if this works well, we could expand the same logic for themes.

[JosVelasco]

Plugins Add New Screen with auto-updates toggle link

[costdev]

Hi @JosVelasco, thanks for opening this ticket.

Adding 2nd-opinion to gather more input on this.

My two cents: A lot of site owners/maintenance companies are very selective about which plugins are enabled for auto-updates. For some plugins, these are always tested on a staging site. Others, if developed by the host or others, may have auto-updates enabled.

As we have no control over what might be served to a user's site via an automatic plugin update, I'd be very hesitant about making it opt-out, or assuming the desired auto-update status.

[JosVelasco]

Thanks, @costdev, for your input.

Then it could be awesome to have special flags/constants to override this option as a plugin developer or maintenance company if needed.

[costdev]

The auto_update_plugin and auto_update_theme filters allow enabling/disabling auto-updates for all plugins/themes.

However, this should only be done by the site owner, developer, or maintenance company. A third-party plugin/theme developer shouldn't forcibly auto-update to their users' sites.

[JosVelasco]

What I mean is we can add a new flag to the plugin’s code for the plugin’s authors to opt-in, or as a constant defined by a plugin or wp-config.php for the maintenance companies not to enable all auto-updates, but to allow WordPress to enable them by default if the user installs the plugin from the Plugin Add New Screen.

Just a way to define the initial state rather than forcing them.

Or at least the “Activate” button would have a checked option to suggest they enable auto-updates under it with a legend like: “Also enable auto-updates.”

I guess a good starting point would be to include the toggle link to increase discoverability of the auto-updates function.

[sebastienserre]

Hello,
I love the idea. It would contribute to keep a web more secure. Doing support for a premium plugin all the day, I see lots of out of date website :-(
Of course, it needs an "option" (by a filter or a constant or something else) to bypass it.

[JosVelasco]

Mockup with the checked option to suggest they enable auto-updates under the install now/update now/activate now button.

[tnolte]

I like the mockup, and fully support this route myself. If having that checkbox in the install screen isn't desirable then we could go with something afterwards like when you are given the option to Activate the plugin. Perhaps "Activate" and "Activate w/ Auto-Updates"?

Chiming in also from the agency point of view, that having a site configuration constant that can be set to disable or control the opt-in/opt-out functionality is also a must.

[boogah]

I really like this idea and was championing it over on the fediverse when @afragen referenced "decisions, not options." So I decided to run with that and wrote a quick and dirty functionality plugin to auto-enable auto-updates on any new plugin install or activation:

​https://gist.github.com/boogah/8209b99cddcb5bb4024382c011745da9

Happy to turn this into an actual repo (rather than a Gist) and collaborate on this with folks if anyone thinks this version of @JosVelasco's idea has legs.

[JosVelasco]

I'll add some of the comments discussed on the #core-upgrade-install Slack channel and social networks:

I've found that not having a link to enable auto-updates on the same screen where the plugin is installed can lead to, for example, forgetting about it.

There are some scenarios where this happens, like when there is more than one admin and not a maintenance plan.

Finding more places where site admins can enable auto-updates is very reasonable. The Install Plugins and WordPress Updates screens are good candidates.

There is also the possibility to add the toggle to turn off the auto-updates in a notification after you install the plugin. There is an overhaul to the notification center and the WP Dashboard, but this can complement both.

[JosVelasco]

Now is a better time to start promoting auto-updates more.

If adding a checked option to suggest to users that they enable auto-updates under the install now button is too much or would lead to accessibility issues, we could start by adding a simple link:

Something like "Manage auto-updates" could appear after installing, taking you to the plugin's list—just as a reminder to activate them.