WordPress auto-update audit: a plugin you can build today

The WordPress dashboard distinguishes between available updates and the mechanism that applies them. Dashboard > Updates shows plugins, themes, and a core version when one is available. It does not show whether auto-updates will ever fire. Two sites can display the same update screen: one where auto-updates will apply overnight, and one where they have been disabled since the site launched.

WP_AUTO_UPDATE_CORE is a constant that lives in wp-config.php, outside the database and outside anything WordPress reads when building the dashboard. Setting it to false at build time is a reasonable choice during development: you want control over when core updates land. The problem is that the constant travels with the wp-config.php file into production and stays there unless someone explicitly removes it.

DISABLE_WP_CRON is a separate problem. WordPress's cron system runs on page load, which is inefficient on high-traffic sites. Hosts and developers disable it in favour of a proper server cron, which is the right call. When the server cron is never set up, or is removed during a migration, the update check simply never runs. No error, no notice, no indication in the admin.

The plugin adds one dashboard widget titled Update Configuration. It reads four things: the WP_AUTO_UPDATE_CORE constant and its effective meaning, whether AUTOMATIC_UPDATER_DISABLED is set, whether WP-Cron is disabled, and whether the currently installed WordPress version matches the latest available from the WordPress update API.

Each check shows green for a healthy state and a coloured warning for anything that would prevent updates from running. No settings screen, nothing to configure. The widget reads the current environment and reports it.

The version comparison uses the same transient WordPress itself populates when it checks for updates. If the transient is empty, the widget reports that the update check has not run, which itself indicates a WP-Cron problem.

A developer sets WP_AUTO_UPDATE_CORE to false during a build. The site launches. The constant remains. Two years later, the site is running a version of WordPress that stopped receiving auto-updates on day one, and nobody has noticed because the dashboard version number looks like any other version number.

This is not a hypothetical. It happens whenever a developer builds on a staging environment with auto-updates disabled to avoid surprise changes, and the wp-config.php from staging becomes the wp-config.php in production. It happens when a hosting migration script copies configuration files without reviewing them. It happens when a developer leaves and the next person inherits a site without documentation.

The plugin makes the configuration visible in under a minute. For anyone who manages client sites or has inherited a site from another developer, running it once is a faster audit than reviewing wp-config manually.

This plugin runs on one site and reports that site's configuration. If you manage ten or fifty sites, checking a dashboard widget on each one is not efficient. ManageWP and MainWP are both built for the multi-site case: they aggregate update state across a portfolio and let you apply or ignore updates from a single screen.

ManageWP also provides update scheduling, staging environments, and backup integration around the update workflow. If you are in an agency context with clients expecting managed updates, that infrastructure is worth the overhead. A single-site owner checking whether their configuration is correct is the case this plugin is actually for.

For anyone already paying for ManageWP or MainWP, the audit this plugin provides is a small subset of what those tools show. Run it during a site audit if you do not have those tools installed on the site you are checking, then uninstall it.