> ## Content Index > Fetch the complete content index at: https://thecloud.market/blog/llms.txt > Use this file to discover other available public pages before exploring further. # WordPress auto-updates: what is actually covered? - URL: https://thecloud.market/blog/wordpress-auto-updates-coverage/ - Published: 2026-11-01T04:11:18.000Z - Updated: 2026-11-01T04:11:18.000Z - Description: Understand which WordPress updates cover core, plugins and themes, why PHP needs a separate owner, and how to confirm maintenance has finished. - Author: Narasimha Uppala - Tags: WordPress, Hosting WordPress released **7.1.4 on 28 October 2026** to fix multiple security issues and recommends updating sites immediately. For sites that support automatic background updates, the process starts automatically. Confirm the installed version even when that automation is enabled. [Read the official release announcement](https://wordpress.org/news/2026/10/wordpress-7-1-4/). For a business owner, the next question is what “automatic updates” covers. A WordPress website has several pieces of software, each with its own update path. A completed core update tells you about the WordPress application; plugins, themes and the server's PHP runtime need their own attention. This guide concerns self-hosted WordPress websites. Hosting tools and maintenance services can change how updates are managed, so confirm the arrangements for your particular site. ## Core updates cover the WordPress application WordPress core is the application that provides the dashboard, editor and other built-in functions. Its automatic-update settings distinguish minor releases, including maintenance and security fixes, from major releases. Defaults also depend on the installation's history. The [WordPress administration handbook](https://developer.wordpress.org/advanced-administration/upgrade/upgrading/) explains that new installations since WordPress 5.6 enable major as well as minor core auto-updates by default, while older installations can retain different settings. Configuration, plugins and hosting tools can alter the behavior. Look at **Dashboard → Updates** to confirm the installed version and available updates. Ask whoever maintains the site to explain any policy that overrides the dashboard controls. The 7.1.4 announcement also describes courtesy security backports to older branches while stating that only the latest WordPress version is actively supported. Check the security update available for an older branch and plan a move to the supported version; a backported fix does not establish ongoing support for that branch. ## Plugins and themes have separate controls Plugins add functions such as forms, bookings and online-store features. Themes control the site's presentation. Their versions and update settings are separate from core. In a standard WordPress dashboard, **Plugins → Installed Plugins** shows automatic-update controls for individual plugins. Theme controls appear under **Appearance → Themes** when you open a theme's details. WordPress documents these as per-plugin and per-theme settings. [See the official plugin and theme auto-update guide](https://wordpress.org/documentation/article/plugins-themes-auto-updates/). A host or plugin may modify or hide those controls. If the interface differs, ask which system actually installs updates. Also identify how updates arrive for any paid or custom component, including who can access the vendor account and who maintains custom code. For example, core may have updated overnight while a booking plugin is still waiting for its maintainer to act. Record the status of that plugin separately instead of describing the whole website as “updated”. ## PHP is maintained through the server or hosting environment PHP is the programming runtime that executes much of WordPress. Updating WordPress core does not itself upgrade the server's PHP installation. The [official PHP update guidance](https://wordpress.org/support/update-php/) explains that available PHP versions and the method of changing them depend on the hosting provider. On an unmanaged server, identify the person responsible for the runtime and operating-system packages. Use **Tools → Site Health → Info** to gather the site's version and server details for that person. The [Site Health documentation](https://wordpress.org/documentation/article/site-health-screen/) explains what the screen reports. It supplies information; it does not change the server configuration. Review plugin and theme compatibility before a PHP version change, with a backup and a way to handle problems. A current WordPress version alone does not demonstrate that every installed component works with a different PHP runtime. ## Give failed updates somewhere to go Automation needs a person who sees failures and can act. Confirm the maintenance contact address and which notices the responsible person receives. WordPress's plugin/theme guide describes default emails for successful, failed and mixed auto-update attempts. It also explains that scheduling depends on WordPress Cron, the system that runs scheduled tasks. If updates are overdue or failing, review **Tools → Site Health** with your maintainer and investigate the reported issue. A missing email by itself does not prove that an update succeeded. For a planned change, follow the [WordPress backup guidance](https://developer.wordpress.org/advanced-administration/upgrade/upgrading/#back-up-wordpress) and confirm that recovery covers the database as well as the site files. Keep urgent security patching a priority. If compatibility blocks an update, give the issue a named owner and a resolution plan. After an update, exercise a task that matters to the business. For a booking site, submit a test booking and confirm that it reaches the right destination. For a shop, use its payment sandbox to check the checkout flow. A homepage loading successfully checks only part of the website. ## A short request to send your maintainer You can adapt this message for your developer, agency or hosting team: > Please confirm the installed WordPress, plugin, theme and PHP versions; which updates run automatically; and who handles each remaining update. Include any failed or blocked updates, the backup/recovery arrangement, and the result of a test of our main customer task. Ask for a clear exception when something cannot be updated, with the next action and the person responsible. That gives the business a useful maintenance record and helps the next person understand what still needs attention.