Automatic WordPress Updates — The Pitfalls

Here’s a great example of why auto­mating updates in WordPress is only smart for non-business web­sites. As I write this, one of the WP plugins pub­lished by Facebook just released an update with invalid code.

Not just a bug — code so wrong that it crashes sites. Code that wouldn’t have passed basic testing.

I’m sure “Facebook for WooCommerce” will be fixed promptly. However, over 900,000 online shops use it. If they were all running auto­matic updates, almost a million shops would be offline right now.

Other WordPress Update Problems

This comes on top of the GADWP fiasco earlier this year, too. In that, ExactMetrics changed the nature of their popular plugin without warning, through an “update”.

Version 6 of the “Google Analytics Dashboard for WP” plugin was “redesigned from the ground up”. However, it removed some popular core fea­tures and started charging for others. The plugin got hun­dreds of one-star reviews overnight, as many switched to solu­tions that had not abused their trust.

Then there are the inev­itable con­flicts. With hun­dreds of thou­sands of optional WordPress com­ponents, it is impossible to test every com­bin­ation. Some plugins rely on others that may need to be updated first. Others just don’t play well together. On top of that, pro­fes­sional WordPress devel­opment some­times involves bespoke coding. Whilst testing that code with any current plugins is part of the job, it simply can’t be guar­anteed to work with all future ver­sions of those plugins.

However, it isn’t just WordPress that needs ongoing maintenance.

All Websites Need Maintenance

Underlying tech­no­logies (web servers, pro­gramming lan­guages and so on) get updates, too. So all web­sites will fail without main­tenance eventually.

WordPress just needs more main­tenance because it provides far more flex­ib­ility. Flexibility creates com­plexity, even if the latter can some­times be hidden.

Still, main­taining back­wards-com­pat­ib­ility is a basic IT prin­ciple. Most systems try to give responsible developers time to catch up. So as long as we’re engaged to do the main­tenance, and any licences are kept up to date, there’s no problem. It becomes a problem when site owners try to avoid maintenance.

Websites are mar­keting vehicles with lots of moving parts under the hood. They work hard to keep you in a mar­keting race in which the road con­di­tions keep changing. You can’t expect them to keep working without main­tenance. Nothing in this world does that.

Do Automatic WordPress Updates Make Sense?

WordPress web­sites are powerful tools, but out­dated software is second only to weak pass­words as a hacker exploit. So WordPress needs fre­quent updates to stay secure. That’s the price of the flex­ib­ility it provides.

Sadly, ama­teurs often ignore this. So insecure WordPress sites are common. Site owners often don’t even know their site has been hacked and is a danger to others.

That’s why version 5.5 of WordPress intro­duced a feature to enable auto­matic updates. It hopes to improve security on per­sonal web­sites run by ama­teurs. As such, it’s a smart move. However, per­sonal web­sites don’t risk losses when auto­mated pro­cesses break them. Business web­sites do.

For business web­sites, WordPress updates need to done by a human. That’s why I include them in my hosting plans and Simple Sites packages and offer them as a sep­arate service, too.