Disabling theme and plugin update notifications in WordPress is an effective way to keep admins from getting confused. This is especially true for client admins without in-depth WordPress expertise: they may accidentally update a theme or plugin to a version that is not compatible, and then the site breaks. If you build WordPress websites for clients, this article shows you how to turn off WordPress update notifications and disable WordPress editing.
When to disable WordPress update notifications
You should turn off WordPress update notifications when you hand over a finished website to a client, or when you have customized the theme or plugins you are using. For websites you manage yourself, keep the notifications on, so you know about new features in WordPress, your themes, and your plugins.
Security warning: Turning off updates means your website will no longer receive security patches for WordPress, themes, and plugins automatically. Many hacked WordPress sites are running old plugins or themes with publicly known vulnerabilities that were never patched. So if you disable updates when handing over a site, agree on a regular maintenance schedule with your client (for example, once a month) so that you can check and apply updates yourself, ideally testing them on a staging copy first.
Advantages
- Lower the risk of clients breaking the website: If a client updates a theme or plugin and the new version isn’t compatible with everything else, the website can break. If they don’t know how to roll back, they will have to come to you.
- Keep the website as it was at handover: If clients have too many permissions, they may update and tweak things until the website no longer looks like what you delivered. People who don’t know the story may then misjudge your skills.
- Less confusion for clients: You have probably run into this too. Hiding update notifications keeps admins from getting confused, so they can focus on their main work.
Disadvantages
- No security patches: Updates often fix bugs or patch security holes. If you don’t update, your website stays exposed to vulnerabilities that are already public. This is the biggest drawback, so don’t take it lightly.
- No new features: A new version may run more smoothly, have a cleaner interface, or add some cool features. It’s a pity to miss out on those.
- The website may fall behind on speed: Your website may be fast now, but when a faster PHP version comes out, WordPress core, themes, and plugins will be updated to support it. If you don’t update, your website may end up slower than others.
How to disable WordPress theme and plugin updates
You can turn off WordPress update notifications at several levels. Choose the one that fits your purpose.
Disable all WordPress updates and notifications
This is the fastest way for you to turn off all update notifications in WordPress, including WordPress core, themes, and plugins. Note that DISALLOW_FILE_MODS also blocks installing, updating, and editing themes and plugins from the admin area; to update, you have to remove this line temporarily.
If you use this method, you don’t need any of the methods below.
Step 1: Go to File Manager in your hosting > your website directory > open the wp-config.php file to edit it.
Step 2: Find the line /* That's all, stop editing! Happy publishing. */ and insert the following code above it.
//Disable updating everything for WordPress
define( 'DISALLOW_FILE_MODS', true );
define( 'AUTOMATIC_UPDATER_DISABLED', true );
Add the remove_core_updates function before disabling notifications
The code snippets below for disabling WordPress core, theme, and plugin update notifications all call the remove_core_updates function. The old version of this article was missing the definition of this function, so pasting only the add_filter lines makes WordPress report an invalid callback. Add the code below to the end of your active theme’s functions.php file first; you only need to add it once, and it works for all three sections.
//Shared function: report "already checked, no updates"
if ( ! function_exists( 'remove_core_updates' ) ) {
function remove_core_updates() {
global $wp_version;
return (object) array(
'last_checked' => time(),
'version_checked' => $wp_version,
'updates' => array(),
'checked' => array(),
'response' => array(),
'translations' => array(),
);
}
}This function returns a “fake” result saying the check has just been done and there are no updates, so WordPress shows no notifications and does not send an update check request every time you open the admin area. The code above has been syntax-checked with PHP 8.
Disable WordPress core updates
Use this method if you want to disable WordPress core updates but keep theme and plugin updates.
Step 1: Insert this code into the wp-config.php file to turn off WordPress core auto-updates.
//Disable automatic WordPress core update
define( 'WP_AUTO_UPDATE_CORE', false );
Note: The value false also turns off minor updates, which are mostly security patches. If you only want to block major version upgrades while still receiving security fixes, use define( 'WP_AUTO_UPDATE_CORE', 'minor' ); instead of the line above. I recommend this option for websites handed over to clients.
Step 2: Insert this code to turn off the WordPress core update notification in the functions.php file of the theme you are using, right below the remove_core_updates function added above.
//Disable WordPress core update notification, requires remove_core_updates() above
add_filter( 'pre_site_transient_update_core', 'remove_core_updates' );
Disable WordPress theme update notifications
Use this method if you want to disable theme updates but keep WordPress core and plugin updates.
Go to WordPress > Appearance > Theme File Editor > select the functions.php file and insert the code to disable theme updates at the bottom (add the remove_core_updates function above first if you haven’t).
//Disable automatic theme updates
add_filter( 'auto_update_theme', '__return_false' );
//Disable theme update notifications, requires remove_core_updates() above
add_filter( 'pre_site_transient_update_themes', 'remove_core_updates' );
Disable WordPress plugin update notifications
Most websites use many plugins, so there are 2 ways to disable plugin updates: disable them for all plugins, or for a single plugin.
Disable for all plugins
To disable updates for all plugins, go to WordPress > Appearance > Theme File Editor > select the functions.php file and insert the code to disable updating all plugins at the bottom (add the remove_core_updates function above first if you haven’t).
//Disable automatic plugin updates
add_filter( 'auto_update_plugin', '__return_false' );
//Disable plugin update notifications, requires remove_core_updates() above
add_filter( 'pre_site_transient_update_plugins', 'remove_core_updates' );
Disable update notifications for a specific plugin
If you only want to disable update notifications for one plugin, go to WordPress > Plugins > Plugin File Editor > select the plugin > select the main PHP file named after the plugin (for example, Contact Form 7 is wp-contact-form-7.php) > then insert this code.
//Disable individual plugin update notification
add_filter('site_transient_update_plugins', function ($value) { unset($value->response[ plugin_basename(__FILE__) ]);return $value; });
Turn off WordPress update emails
If you don’t want to receive update emails from WordPress, add this code to the functions.php file of your active theme.
//Disable update emails
add_filter( 'auto_core_update_send_email', '__return_false' );Use a plugin to manage WordPress updates
Those are the ways I turn off WordPress updates without a plugin. If you prefer not to touch code, there is a dedicated plugin for this: Easy Updates Manager.
Once the plugin is installed, go to WordPress > Dashboard > Updates Options to disable the updates you want. The interface is quite friendly and has plenty of options:
- Disable updating everything in WordPress.
- Disable WordPress core updates.
- Disable theme updates.
- Disable plugin updates.
- Disable email notifications for updates.
- And a few other features.
Bonus: how to disable theme and plugin editing in WordPress
If you don’t want clients to edit theme or plugin files in the WordPress admin, add this code to the wp-config.php file above the line /* That's all, stop editing! Happy publishing. */.
//Disable WordPress theme and plugin editing
define( 'DISALLOW_FILE_EDIT', true );
Conclusion
Once you have disabled update notifications and theme and plugin editing, you can hand the website over to your client. However, don’t forget the regular update schedule mentioned above, because an unpatched website is an easy target. For an extra layer of protection, install Wordfence Premium and set up 2-factor authentication for WordPress.
If you find this article useful or have any questions, feel free to comment below. I’d love to chat with you!
