WordPress Host WP Engine Will Not Support Automatic Background Updates

wpengineManaged updates have always been one of the main selling points for WP Engine’s WordPress hosting packages. Customers have the luxury of never having to update their own sites because WP Engine keeps them on the cutting edge:

We keep your site secure without you having to think about it. Whenever WordPress issues a security update, we test it, and then proactively apply it to your site.

However, the company announced today that it will not be offering support for WordPress’ new ability to update itself.

WP Engine will not be supporting the background updates for WordPress. We will continue managing the updates for your installs, testing each release on our infrastructure, and fully managing the releases of the minor updates. For example, when there is a security update to WordPress, as soon as the patch is released, we’ll update all customer sites to ensure we continue to keep your sites safe and sound.

I asked WP Engine to clarify this statement. Does this mean that customers cannot enable automatic updates via the WP_AUTO_UPDATE_CORE define in wp-config.php? It seems that is the case. Their official policy is that automatic background updates will be disabled and customers will not be able to turn them on:

The function will be disabled because when we update we also automatically create site backups for you.

WP Engine will still continue to update customer sites as they always have. There’s no change here, but it is always interesting to note when a company restricts access to something that will soon be native to WordPress.

Playing it Safe

One huge advantage of enabling automatic background updates for WordPress is that a site can get those security improvements the very same day they are released with no waiting time. The same applies with major releases, plugins and themes, if one wants to live adventurously. However, if you host with WP Engine, you’ll have to settle with living on the safe side.

WP Engine customers will either need to manually update their sites through the dashboard or wait for WP Engine to initiate those updates. The company tries to ship security updates out as soon as possible and these updates are usually applied within the same day. The reason for this is to keep customers from accidentally breaking their own sites without backing them up. WP Engine customers will be upgraded within a week or two of the 3.7 release, as per their announcement today. For many customers, this is exactly why they have chosen WP Engine. Not having to worry about testing major updates is a huge relief for WordPress site admins.

The Future of Managed WordPress Hosting: A Growing List of Restrictions

I am surprised that this popular WordPress hosting company is preventing its customers from taking advantage of one of the most exciting new features of WordPress 3.7. Although customers always have the freedom to manually update their sites early, they will not be permitted to allow WordPress to update itself. This makes sense as a company policy, but as a developer I can’t help but see it as a limitation.

Why not allow developers to override the WP Engine restrictions via WP_AUTO_UPDATE_CORE in wp-config.php? Your average user isn’t likely to venture into this file to make any modifications, so it would be safe to assume that anyone who applied those settings knew what they were doing. The WP Engine infrastructure, however, does not allow for this.

WP Engine does a lot of things right when it comes to speed and prioritizing the customer’s ability to have a development environment. The company is a proven and reliable WordPress host that I would recommend to anyone. For many customers, trading freedom for security is well worth it in order to have their sites fully “managed.”

But what about the others who may want the freedom to let WordPress update itself? The company has very good reasons for limiting developers from doing this. But will the number of restrictions continue to grow? Managed WordPress hosts are a relatively new development in the marketplace of WordPress services. It will be interesting to see how their policies develop in relationship to WordPress core enhancements, which more often than not err on the side of giving more freedom to the user.


24 responses to “WordPress Host WP Engine Will Not Support Automatic Background Updates”

  1. Your average user isn’t likely to venture into this file to make any modifications, so it would be safe to assume that anyone who applied those settings knew what they were doing.

    You’re kidding right? The WordPress world is full of people who do a quick google search, arbitrarily apply config changes and who knows what else and then bring their whole site crashing down around them. I think WP Engine are spot on to disallow this forthcoming feature.

    I don’t use WP Engine myself, I much prefer the freedom of managing my own sites, but for your typical WP Engine customer, restricting them this way is the right thing to do.

  2. No surprise that WPEngine wouldn’t support this – it has it’s own system and i’m guessing thanks to the options you have with auto updates it would complicate things. With WPEngine your site is updated quick enough.

    I am a little turned off by not able to turn on auto updates for THEMES and PLUGINS. I wouldn’t be surprised if this is supported someday.

    WordPress hosting – always expect restrictions, but I think WPEngine’s restrictions still are reasonable.

  3. I am a WP Engine customer and I am happy that they have chosen to go this way. As a business person, I just want my site to work. I think they are catering to the business person not the tech geek who wants the latest and the greatest. I’d rather be conservative and wait until they’ve tested things thus ensuring my site’s maximum uptime.

  4. I am happy with the trade-off. Particularly because of two things:

    1) I know they will push updates for security patches right away (as I’ve seen them do in the last year).

    2) I know they’ll create backups and snapshots as they do updates, which you mentioned above.

    These two things are parts of what I love. And I don’t mind that core updates show up in a week. If I want, I can always make it happen faster by doing it manually.

    So in the end, they support the concept, but implement it differently, which is fine by me.

    If they were to allow people to change the config, I can only imagine what would happen later when someone (who didn’t know what they were doing) complained that backups weren’t taken, and WP Engine would have to explain that they let the customer hose themselves.

    In the end, the value proposition of hosting with them is that I can step out of the role of sys admin and they can “manage” it for me – so that I can’t hose myself. Like I said, I’m happy with that tradeoff.

  5. Howdy. I’m the guy who was responsible for testing WordPress 3.7 and ultimately turning automatic core updates off at WP Engine. I can assure you that there was a lot of internal discussion that happened before this decision was reached — and we did not come to it lightly.

    While the auto update feature is definitely an exciting one that we would like to support in the future, we currently feel that the checkpoints we create before and after upgrades to WordPress core offer a better experience to our customers at this time.

    Now, as I’ve alluded to before, this decision is by no means final. Even after WordPress 3.7 ships, I’ll personally continue to look into allowing customers to turn at least automatic plugin & theme updates on. If they’re feeling courageous, that is.

    At the end of the day, if a feature conflicts with something we already do — and we feel is more advantageous to our customers — we’ll have a serious discussion about it and go from there. We will never take a blanket “disable” stance on further improvements to WordPress core, however.

    I hope that addresses some of your concerns, Sarah.

  6. @Jason Cosper – Jason, thanks so much for your clarification. The piece is meant for discussion and clearly from what you are reporting it is a topic with many strong opinions, even within your own company. It would be really cool if there were some way for devs to turn on at least plugin/ theme updates in the future and I hope you guys find a way. Thanks for dropping by to join in the discussion. :)

  7. WPEngine should continue to do what they do IMHO. I have zero bad things to say about them. They are what hosting companies in general should be. Outside of WPE on a service like HG, auto updates are critical. HG and any other soup kitchen hosting company can care less about sec on your site.

  8. Well, Page’ly announced a similar stance and they were chiming in on auto updates when the feature was first announced on the Make.core WordPress blog. I think people choose to use Managed WordPress hosting because of the restrictions and hand holding that comes with it. Pretty sure that all Managed WP hosts will disable auto updates in WordPress and continue to operate as they have been.

  9. @Jeffro – Kind of agree with you on this point. I see potentially three kinds of users of WordPress.

    1) Small-scale users who prefer going the shared hosting route like HG or BH and for whom the auto-update is actually a good feature to ensure that they are always running the best and latest version of WordPress

    2) Users on WPEngine and other managed WordPress hosts who don’t have the time or the intention of managing their WordPress installs. That’s the reason they pay the managed host to do so.

    3) Other users like me who have their own VPS or servers, are comfortable tinkering with WordPress and would prefer the freedom of their own installs and not the restrictions put in place by a managed WordPress host.

    For me personally, the updates are a good thing. I monitor my sites daily for any updates and usually put them through immediately. The auto-update ensures I save a bit of time doing that.

  10. I am sure we are not alone. We will remain not (into) using these auto updates at all! Often we wait for secondary release of WP before updating, or, 2 or 3 weeks delay just in case. There is difference, a smaller site or huge site run on WP, there come things in this fast life we live in when it’s more logical not to take any unnecessary risk. There should exist some PRO version of WordPress in which its clutter could be permanently uninstalled.

  11. I’m not surprised to see this and, as a current WP Engine customer, I’m happy to know it. Having the option for background updates is a good thing for WordPress to add, in my opinion, but serious businesses want to take time to test updates versus key plugins or infrastructural elements.

    A lot of what WP Engine does behind the scenes is unusual compared to the average hosting setup and it makes perfect sense that they want to apply caution. It’s what I pay them for, after all.

  12. Thanks for all the awesome comments on here. There’s one more thing that WP Engine is proud to announce tonight. Along with the release of WordPress 3.7, WP Engine is announcing Automatic Update Protection.

    What is Automate Update Protection? Well, we’re adding an entirely new layer of management to our hosting that allows us to not only automate the updating of your WordPress site, but automate the testing and a validation of the upgrades as well.

    It’s pretty awesome.

    From the announcement on our blog:

    Here’s how it works:
    First, our automation loads your site just like a browser, and ensures that everything is working normally. If that’s so, we take a snapshot backup point of your site as-is. Then we perform the WordPress core upgrade. Once the upgrade is complete, we reload your site and automatically test it to make sure everything is on a basic level running normally.

    Here’s where it gets really cool.
    If all the code comes back in working order, awesome. Your site is upgraded, and you didn’t have to lift a finger. However, lets say there is a code conflict that would ordinarily summon the white screen of death. The upgrade failed, but we don’t want to leave you in a failed state. Your site has to stay online, remember?

    What happens next? Remember the backup point we just took? Well, we *immediately* revert your site to working order, the way it was before the update. It’s online and serving your visitors and customers like always. Your site is then automatically placed into a support queue for our technicians to have a look at so we can make sure the update gets done right.

    By the way, all this happens faster than any human could test things.

    For all the details, please visit: http://wpengine.com/2013/10/25/announcing-automated-upgrade-protection-wordpress-3-7/

    Thanks so much to all our customers for being amazing. We hope this will be one more thing we can do to ensure your success.


  13. The WordPress team is doing a fantastic job with this platform and appreciate their balanced approach to this auto update implementation ( e.g., searching for signs of versioning and disabling updates accordingly ). The assertion of not allowing automatic updates being crazy is just as crazy. As both a “developer” ( as you put it Ms. Gooding ) and a Linux system administrator, I see both the benefits and costs of this new feature. I do appreciate the push to automating security updates from this point forward. The fact of the matter is that it is entirely too easy to install a WordPress install in some directory in your doc root then forget about it until you visit your domain and find that all the things have been defaced. In the same vein, however, this heavy handed approach is not considering any number of production and development environments. I think it’s crazy to allow a 3rd party dictate changes to your website without any idea as to what and when changes are to be made to your website. Really though, we’re talking about WordPress. Can I expect anything different?

  14. I’m not quite getting the point of this article. Freedom? Seems kind of like the ‘rebel without a cause’ type to me. Why would I want the automatic updates from WordPress when WP Engine does the same, only in a safer manner? And, worst case, if they delay and I get hacked, they fix it… for FREE! I get why this will be good for non-managed folks, and I’ll welcome it on my non-WP Engine sites. The author seems to miss the whole point of ‘managed.’ Given this, the title seems more like link-bait. WP Engine will not support… well, Duh! and Hooray!

    Also, it is quite obvious (by now, maybe not when the article was written) why they didn’t quickly apply 3.7 or 3.7.1… there were a number of issues which kept me from initially updating my non-WP Engine sites as well. Typically, I think they do push them out pretty quickly (I’ve only been on WP Engine since like July… but the one update at that point, they pushed out right away as far as I remember… I saw their ‘updated’ email before I realized it was released).

  15. @Steve Wilkinson – It’s more than just core updates in consideration. WP Engine does not allow automatic plugin or theme updates yet, so it is indeed much more restricted. Certainly for those who feel they need the safety this is a good measure. But for those who want to live on the edge and make use of everything 3.7 has to offer, you won’t find those freedoms with a manged host. They restrict features native to WordPress so they can perform them for you instead.

  16. @Sarah Gooding – Maybe one day I’ll see… but I’m still not understanding what the problem might be. :) If you’re ‘living on the edge’ do you want WordPress automatically updating things? That removes control. Or is it living on the edge if they just pushed updates to everything immediately, no matter the consequences? Now THAT is living on the edge! (And, unless you’re just playing around, I don’t think that would generally be considered a positive.)

    If what you’re saying is that WP Engine is now no longer stock-WordPress, then OK. We’ll each have to decide if that is, in any way, a bad thing or not. I’ve been on my own (i.e.: non-managed… I’m my own IT staff) with WordPress since like 2005. Managed, IMO, is quite nice!


Subscribe Via Email

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

%d bloggers like this: