How to Disable WordPress Update Notifications Without Missing Security Patches

WordPress update messages come from separate systems, so there is no single switch that safely hides everything. A red core-update nag, a plugin or theme badge, an email, and an automatic installation each require a different control. Hide the core nag only for users who do not maintain updates, identify the source of plugin and theme alerts, use the specific email filter for core messages, and treat automatic-update settings as an operational policy rather than a display preference.

Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.

What you can disable—and what you cannot

WordPress presents update information through several channels. The administrator dashboard can show a core update notice, the Plugins and Themes screens can highlight items with newer versions, admin-menu icons can display counts, and WordPress can send email about core or background-update events. These channels are related, but they do not share one universal “hide” setting.

#	Preview	Product	Price
1		WordPress Multisite Administration	$34.38	Buy on Amazon
2		Mon Site WordPress – Volume 2 – Administration & Utilisation (French Edition)	$9.90	Buy on Amazon
3		WordPress 24-Hour Trainer	$3.95	Buy on Amazon
4		Teacher Record Book	$4.89	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

Before changing anything, decide whether the problem is visual clutter, unwanted email, or an update policy that installs files without a human approval. A display change is usually low risk. Disabling updates is a maintenance decision that needs an owner, backups, testing, and a schedule.

Hide the core update nag for non-maintainer users

The narrowest code solution is to remove the core nag only for users who lack the update_core capability. Administrators and other users who can update WordPress continue to see the warning. WordPress Developer Resources describes update_nag() as the function that returns the core update notification.

#1 Best Overall

Sale

WordPress Multisite Administration

$34.38

Buy on Amazon

Use a capability-based snippet

Place this code in a site-specific plugin or a must-use plugin rather than a theme, so a theme change cannot bring the nag back:

<?php
function hide_core_update_notifications_unless_admin() {
    if ( ! current_user_can( 'update_core' ) ) {
        remove_action( 'admin_notices', 'update_nag', 3 );
    }
}
add_action( 'admin_head', 'hide_core_update_notifications_unless_admin', 1 );

The function runs early in the admin head, checks the current user’s capability, and removes the callback that prints the notice. A user who can update core is left untouched. This is preferable to hiding the notice for everyone because at least one qualified maintainer still receives the warning.

Install it as a must-use plugin

1. Create the directory wp-content/mu-plugins if it does not already exist.
2. Create a PHP file such as hide-core-nag.php in that directory.
3. Paste the complete snippet, including the opening PHP tag, into the file.
4. Sign in with a user who cannot update core and open several admin screens. The core nag should no longer appear for that user.
5. Sign in with an administrator or maintenance account and confirm that the update notice remains visible.

Must-use plugins load automatically and do not have an activate/deactivate button in the normal Plugins screen. Keep a documented copy of the file and a recovery method; a syntax error in a must-use plugin can affect every admin request.

Important multisite limitation

The reference example is intended for installations that are not multisite. In a network, capability assignment and the distinction between site administration and network administration can change who should see core updates. Do not deploy this snippet across a multisite network until the network administrator has reviewed the roles and tested both site-level and network-level dashboards.

Stop plugin and theme update badges

WordPress.org documents that available plugin and theme updates appear as an admin-menu alert bubble and highlight the relevant item. The Plugins and Appearance screens are therefore the first places to inspect when a badge persists. The built-in “Automatic update” controls decide whether WordPress may install a particular plugin or theme update; they are not a global “hide every notice” switch.

Rank #2

Mon Site WordPress – Volume 2 – Administration & Utilisation (French Edition)

$9.90

Buy on Amazon

Use the built-in controls when installation policy is the real issue

1. Open Dashboard → Updates to see which core, plugin, theme, and translation updates are currently available.
2. Open Plugins → Installed Plugins and locate the plugin with an available update.
3. Use that row’s Automatic updates control to allow or disallow automatic installation for the individual plugin. Bulk actions are available for plugins when you need to apply the same policy to several items.
4. For themes, open Appearance → Themes, select a theme, and use its Automatic updates control where offered.
5. Return to Dashboard → Updates after the update runs or after a manual update to verify the item no longer has an available version.

If the badge remains because an update is still available, changing the automatic-update toggle will not remove it. The update must be installed, or a separate notice must be identified and addressed.

Find notices added by a plugin or theme

A message inside a plugin’s own settings page, a banner with a license prompt, or an alert that remains after core and extension updates may not be generated by WordPress’s standard update UI. Temporarily disable nonessential plugins on a staging copy, one at a time, and check whether the message disappears. Review the plugin or theme’s settings for a notification option before removing code. Never disable a security, backup, or monitoring extension on a production site merely to test a banner without a rollback plan.

When a settings interface is preferable

The WordPress.org listing for Disable & Manage Updates describes separate controls for checking for updates, automatic-update behavior, and the display of update notifications, notices, badges, counts, and alerts across core, plugins, themes, and translations. It is an optional third-party plugin, not part of WordPress core. Review its maintenance activity, compatibility with the site’s WordPress version and extensions, security history, and access requirements before installing it. Test the effect on a staging site and preserve an administrator or maintenance owner who can still see actionable security updates.

Turn off WordPress update emails

Dashboard notices and email are independent. Removing update_nag will not reliably stop a mailbox message, and suppressing an email filter will not remove admin-menu badges. First identify the sender and subject: the message may be a core update notification, an automatic-update result, a hosting control-panel message, or a plugin’s own email.

Suppress core update notification email

For the core update notification email specifically, add this filter in a site plugin or must-use plugin:

<?php
add_filter( 'send_core_update_notification_email', '__return_false' );

This returns false to the filter that determines whether the administrator is notified about a core update. It changes the core email decision only; it does not disable update checks, automatic installation, or notices generated by plugins, themes, or a hosting service.

Rank #3

Sale

WordPress 24-Hour Trainer

$3.95

Buy on Amazon

Trace other email sources before filtering them

• Core message: Use the send_core_update_notification_email filter above.
• Automatic-update result: Check the site’s automatic-updater settings and the message wording. A core-email filter may not govern a report about an update that already ran.
• Hosting or control-panel message: Change notification preferences in that service rather than adding WordPress code.
• Plugin or theme email: Look for an email setting in that product’s own administration screen, or consult its documentation.

Keep at least one monitored address for security and maintenance events. Suppressing every message can hide a failed update, a vulnerable component, or a site that has stopped receiving background tasks.

Disable automatic updates when you have a manual patch process

WordPress’s Advanced Administration Handbook documents constants and filters that govern update behavior. They are not cosmetic controls: they decide whether background updates are allowed. The handbook strongly discourages broadly disabling automatic updates because minor and security releases help keep sites current.

Constants in wp-config.php

WP_AUTO_UPDATE_CORE accepts documented values for core update policy. A value of false disables automatic core updates; the 'minor' policy limits automatic core updates to minor releases, while true permits automatic core updates according to WordPress’s normal rules. AUTOMATIC_UPDATER_DISABLED disables the automatic updater more broadly and also disables update-notification emails according to the reference documentation.

define( 'WP_AUTO_UPDATE_CORE', false );
define( 'AUTOMATIC_UPDATER_DISABLED', true );

Place constants in wp-config.php before the line that says “That’s all, stop editing! Happy publishing.” Do not paste filter calls into this file. WordPress is not fully loaded when configuration constants are read, so add_filter() calls there can conflict with normal loading order.

Use filters in a must-use plugin

For plugin and theme installation decisions, create a must-use plugin such as wp-content/mu-plugins/update-policy.php:

Rank #4

Teacher Record Book

• Keep track of everything from attendance to test scores
• Spiral bound
• Measures 8-1/2" x 11"

$4.89

Buy on Amazon

<?php
add_filter( 'auto_update_plugin', '__return_false' );
add_filter( 'auto_update_theme', '__return_false' );

The dynamic auto_update_{$type} hook covers core, plugin, theme, and translation decisions. The documented hook names include auto_update_core, auto_update_plugin, auto_update_theme, and auto_update_translation. Returning false for plugins and themes stops their automatic installation while leaving you responsible for applying updates manually.

WordPress introduced plugin and theme automatic-update controls in version 5.5. The reference also records the default major-core behavior for new WordPress 5.6-and-later installations. These version details explain why an older site may behave differently from a newly installed one; always confirm the policy on the actual site rather than assuming the default.

Document the replacement workflow

If automatic installation is disabled, write down who owns updates, where they are tested, and how quickly security releases are applied. A practical manual process includes:

• A current backup that has been restored successfully in a test environment.
• A staging copy that uses the same PHP version, database engine, theme, and extensions as production.
• A change record containing the old and new versions, date, person responsible, and test result.
• A rollback plan for failed updates, including a known-good backup and access to hosting recovery tools.
• A recurring calendar check of Dashboard → Updates and any relevant security advisories.

Do not disable updates merely to make a dashboard quieter if nobody has accepted responsibility for this work. The operational risk is greater than the visual annoyance.

How the controls interact

Troubleshoot a notification that will not disappear

The red message is still visible

• Confirm you are testing with a user who lacks update_core; administrators should still see the notice when using the capability-based snippet.
• Check that the PHP file is loaded. A must-use plugin must be directly inside wp-content/mu-plugins, not in a subdirectory unless a loader file includes it.
• Clear any server-side or object cache and sign out and back in. Cached admin HTML can make a removed notice appear unchanged.
• On multisite, stop and review network roles instead of extending the non-multisite example blindly.

The plugin or theme badge remains

• Open Dashboard → Updates and confirm which item WordPress still considers outdated.
• Update the item manually or allow its per-item automatic update to run; changing the toggle alone does not make an available version disappear.
• Inspect the Plugins and Appearance screens for a second item with an update.
• If the alert is a custom banner, identify the plugin or theme that prints it and use that product’s setting rather than a core-update hook.

The email continues after the filter

• Check whether the subject is a core update notification. The filter shown here applies only to that core message.
• Look for an automatic-update result, host notification, or plugin-generated email and change the setting at its source.
• Confirm the filter is loaded from a plugin or must-use plugin, not inserted as an add_filter() call in wp-config.php.
• Review mail logs or the site’s mail provider to distinguish a newly generated message from a delayed or queued message.

A safe decision tree

1. Is the complaint a dashboard nag shown to editors? Use the capability-based update_nag removal pattern and keep it visible to maintainers.
2. Is it a plugin or theme bubble? Check the exact item and its built-in automatic-update control. If a custom banner remains, locate the extension that generated it.
3. Is it an email? Identify whether it is core, an automatic-update result, the host, or an extension, then change that source’s setting.
4. Is the actual goal to prevent files from changing automatically? Use documented constants or filters in a must-use plugin, not a display-only snippet.
5. Will someone apply patches manually? If there is no named owner, tested backup, staging workflow, and schedule, do not disable automatic updates broadly.

The least disruptive fix is usually the best one: hide a core nag only from non-maintainers, leave actionable update information available to an owner, and separate notification preferences from installation policy. That preserves the security value of WordPress updates while removing noise from users who cannot act on it.

Quick Recap

SaleBestseller No. 1

WordPress Multisite Administration

$34.38

Bestseller No. 2

Mon Site WordPress – Volume 2 – Administration & Utilisation (French Edition)

$9.90

SaleBestseller No. 3

WordPress 24-Hour Trainer

$3.95

Bestseller No. 4

Teacher Record Book

Keep track of everything from attendance to test scores; Spiral bound; Measures 8-1/2" x 11"

$4.89

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.