Managed vs Self-Managed WordPress: Who Handles Security Updates?

In short: with managed WordPress hosting, the host applies core, plugin, and theme security updates for you; with self-managed hosting, you are responsible for every update yourself. This article explains exactly who does what in each setup, how updates actually work behind the scenes, and what you need to know to keep your site secure.

What “Managed� and “Self-Managed� Actually Mean

The difference comes down to who controls the server and who is accountable for maintenance. Managed WordPress hosting is a service where the hosting company optimizes the server specifically for WordPress and takes over routine administrative tasks—including security updates. You log in, manage your content, and the host handles the technical upkeep. Self-managed hosting (often called traditional or unmanaged hosting) gives you a server or a shared account where you install WordPress yourself and take on all maintenance duties, including updates, backups, and security hardening.

How Security Updates Work in Managed Hosting

Managed hosts use a combination of automatic updates and staged rollouts to keep WordPress secure. Most managed hosts automatically apply minor core updates (like 6.4.1 to 6.4.2) as soon as they are released, because these are security and bug fixes that rarely break sites. Major core updates (like 6.4 to 6.5) are often tested by the host against their own infrastructure before being applied, sometimes with a delay of a few days to a few weeks. Plugins and themes are trickier: some managed hosts update them automatically by default, while others require you to enable that option in a control panel or dashboard. For example, a host might offer a setting that says “auto-update plugins� with an option to exclude specific plugins you’re worried about.

Importantly, managed hosts also handle server-level security updates—the operating system, web server software, PHP version, and database software. These are invisible to you but critical, because a vulnerable server can compromise every site on it. When you use managed hosting, you don’t need to worry about SSHing into a server to run apt update or restart services. The host does that as part of their maintenance window.

How Security Updates Work in Self-Managed Hosting

On self-managed hosting, you are the system administrator. WordPress core updates can be set to auto-update by default (since WordPress 3.7, minor security updates apply automatically unless you disable them), but you must ensure that your server’s PHP version, MySQL/MariaDB, and web server (Apache, Nginx) are kept up to date. This means regularly running package manager commands, monitoring security mailing lists, and testing updates in a staging environment before applying them to production.

Plugins and themes do not auto-update by default in self-managed setups—you must manually click “Update� in the WordPress admin or configure a third-party service like WP-CLI to run updates via cron. Many self-managed users also rely on a security plugin like Wordfence or Sucuri to add a firewall and malware scanning, but those plugins do not replace the need for core and server updates.

Common Problems When Updates Are Ignored

The most common consequence of skipping updates is a hacked site. WordPress is open source, so vulnerabilities in core, plugins, and themes are publicly disclosed. Attackers scan the internet for sites running outdated software and exploit known flaws within hours of a patch being released. A 2023 report from Patchstack (a WordPress security company) found that plugin vulnerabilities account for the vast majority of WordPress exploits, and most attacks target plugins that are months or years out of date.

Another problem is update conflicts. If you update a plugin and it breaks your site, you need to be able to roll back quickly. Managed hosts often keep backups and offer one-click restore, while self-managed users must have their own backup system and test updates in a staging environment to avoid downtime. Without a staging site, a bad update can take your site offline for hours while you troubleshoot.

How to Choose the Right Setup for Your Needs

Your choice depends on your technical comfort, your budget, and how much risk you can tolerate. Here are the key factors to weigh:

• Technical skill: If you don’t know how to use SSH, manage a server, or read PHP error logs, self-managed hosting will be a constant struggle. Managed hosting abstracts all of that away.
• Time commitment: Self-managed hosting requires regular maintenance—updates, backups, monitoring, and security audits. If you’d rather spend time creating content, managed hosting frees you up.
• Budget: Managed WordPress hosting typically costs more—often $20–$50 per month for a single site, compared to $5–$15 for shared unmanaged hosting. But the cost includes maintenance and often better performance and support.
• Control: Self-managed hosting gives you full control over the server environment, which is essential for custom configurations, specific PHP extensions, or unusual security requirements. Managed hosts impose limits on what plugins and code you can run.
• Site criticality: If your site is a business’s main revenue source, the cost of a hack (downtime, data loss, reputational damage) far outweighs the savings of unmanaged hosting.

Cost Comparison and What You Pay For

Self-managed hosting is cheaper upfront but has hidden costs. You pay for your own time (or a developer’s time) to handle updates, security, and troubleshooting. If you value your time at $50/hour and spend two hours a month on maintenance, that’s $100/month in labor—more than most managed plans. Managed hosting also includes features like automatic backups, staging environments, and specialized WordPress caching, which you would otherwise need to purchase separately or configure yourself.

However, managed hosting is not a silver bullet. You still need to choose strong passwords, enable two-factor authentication, and avoid installing nulled or pirated plugins. The host handles updates, but it cannot prevent you from installing a malicious plugin or using a weak admin password.

Safety and Security Best Practices (Regardless of Hosting Type)

No matter who applies updates, you should follow these practices to keep your site secure:

• Use strong, unique passwords for all WordPress admin accounts and your hosting control panel. Enable two-factor authentication.
• Limit login attempts to prevent brute-force attacks. A security plugin or a server-level rule can block IPs after a few failed attempts.
• Keep backups—ideally offsite and automated. Managed hosts often include backups, but you should verify they work by restoring a test site.
• Remove unused plugins and themes—every piece of code is a potential attack surface.
• Use HTTPS with a valid SSL certificate to protect data in transit.
• Monitor your site for uptime and unexpected changes. Free tools like UptimeRobot or a security plugin’s scan can alert you to problems.

Frequently Asked Questions

Do managed hosts update all plugins automatically?

Not always. Many managed hosts auto-update plugins by default, but some require you to enable that feature. Even when enabled, you can often exclude specific plugins that you don’t want updated automatically. Check your host’s documentation to see how to configure this.

Can I turn off auto-updates on managed hosting?

Yes, most managed hosts let you disable auto-updates for core, plugins, or themes. However, doing so defeats the main security benefit of managed hosting. If you disable them, you must manually check for updates regularly—and you’ll still be responsible for any vulnerabilities that arise.

What happens if a plugin update breaks my site on managed hosting?

Managed hosts typically keep a backup of your site before applying updates. If a conflict occurs, you can restore to the previous version via the host’s control panel. Some hosts also have a “rollback� feature specifically for plugin updates. If you don’t have a backup, you’ll need to use a staging site to troubleshoot.

Is self-managed hosting ever the right choice?

Yes, if you are a developer who needs full control over the server environment, or if you have the time and expertise to maintain a server properly. For a hobby site or a business with no technical staff, managed hosting is almost always safer and more cost-effective in the long run.

Do I still need a security plugin if I use managed hosting?

Most managed hosts provide a server-level firewall and malware scanning, so a security plugin may be redundant. However, if you want features like login protection, file integrity monitoring, or a web application firewall, a lightweight plugin can add value. Check your host’s documentation to see what they already cover.

What about WordPress core updates—are they always safe?

Minor core updates are almost always safe and are applied automatically by both WordPress and managed hosts. Major core updates can occasionally introduce compatibility issues with plugins or themes. Managed hosts usually test major updates before rolling them out, but you should still check your site after any major update.

Related

• IBM Bob vs GitHub Copilot Business: On-Premises Data Control
• AI Boom vs. Dot-Com Crash: What Developers Should Watch
• AI Agent Harness vs Framework: What’s the Difference?