The Updates page collects everything pending across your whole portfolio, so the question stops being which sites need attention and becomes what do I want to update.

Updating by hand

Select any combination of plugins, themes and core across any number of sites, and apply them in one action. Progress is reported per item; a failure on one site does not stop the others.

Each site keeps a rollback point for plugin updates, so a plugin that breaks a site can be put back to its previous version from the site's Updates tab without touching a backup.

Automatic updates

Auto-updates are configured per site, on the site's Updates tab, and are off until you turn them on. The policy has four parts:

What — core, plugins, themes, independently.
When — how often the site checks for updates to apply.
Never — a denylist of plugins or themes to leave alone. Use it for anything customised, licensed or fragile.
Only — an allowlist, if you would rather name what may update rather than what may not.

The denylist wins over the allowlist.

Vulnerable plugins

A site can be set to auto-update a plugin only when a known vulnerability is involved, leaving ordinary version bumps to you. It is the right default for sites where you want control but not exposure.

What to expect in practice

A run takes a few minutes; the site stays online throughout.
Results, including failures, land in the site's Activity log.
If a run crashes mid-way — a plugin update raising a PHP error, for instance — the lock it holds expires within half an hour and the next run proceeds.

Sites with no traffic

Worth knowing, because it explains a difference you may notice. WordPress runs its own scheduler only when somebody visits the site, so a site nobody visits would never get round to its automatic updates.

MegaManager covers that: when a site has not run its updates for several hours, the platform asks it to. Your settings still decide what happens — a site with automatic updates switched off is asked once, says no, and is left alone. A site that never sees a visitor is checked roughly as often as a busy one.

The same applies to the figures on the site's page: versions, database size and update counts are refreshed from our side when the site's own hourly job has not run.