Why are WordPress security updates delayed on WP Engine?
WP Engine relies on a cached updates API and slowly rolls out core releases over several weeks to manage hundreds of thousands of installs. Because there is no way to predict when a crucial patch will actually appear in the dashboard, administrators are forced to bypass the host and run updates manually to secure their sites.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
Found another way around this?
Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.
- 1Changing the site's update source settings to point directly to WordPress.org instead of the host mirrorDid this help you?
- 2Clearing the host cacheDid this help you?
- 3Using command-line inventory scripts over SSH to check for updates independentlyDid this help you?
- 4Applying minor security versions manually immediately upon release to remove the unknown factor.Did this help you?
- 5Creating manual backups, running updates in a staging environment, and pushing to production manually.Did this help you?
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“For reference, we use a number of different hosts and most of them update WP Core within 6 hours. We've been noticing that WP Engine always seems late and have been running them manually.”source ↗
“However, they are apparently straying from doing this ASAP and now updates take weeks. How am I supposed to trust them (especially given their bad relationship ~not their fault mind you~ with Automattic) that they can evaluate an unpublished RCE issue?”source ↗
“Yeah I had to do a deep dive with them last month about exactly this, and got essentially the same answer. Some version of "There are hundreds of thousands of installs, not practical to do them all at once, slow rollout over weeks." So basically there's no way to know when the updates will hit. We amended our internal practice for our clients so we apply any minor security versions ourselves immediately so we can remove the unknown factor completely.”source ↗
“yeah this was very annoying today. i updated my cloudways sites first then moved to siteground sites. for WP Engine i had to change the updates API to point to the Wordpress official ones instead of using the cached WP Engine ones which added time to my process.”source ↗
“I frequently find (today for example) that there is a security release available for a plugin , or in this case Wordpress version 7.1.2 that does not show in the usual dashboard view.”source ↗
Where this came up
People with this problem also raised
- 16Why won't my store data update through the API?
- 6Why is the 2026.1 software update so slow?
- 9How to stop software updates from breaking your production website
- 6Why is remote management software so slow and laggy?
- 39Why does every software update make things slower and harder to find?
- 3Why does Office 365 show zero required updates?