Automatic Updates Without Consent
According to user reports, the All in One SEO plugin for WordPress unilaterally turned on automatic updates. These updates coincided with a major upgrade, leading to multiple sites experiencing outages and other unintended issues.
Automatic Updates Without Consent
Automatic updates are meant to allow plugins to update themselves without any action from the publisher. The common expectation is that publishers choose to opt into this feature.
Some publishers typically backup their WordPress installations before making updates. This approach ensures that if something goes wrong, they can easily revert to the previous state. With automatic updates, saving a backup beforehand is no longer possible. A problematic update can escalate into a significant issue without a proper backup.
This scenario became a topic of discussion when a member of the Advanced WordPress Facebook group highlighted that All in One SEO had turned on automatic updates without clear notification, save for a note in the changelog. A changelog is essentially a record of changes made in an update.
The issue was framed as an ethical one, questioning whether a plugin publisher is responsible for explicitly notifying users about changes in the automatic update feature.
Public Reaction
Many users felt that automatic updates should always be an optional feature.
There was also some discussion on Twitter. Several publishers expressed their opinion that the automatic update option should not be enabled by default.
One user expressed their discontent on Twitter:
"I do not like to automatically update WordPress plugins, and I especially don’t like plugin software authors to try to force automatic updates on the marketplace. So much so, I will look to replace such software if I can. Please stop."
They followed up with another tweet:
"Although this message was prompted by the recent All In One SEO default setting of automatic update in the plugin, that is far from the only plugin software doing this. Offer the option, don’t set it as default, and make it plain as day as an option."
User Feedback on All in One SEO
The WordPress plugin repository support page saw several negative reports about the automatic update issue.
One user described the situation as a disaster:
"After nearly 10 years, I have to say goodbye.
This recent series of almost daily updates since version 4 was released really shows that the new owners of AIOSEO have no clue at all about SEO…
…I don’t have the time to invest in being a beta tester for a plugin that has 2 million users but now doesn’t work… because it is so full of bugs."
There is a support thread full of frustrated publishers who complained that their plugins auto-updated despite being set to not update automatically.
Another irate publisher wrote:
"Multiple sites have updated to 4.0.11 without my permission and while all auto updates are disabled.
Your once reliable plugin has destroyed hundreds of pages of social meta data on multiple sites, broken layout (and this after I fixed the problems and told you last week, I will be disabling all updates).
How dare you update my websites without my permission.
For everyone reading this, this plugin has come to the end of its life as we know/knew it.
Migrate everything you have now, while you still can."
Multiple All in One SEO 4.X Updates
The All in One SEO plugin updated from version 3.7 to 4.X on November 14, 2020. A problematic start saw a second update to version 4.01 on the same day to fix a database issue.
From November 14 through December 2020, the plugin issued twelve updates to address a multitude of issues, seemingly dozens of bugs. By comparison, Yoast SEO, another popular plugin, issued only three updates within the same time period.
Here are some bug fixes from just one update:
- Fixed: Bug that prevented editors and authors from editing SEO titles and descriptions
- Fixed: TruSEO support in the classic editor URL not fully working on extra long URLs
- Fixed: Issue where the closing head tag did not always display
- Fixed: Issue on a few remaining sites where the title tag would strip out a $ and any numbers after it
- Fixed: PHP error related to missing array during the migration
- Fixed: Issue where AIOSEO would not remove the trailing /amp from canonical URLs
- Fixed: Issue where notices would appear in the log when trying to access our log file
- Fixed: Conflict with WP Shop plugin
However, it’s the update from December 21 that appears to have introduced the automatic update feature. This is the only update in the changelog that mentions auto updates but is somewhat vague:
"Updated: Default options for auto updates"
Should WordPress Plugins Auto Update Without Permission?
Automatic updates can be beneficial for simpler sites, but backing up a site is a crucial step before updating. Many believe publishers should have the choice to opt into these updates.
The publishers of All in One SEO have apologized and stated they are removing the automatic updates. The question remains: should auto updates have been enabled by them in the first place?
