I would like to be able to disable the WordPress and Plugins updates through code so that even the wordprees admin can not do it.
Only when the web developer allows it.
Do these lines serve me?
define( 'AUTOMATIC_UPDATER_DISABLED', true );
define( 'WP_AUTO_UPDATE_CORE', false );
With the following lines in the wp-config.php you disable:
TODO:
define( 'WP_AUTO_UPDATE_CORE', false );
Plugins only:
add_filter( 'auto_update_plugin', '__return_false' );
Themes only
add_filter( 'auto_update_theme', '__return_false' );
Unfortunately, WP is a highly attacked framework. In my UTM most of the attacks received are towards WordPress and range from attacks to the login to any badly programmed plugin. My recommendation is always to keep your WP updated because important security patches are released in each update.