PHP isn’t a permanently-running process: it only runs when requested.
So as far as I can tell, WordPress can only update itself when someone
loads a web page. But the update process is not instantaneous, so
surely a user visiting the site would have a really slow page load.Is there a different trick they use for automatic updates? I’ve
searched all over the place but haven’t found any explanation.
The system you’re looking for here is called “WP Cron”. It’s a background process system in WordPress that allows events to occur outside of normal processing. They still need a trigger to kick them off, but they don’t interfere with page loads because of the background process.
So yes, somebody must load your page. Off in the default-filters.php file, you’ll find this line of code:
add_action( 'init', 'wp_cron' );
So, on every page load, the wp_cron function runs. This function is over in wp-includes/cron.php and what it does is to check the scheduled events in the database. If there are any processes it needs to run in the background, then it calls the function spawn_cron.
Spawn cron has two possible methods of operation, but the first and most common one is to call the wp_remote_post function to make a connection back to itself, on the URL of wp-cron.php. By making this extra HTTP request, it starts another PHP process to do all the actual work. The request it makes here is non-blocking, with a timeout of 0.01 seconds. So, it doesn’t actually get any results here. The purpose of the request is simply to start a new process in the background. After this is done, it simply returns, so the viewing user never has any delays.
The wp-cron.php process is what does the actual work, and the update, and everything else. Lots of processes in WordPress are handled by the cron system. Scheduled post publishing, processing pings, update checks, anything which needs to happen outside the normal flow can be scheduled and then run on an as-needed basis.
But yes, a normal hit to the site must indeed happen to kick off the process. And no, WordPress.org does not contact your site directly to kick things off, your site has to receive some form of traffic to start it up. Any form of traffic will do.