When is wp_loaded initiated only with admin or only when user enters the site or both?

wp_loaded fires for both the front-end and admin section of the site.

This action hook is fired once WordPress, all plugins, and the theme are fully loaded and instantiated.

Since you’re checking for plugin updates, it might be best to hook into admin_init instead of wp_loaded — assuming you want to know if a user is logged in and viewing the admin section of the site.

function wpse_20160114_admin_init_update_plugin() {

    // don't run on ajax calls
    if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) {
       return;
    }

    // only administrators can trigger this event
    if(is_user_logged_in() && current_user_can('manage_options')) 
    {
        @include(plugin_dir_path(__FILE__) . 'wp-plugin-update.php');
    }
}

add_action('admin_init', 'wpse_20160114_admin_init_update_plugin');

In the case that you want to run on the front-end for all users

function wpse_20160114_update_plugin() {

    // don't run on ajax calls
    if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) {
        return;
    }

    // only run on front-end
    if( is_admin() ) {
        return;
    }

    include(plugin_dir_path(__FILE__) . 'wp-plugin-update.php');
}

add_action('wp_loaded', 'wpse_20160114_update_plugin');

As far as my tests are concerned, wp_loaded fires after init but before admin_init.

Front-End

• [ init ]
• [ widgets_init ]
• [ wp_loaded ]

Admin

• [ init ]
• [ widgets_init ]
• [ wp_loaded ]
• [ admin_menu ]
• [ admin_init ]