When is wp_loaded initiated only with admin or only when user enters the site or both?

wp_loaded fires for both the front-end and admin section of the site.

This action hook is fired once WordPress, all plugins, and the theme are fully loaded and instantiated.

Since you're checking for plugin updates, it might be best to hook into admin_init instead of wp_loaded -- assuming you want to know if a user is logged in and viewing the admin section of the site.

function wpse_20160114_admin_init_update_plugin() {

    // don't run on ajax calls
    if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) {
       return;
    }

    // only administrators can trigger this event
    if(is_user_logged_in() && current_user_can('manage_options')) 
    {
        @include(plugin_dir_path(__FILE__) . 'wp-plugin-update.php');
    }
}

add_action('admin_init', 'wpse_20160114_admin_init_update_plugin');

In the case that you want to run on the front-end for all users

function wpse_20160114_update_plugin() {

    // don't run on ajax calls
    if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) {
        return;
    }

    // only run on front-end
    if( is_admin() ) {
        return;
    }

    include(plugin_dir_path(__FILE__) . 'wp-plugin-update.php');
}

add_action('wp_loaded', 'wpse_20160114_update_plugin');

As far as my tests are concerned, wp_loaded fires after init but before admin_init.

Front-End

• [ init ]
• [ widgets_init ]
• [ wp_loaded ]

Admin

• [ init ]
• [ widgets_init ]
• [ wp_loaded ]
• [ admin_menu ]
• [ admin_init ]

wp_loaded is being triggered after the core initialization is done and before any output is emitted. user authentication is also done at this stage.

In general, you will need to hook on it, or earlier hooks, only if you need to change any of the globals initiated by core before any actual output is done. If you are interested only in changing the output this hook is too early and you better find a more specialized hook that is triggered later. For admin it can be admin_init while for front-end it can be template_redirect which is triggered when wordpress decides which template to use or wp_head that is (almost) the first hook that is triggered as part of the front-end output itself.

wp_loaded runs front end and back end regardless of user and page. Whenever a page is requested wp_loaded will run.

Typically, by the time wp_loaded executes, Wordpress is done loading and it is also the first hook available to use after WordPress is fully loaded. Users have already being validated/authenticated (users was already authenticated on init, this happens front end and back end) by this time, so that data is already availble.

You should look at the action hook execution sequence for both front end and back end actions and determine which hook will be best for the specific application you need to run. Note that certain actions like init and wp_loaded executes on both front end and back end, so you would need to do the is_admin() check to specifically target the front end or back end according to your needs.

Sorry that I cannot be more specific, but your question is lacking very specific info, but in general you would do something like the following on wp_loaded on the front end only

add_action( 'wp_loaded', function ()
{
    if ( !is_admin() ) { // Only target the front end
        // Do what you need to do
    }
});