How to Turn On Automatic Security Updates on Ubuntu

You do not want your server’s safety to depend on whether you remembered to log in this week.

Short version: on Ubuntu, automatic security updates are handled by a package called unattended-upgrades. It can install important security fixes on its own, so known holes get patched sooner without you manually running updates every time. You should still keep backups, check your server occasionally, and understand whether automatic reboots are enabled.

Why turn on automatic security updates on Ubuntu?

Security updates are like replacing a broken lock after everyone in town has heard it can be picked.

When Ubuntu publishes a security fix, it usually means a weakness has been found in something your server uses: the Linux kernel, OpenSSL, sudo, SSH, a web server, or another common package. Attackers often scan the internet for machines that missed those fixes.

Automatic security updates reduce the gap between “a fix exists” and “your server has the fix.” That gap matters. A server left unpatched for weeks is not safer because nothing looks wrong from the outside.

This does not replace basic hardening. You still want a firewall, sensible SSH access, and restorable backups. If you have not done those yet, start with the plain-English guides on setting up a firewall at /blog/set-up-a-firewall-on-your-server and backing up your server at /blog/back-up-your-server.

How do you enable unattended-upgrades on Ubuntu?

Ubuntu’s normal tool for this is called unattended-upgrades. Think of it as a night cleaner: it does not redesign the building, but it quietly handles the routine cleanup that should not wait for you.

On many Ubuntu server images, unattended-upgrades is already installed. If it is not, you install the unattended-upgrades package and enable periodic apt tasks. apt is Ubuntu’s package manager — the part of the system that installs and updates software from Ubuntu’s official repositories.

The important setting is usually in Ubuntu’s apt configuration, where automatic update checks and unattended upgrades are turned on. You may see settings like APT::Periodic::Update-Package-Lists and APT::Periodic::Unattended-Upgrade. In plain English, those mean: refresh the list of available fixes, then install the allowed ones automatically.

By default, Ubuntu’s unattended-upgrades is commonly focused on security updates, not random major changes to your whole server. That is the right idea. You want urgent lock repairs, not surprise renovation.

Should automatic updates reboot the server?

Sometimes a security fix is installed but does not fully take effect until the server restarts. Kernel updates are the classic example.

Ubuntu can be configured with Unattended-Upgrade::Automatic-Reboot. If that is enabled, the server may restart automatically when an update needs it. That can be fine for a small personal app, a side project, or a low-traffic site. It can be risky if you run something that must stay online at a specific time.

The safer mental model is this: automatic updates patch the software, while reboots decide when the patched parts actually replace the running parts. If uptime matters, you may want updates to install automatically but reboots to happen during a maintenance window you understand.

Also remember that a reboot can expose hidden problems. A service that was started by hand months ago may not come back after restart. A forgotten database setting may suddenly matter. That is why automatic updates work best when your setup is documented and boring, not mysterious.

What can go wrong with automatic security updates?

Most of the time, automatic security updates are uneventful. That is the point. But you should know the common failure modes.

One risk is disk space. If the server is already nearly full, updates may fail or leave packages half-configured. If your site is slow or behaving strangely, disk pressure is one of the things to check; we explain the basics in /blog/why-is-my-server-slow.

Another risk is service compatibility. Security updates are meant to be safe, but a web app might depend on an old library behavior, or a custom setup might be fragile. This is less about Ubuntu being dangerous and more about your server being a stack of moving parts.

A third risk is false confidence. Automatic updates do not protect you from weak passwords, exposed admin panels, missing backups, bad file permissions, or an app with its own outdated plugins. They are one layer, not the whole roof.

The best pattern is simple: turn on unattended-upgrades, keep enough disk space free, make sure backups can actually restore, and occasionally check that updates are succeeding.

The shortcut

Server Manager helps by keeping this kind of server hygiene visible instead of buried in a memory you have to reconstruct later. The outcome is that routine safety work stays understandable: you can see what the server is for, what belongs to it, and what needs attention without digging through old notes.

For the problems in this post, that means fewer surprises from forgotten maintenance: missed security patches, a server that needs a reboot but nobody notices, or a setup that becomes hard to reason about months later. The real benefit is not avoiding every technical detail; it is keeping the server legible enough that updates, restarts, and checks feel manageable.

That matters most when you host more than one thing. If one project breaks after an update, you want to understand what changed and what depends on what, instead of treating the whole server like a locked box.

FAQ

Does Ubuntu install security updates automatically by default? Sometimes. Many Ubuntu server images include unattended-upgrades, but you should verify that it is installed and enabled.

**Is unattended-upgrades safe?** For most small servers, yes. It is designed for routine security fixes, not surprise major upgrades.

Will automatic security updates update my web app too? Usually no. It updates Ubuntu packages. Your app, WordPress plugins, Docker images, or custom code may need separate maintenance.

Do I still need backups? Yes. Updates reduce risk, but backups protect you when an update, mistake, disk issue, or bad deployment causes damage.

What is the win?

Turning on automatic security updates on Ubuntu gives you a quieter baseline. Known security holes get patched sooner, and your server does not rely entirely on your calendar.

You still own the responsibility for backups, reboots, disk space, and the apps you run. But with unattended-upgrades in place, one important piece of maintenance becomes routine instead of easy to forget.