Configure automatic updates

The automatic updates feature is ideal for small to medium-sized sites—especially those run by site owners without a dedicated developer team or a complex deployment process. If your site relies primarily on modules bundled with Drupal CMS or other well-supported contributed modules, and you prefer a hands-off approach to routine security and maintenance tasks, enabling automatic updates helps you stay secure with minimal effort.

However, if you manage a mission-critical or highly customized website—where changes must be tested in a dev → stage → live workflow—or if your hosting platform provides its own update tools, you may find that alternative solutions offer more control and reliability. In those cases, working closely with a hosting provider or a development team is often the safer approach, ensuring updates don’t break custom functionality.

Note: Right now the update UI only supports patch updates for Drupal core. For minor, or major, version updates you’ll need to use Composer. Learn more about semantic versioning.

Prerequisites

• Your hosting provider must support automatic updates. To verify updates can be applied go to Reports > Status report (/admin/reports/status). Under Update readiness checks, look for the status Your site is ready for automatic updates.
• A backup strategy. Learn more.
• The Administer software updates and View software update notifications administrative permissions.

⚠️ Make sure you have automated backups!

The Drupal CMS automatic updates feature does not make a backup before performing an update. Consider using a module like Backup & Migrate, or adding additional steps to your environment’s process that runs Drupal CMS’s scheduled cron tasks, that automates the process of creating a backup before updates are applied so that you can safely rollback in the event of a failure. Learn more in Make a backup before applying security updates.

Failure to do so could result in a broken site with no ability to revert to a previous version.

Set up automatic updates

To configure your site to automatically apply updates:

1. Go to Reports > Available updates (/admin/reports/updates) and choose the Settings tab.
2. Set the Unattended background updates field to Security updates only.
3. Choose an option for How unattended updates should be run:
   1. By using the Automated Cron module or a request to /system/cron: This relies on Drupal’s cron system. Drupal will check for, and apply, updates each time cron is run. This works well for sites already using cron and running a modest number of extensions. You don’t have much control over when updates are applied with this option.
   2. By using the auto-update command-line utility: This uses a standalone script run directly from the command line via system cron job or other scheduling mechanism. This approach is better suited for larger sites or those with more advanced workflows, giving you finer control over when and how updates are applied. For example, if you want to apply updates during off-peak hours—after a backup—you’ll need to use this option.
4. Press Save configuration to save your changes and enable automatic updates.

To verify that updates are working, you review the site’s logs and look for messages about Drupal CMS or extensions being updated.

Customize the maintenance mode message

Did you know that when background updates are applied, your site will be automatically put into maintenance mode while the process runs? This means that during that time visitors to your site (other than those logged in as a site administrator) will see a temporary message. You can configure this message by going to Configuration > Development > Maintenance mode (/admin/config/development/maintenance) and entering a value there.

Wrap-up

The automatic updates feature can be configured to check for and apply security updates for Drupal CMS and the extensions your site uses automatically in the background. It can be triggered either via Drupal’s built-in cron, or via an external script. Regardless of which option you choose you should ensure that you are also making regular backups as part of this process.