Turn On Automatic Security Updates on Your VPS

Security updates versus all updates

Applying every update automatically can change application behaviour. Applying only security updates is low risk and covers what attackers actually use. The configurations below install security fixes automatically and leave feature upgrades to you.

Ubuntu and Debian: unattended-upgrades

sudo apt install -y unattended-upgrades apt-listchanges
sudo dpkg-reconfigure -plow unattended-upgrades

Answer yes. This writes /etc/apt/apt.conf.d/20auto-upgrades, which should contain:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

The policy lives in /etc/apt/apt.conf.d/50unattended-upgrades. The defaults allow only the security origin. Useful settings to review there:

Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Automatic-Reboot "false";
Unattended-Upgrade::Mail "[email protected]";

Mail delivery needs a working mail transfer agent on the server; skip it if you check logs instead.

Test without changing anything:

sudo unattended-upgrade --dry-run --debug

Logs are written to /var/log/unattended-upgrades/.

AlmaLinux, Rocky Linux and Fedora: dnf-automatic

sudo dnf install -y dnf-automatic

Edit /etc/dnf/automatic.conf:

[commands]
upgrade_type = security
download_updates = yes
apply_updates = yes

Then enable the timer:

sudo systemctl enable --now dnf-automatic.timer
systemctl list-timers dnf-automatic.timer

Run history is available with sudo dnf history and journalctl -u dnf-automatic.

Handling reboots

Kernel and core library fixes only take effect after a reboot. Three approaches, from simplest to most controlled:

1. Automatic reboots at a quiet hour. On Ubuntu and Debian set Automatic-Reboot "true" and Automatic-Reboot-Time "04:00". Suitable for stateless web servers and personal projects.
2. Reboot when flagged, on your schedule. Check /var/run/reboot-required (Debian family) or run sudo dnf needs-restarting -r (RHEL family) from a weekly maintenance script.
3. Restart services only. needrestart on Debian-based systems restarts daemons that use updated libraries, which covers most fixes without a full reboot.

Because VeloxMedia uses live migration for host maintenance, the platform itself never needs to reboot your server; reboots are only ever for updates inside your OS.

Do not forget applications

OS updates do not patch software you installed outside the package manager. Keep a short list of what needs manual attention, for example WordPress and its plugins, Docker images (docker compose pull), language packages and anything built from source. The vulnerability monitoring in the VeloxMedia control panel scans for known CVEs and exposed services, which helps catch what slips through.

Before big upgrades

Automatic security patching is routine. Major version upgrades are not. Take a snapshot from the control panel first; if anything breaks, restoring takes a few clicks.