In this guide · 7 sections
Short answer
Keep unattended-upgrades on for security updates only, add a nightly reboot window (for example 03:00), turn on email reports, and schedule monthly manual updates for anything it does not cover: major OS versions, your CMS or app code, Docker images and third-party repositories.
What Ubuntu does by default
Ubuntu's automatic updates documentation says security updates are applied automatically, without user interaction, by the unattended-upgrades package, which is installed by default. Debian servers use the same unattended-upgrades package, so the settings below apply there too, but check that it is installed and enabled.
| Setting | Ubuntu default | What it means |
|---|---|---|
| Security updates | On, once a day | Fixes from the official -security repository install automatically |
| Other updates (-updates) | Off | Bug-fix updates wait for you |
| Automatic reboot | Off | Kernel and core library fixes wait for a manual restart |
| Email report | Off (no address set) | Nobody is told what was updated |
| Extra repositories and PPAs | Not included | Third-party software is not auto-updated |
| Service restarts (24.04+) | Automatic via needrestart | Services using updated libraries are restarted |
The two files to know are /etc/apt/apt.conf.d/20auto-upgrades (on or off, and how often) and /etc/apt/apt.conf.d/50unattended-upgrades (what to update, reboots, email, blocked packages).
Security-only vs all updates
For a small business server running a website or app, security-only automatic updates are the safer default. Security fixes are small and targeted; general updates change more and are more likely to affect your software.
Security updates only (default)
- Smallest changes, lowest chance of breaking your app
- Closes known vulnerabilities within a day
- No configuration needed on Ubuntu
Security plus -updates
- Picks up bug fixes too, so fewer manual updates
- Slightly higher chance of a behaviour change
- Needs the -updates line uncommented in 50unattended-upgrades
If you rely on a package that must not change version, such as a specific database build, you can block it with Unattended-Upgrade::Package-Blacklist. Ubuntu warns that blocking a package can also hold back other updates that depend on it, so use this sparingly and update that package by hand.
Set a safe reboot window
Kernel and core library updates only take effect after a restart. Ubuntu says unattended-upgrades can reboot automatically when /var/run/reboot-required exists, but this is off by default because reboots can be disruptive if the server does not come back. For a single web server, a scheduled early-morning reboot is usually the right trade-off.
Check updates are on
Open /etc/apt/apt.conf.d/20auto-upgrades and confirm both Update-Package-Lists and Unattended-Upgrade are set to "1".
Turn on automatic reboot
In /etc/apt/apt.conf.d/50unattended-upgrades, set Unattended-Upgrade::Automatic-Reboot "true".
Pick the reboot time
Set Unattended-Upgrade::Automatic-Reboot-Time "03:00". Ubuntu notes the time uses the server's local time zone, so set the server to Asia/Singapore or allow for UTC.
Make sure services start on boot
Reboot once by hand and check your web server, app, database and containers all come back without anyone logging in.
Test with a dry run
Run sudo unattended-upgrade --dry-run -v to see what it would install without changing anything.
What automatic updates do not cover
This is where most small business servers go wrong: the OS is patched, but the software that faces customers is years old.
| Item | Covered automatically? | What to do |
|---|---|---|
| Ubuntu packages from official repositories | Security fixes, yes | Nothing beyond reboots |
| Third-party repositories (Docker, Node, PHP PPAs) | No, unless added to Allowed-Origins | Add their origin or update monthly |
| Major OS upgrade (e.g. 22.04 to 24.04) | No | Plan before standard support ends |
| WordPress core, plugins, themes | No | Use the CMS updater or a care plan |
| Your app's dependencies (npm, composer, pip) | No | Review with npm audit or Dependabot, update and redeploy |
| Docker images | No | Pull and rebuild images, then recreate containers |
Canonical's release cycle page shows standard security maintenance for Ubuntu 22.04 LTS ending in May 2027, so servers on 22.04 should plan their upgrade in the next few months. Our software updates and patching guide covers PCs and apps, and the VPS hardening checklist covers the rest of a server's security.
Check that updates actually ran
Automatic updates fail quietly: a full disk, a held package or a broken repository can stop them for months. Ubuntu keeps detailed logs of each run in /var/log/unattended-upgrades.
To get a report by email, set Unattended-Upgrade::Mail to a shared address and Unattended-Upgrade::MailReport to "on-change" (the default) or "only-on-error". Ubuntu notes this needs a mail tool on the server that can send to your mail server, which many VPS setups do not have, so test it.
Monthly update check
Do it yourself or get help?
Turning on a reboot window and email report takes an experienced admin about half an hour. The ongoing work is the monthly app and container updates, and noticing when automatic updates have silently stopped.
IT Sorted is a Singapore-based team of developers with over 10 years of experience. Server Protection Care (S$149 per server a month) applies OS and app updates in a monthly window, checks protections are still on and sends a plain-English report. Software & Server Protection Setup (S$590) sets up automatic security updates with a safe reboot window, firewall, malware scans and a daily summary email for one server.
Frequently asked questions
Yes. Ubuntu's server documentation says the unattended-upgrades package is installed by default and applies security updates automatically once a day. It covers the official Ubuntu security repository and, where available, Expanded Security Maintenance. Automatic reboots and email reports are off until you configure them.
For a single small business web server, usually yes, if you choose a quiet time and have checked that every service starts on its own after a reboot. Reboot by hand once to test. If the server runs something that cannot be interrupted, schedule manual reboots weekly instead and check for the reboot-required file.
No. It updates operating system packages from the repositories it is configured for. WordPress core and plugins, npm or composer dependencies, and Docker images all need their own update process. These are the parts attackers target most, so put them on a monthly schedule or a maintenance plan.
Check the logs in /var/log/unattended-upgrades for recent runs, or configure the email report so you hear about changes or errors. Common causes of silent failure are a full disk, a package held back by a blacklist entry and a broken third-party repository. A monthly check catches all three.
It is optional. Security-only is the safer default for servers running business apps, because security fixes are small and targeted. Adding the -updates repository picks up bug fixes too but slightly raises the chance of a behaviour change. Many small businesses keep security-only automatic and apply other updates monthly.