What you should take away from this is:TL;DR: Automatic Updates can help reduce the manual work of security and patch-level updates in Drupal, but it’s not right for every site. If your host provides update tools or you already have a Composer-based deployment workflow with automated backups, stick with that. For small or low-risk sites, or anyone curious to try Drupal CMS, Automatic Updates is worth exploringājust make sure you set up an automated backup strategy first.
- What Automatic Updates can and canāt do
- The technical requirements and limitations
- A decision matrix to help you determine if it’s a good fit
- Where to learn more in the Drupal CMS Guide
You can try it today by downloading Drupal CMS, where it’s pre-installed and ready to try if itās compatible with your host. There are also Automatic Updates releases available for Drupal 10 and 11.
What is āAutomatic Updatesā?
In this post, weāll walk through:
Keeping a Drupal site secure means staying on top of security updates, which are a kind of patch-level update. You may have heard of Automatic Updates, a tool that helps you apply patch-level updates to your site without the need to manually use Composer on the command line. Perhaps youāve installed Drupal CMS and encountered it there or in the documentation as a feature. Before you turn it on, make sure you understand whatās required and the best-fit use cases. Depending on your hosting provider and deployment workflow, you may already have the best update solution in place.
- A user interface for attended updates (click a button to update)
- An optional system for unattended updates (cron runs them for you)
- Tools to validate your siteās readiness and detect common update risks
- A sandboxed Composer workflow under the hood ā so updates happen in a temporary copy before being deployed
Automatic Updates is a big step forward in making Drupal more accessible and secure for smaller teams and solo site maintainers. But itās not a one-size-fits-all solution. Automatic Updates and Package Manager are still under active development, and limitations remain.
What Automatic Updates can do
- Applies patch-level updates to Drupal core
- Optionally updates contributed modules and themes (experimental)
- Validates update readiness
- Works through the UI or command line
What Automatic Updates canāt do
Is your site ready to run Automatic Updates?
Consider these questions before turning on Automatic Updates.
Automatic Updates does not back up your site. Youāll need to set up automatic backups before enabling unattended updates. We recommend using your hosting providerās tools if available.
Upgrading is the process of moving your site from a previous major version of Drupal to a newer version, for example from Drupal 7 to Drupal 11.
ā A Composer-based site
With the Automatic Updates module installed, you can check to see if your site is ready to use Automatic Updates.
ā Composer 2.7 or higher
Automatic Updates requires:
ā File system write access
Your site must be able to modify its own codebase during an update. Shared hosting and many platform providers (like Acquia or Pantheon) block this, which makes Automatic Updates incompatible unless you use it in a local or development environment.
ā An automated backup strategy
š” Even if you donāt use it in production, trying Drupal CMS locally can help you understand Drupalās evolving update infrastructure.
Your site must be managed by Composer. Most modern builds are, but double-check your setup if you’re unsure.
Should you use Automatic Updates on a Drupal project?
Composer 2.7 is required by Package Manager (as of writing). Package Manager is a core module that the Automatic Updates module depends on.
| Situation | Should You Use Automatic Updates? | Why? |
|---|---|---|
| Your hosting provider offers update tools or workflows | ā Prefer your host’s tools | Built-in support is often safer and better integrated |
| You already have CI/CD workflows for updates | ā Stick with Composer + CI | Youāre already in control with better testing |
| You donāt have automated backups set up | ā Not safe to use | Updates could break your site with no recovery path |
| You run a simple, low-risk site (blog, brochure) | ā Worth a try | Automatic Updates lowers maintenance effort |
| You want to test it in dev or staging | ā Go for it | Safe place to experiment |
| You want to reduce manual steps for patch updates | ā If you have automated backups in place, yes. | Helpful for reducing friction |
Automatic Updates refers to an actively developed Drupal feature that includes a contributed module and the core module, Package Manager. The plan is that eventually the contributed Automatic Updates module will be moved to Drupal core.
Take Automatic Updates for a test drive
- Download Drupal CMS to get Automatic Updates pre-installed.
- Install some recommended add-ons to try out features and get a demo site running locally.
- Wait for the next patch or security update release.
- Read the documentation on keeping your site up-to-date on the Drupal CMS User Guide. This section of the guide will get you up-to-speed on a general update and backup strategy, regardless if you use Automatic Updates.
Recap
Learn more: Make a backup before applying security updates
The purpose of Automatic Updates is to help site owners and developers keep Drupal core (and, eventually, modules and themes) up-to-date safely and easily. Right now, itās limited to providing patch-level updates to Drupal core. (Patch-level refers to a bug fix or security update releaseāthe third number in a release version, e.g. 11.2.1 to 11.2.2.) The Automatic Updates project currently includes:
- Prefer your hosting providerās tools when available
- You must have an automated backup strategy set up before you turn on Automatic Updates.
- Use Automatic Updates in development or simple sites to learn and experiment. The easiest way to do this is to install Drupal CMS.
- Read Keep your site up-to-date in the Drupal CMS Guide to learn more about creating an effective update strategy. This advice will apply to Drupal in general as well.
