Drupal automatic updates is a module that enables Drupal to update itself without user interaction. It's based on the update manager of Drupal core and uses the same database tables and data structures, which means it doesn't require any additional infrastructure.

Automatic Updates is maintained by the core team but has been used in production by thousands of developers. It is expected to be in Drupal core on the release of Drupal 10

What are Drupal automatic updates?

Drupal automatic updates is a feature that will automatically install new Drupal core updates when they are released. This can be done without you having to lift a finger!

The first versions of the Drupal module were created by members of the Drupal security team in order to help ensure their sites were receiving critical security fixes in a timely manner. The module has since been made available for all Drupal users and it's now being developed as part of Drupal core itself.

Why Drupal automatic updates are important?

Drupal updates can be time-consuming. Moreover, you always need a skilled developer to do so. So unless you have an advanced DevOps system running that can make you run updates with the click of a button, you always need the intervention of a developer.

In the future, these will auto-update. Making Drupal an extremely advanced and even more secure enterprise CMS.

So, why this is very important:

  • Site-maintenance can be a lot of work
  • Too many sites don't take security updates
  • Composer can be hard, some people even do not use it yet

What kind of automatic updates are there?

There are three ways of automatic updates:


This is the way a lot of us already do it:

composer update drupal/core-recommended --with-all-dependencies

Attended automatic update

You head to the updates module and click for an update
Drupal automatic update

Unattended automatic updates (cron)

These are the real automatic updates like you imagine them. Drupal will automatically update. You can choose however between "All supported updates" and "Security updates only". 

Drupal automatic update

If this sounds good to you too—and why wouldn’t it?—then let's talk about how Drupal's automatic update system works.

How do automatic updates work?

So when the system has a "go", either manual or on cron, it will copy your site separately and download the updates separately. When everything is done, it will place your newly updated site over your old site.

What are the limitations and requirements?

What are the requirements

  • You need a writeable file system
  • You need to use composer 2

Are there limitations?

  • Unfortunately, it cannot commit updates to version control
  • Major updates, like going from Drupal 9 to Drupal 10 are not included in auto-updates.
  • It does not support multi-site environments


Automatic updates are there for people that do not have full-time developers on their projects. If you do have a team, you may be better off with just command-line and git updated operations.

Good resources on automatic updates:


Saved you some valuable time?

Buy me a drink 🍺 to keep me motivated to create free content like this!