Most attacks use weaknesses that already have a fix. A server that installs security updates by itself closes those gaps without you remembering to log in. Ubuntu includes a tool for this called unattended-upgrades.
Before you start, connect to your VPS with SSH.
1. Install and enable it
sudo apt update
sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgradesChoose Yes when asked. By default it installs only security updates, which is the safe choice.
2. See what it will do
sudo unattended-upgrade --dry-run --debug 2>&1 | tail -n 20The dry run shows what it would install, and changes nothing.
3. Decide about reboots
Some updates, such as a new kernel, only take effect after a reboot. You can let the server reboot itself at a quiet hour. Open the settings file:
sudo nano /etc/apt/apt.conf.d/50unattended-upgradesFind and set these lines (remove the // at the start of each):
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:30";Save with Ctrl+O, then Enter, then exit with Ctrl+X. Choose a time when few people use your site. Skip the automatic reboot if your app cannot start by itself after a restart; in that case reboot by hand when the system asks.
4. Check that it ran
cat /var/log/unattended-upgrades/unattended-upgrades.log | tail -n 20
ls /var/run/reboot-required 2>/dev/null && echo "A reboot is needed"Good to know
- This updates the operating system's packages. It does not update WordPress, your plugins, or your own code. Keep those updated too.
- Make sure your services start after a reboot. For a Node.js app that means running it under PM2 or systemd: see host a Node.js app on a VPS.
- Take a backup before turning on automatic reboots on an important server.
Run it on your own VPS
Ubuntu VPS in India: Ubuntu releases with long-term security updates. Prices are in rupees, you can pay by UPI, and you get a GST invoice.