Automated updates in Joomla 6, and what they send

Older guides describe update settings as one thing: an update channel and a minimum stability. Those still exist, in System, Global Configuration, Update. What is new is that Joomla can apply updates on its own.

How it works

Automated Updates registers your site with a service the Joomla project runs. The service knows a new release is out and triggers the update, rather than waiting for someone to click a button.

You can switch it on in the Joomla Update component's options, or from the command line:

php cli/joomla.php core:autoupdate:register
php cli/joomla.php core:autoupdate:unregister

The conditions

Two limits are worth knowing before you plan around it.

• Your site has to be reachable from the internet. A site behind a firewall, on staging, or on your laptop cannot be reached by the service, so it stays manual.
• It only works on the default channel with minimum stability set to Stable. Sites on testing channels are on their own.

What gets shared

Registering hands the Joomla project some information about your site: the site URL, PHP version, database type and version, the Joomla version and the server operating system. Joomla says it uses this to improve the service, and there is no reason to doubt that, but if you host for clients you should know it happens before you enable it on their behalf.

Whether to use it

For a small site with no unusual extensions, automated updates close the window between a security release and your site actually having it. That window is where most Joomla sites get compromised, and it is usually months wide.

For a site with heavy customisation, keep it manual and test on a staging copy first. And either way, make sure the backups run before the update does, not after.