> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.faaaster.io/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# How do I configure automatic security updates?

The **Automatic security updates** card, when available on the production environment, lets Faaaster fix detected vulnerabilities in plugins, themes and WordPress according to your settings.

> **Prerequisite** — Your role must allow you to change the site. Otherwise, you can view the card but its settings are grayed out.

## Choose the updates you allow

1. Open your site, then the **Security** tab.
2. In the **Automatic security updates** card, turn **Fix detected vulnerabilities automatically** on or off.
3. Under **Allowed updates**, choose **Minor only** or **Minor and major**.
4. Under **Minimum severity**, choose the level from which a vulnerability should be fixed automatically.

Each change is saved immediately. By default, the setting is enabled for **Minor only** updates and **Critical and high** vulnerabilities.

## What happens after detection

Faaaster handles each component separately when a fix is published and allowed by your settings. Before the first update, all your plugins and themes are copied once: an update can change others, such as a theme that updates its own plugins.

Faaaster then waits for the update to be entirely finished before checking the site. If the site stops answering correctly, everything the update changed is put back to its previous version. The version a successful update replaced is kept for seven days. If the site still does not answer correctly, or if a changed component cannot be put back, our team is notified and steps in.

For WordPress, Faaaster returns to the previous version if the check fails. A required major update remains pending when you selected **Minor only**.

An update that does not install leaves your site unchanged. You can run it from your WordPress dashboard; if it fails there too, check with the publisher that this component's license is active.

When **Read only** is on (**Security** tab, **Server security** section), no update can be applied. Turn it off: the update will be tried at the next pass.

If your site does not have enough disk space to update safely, nothing is changed and the email says so. An administrator of your organization can grow the disk from the **Configuration** tab (**Disk** card); the update will be tried again at the next pass.

## Check the result

The card shows the **Last run** date, how many updates were applied, and how many were undone. The vulnerability email summarizes what was fixed automatically, what was undone, and which vulnerabilities still need attention, with the reason. If everything was fixed, no further action is required.