cPanel releases security fixes and features regularly. An outdated server is one of the easiest ways to get compromised. WHM's Update Preferences decide which release tier you follow and whether cPanel, system packages and Apache update automatically.
MdmHost manages these server settings on its hosting plans. This guide is for administrators of their own cPanel VPS or dedicated server with root access.
Before you start
- Root access to WHM and SSH.
- Current backups (see backup configuration).
Release tiers
| Tier | Use it for |
|---|---|
| LTS | Long-term support; fewest changes. Good for conservative production servers. |
| STABLE | Tested releases; good default for production. |
| RELEASE | Newer features, slightly earlier than STABLE. |
| CURRENT / EDGE | Testing only; not for production. |
Set update preferences
- Go to WHM → Server Configuration → Update Preferences.
- Choose the Release Tier (STABLE or LTS for production).
- Set cPanel & WHM Updates to Automatic.
- Set Operating System Package Updates to Automatic so security patches install with the nightly update.
- Keep Apache SpamAssassin Rules Updates and Real-time Blackhole List updates automatic.
- Click Save.
Automatic updates run nightly through the upcp cron job.
Note: Updates within a major version are automatic. Moving to a new major version can be blocked by a "major version" setting on some tiers; review release notes before allowing it.
Run an update manually
/usr/local/cpanel/scripts/upcpAdd --force to reinstall the current version if files are damaged. Logs are in /var/cpanel/updatelogs/.
Tip: Run upcp in a screen or tmux session so an SSH disconnect does not interrupt it.
Other software to keep updated
- EasyApache 4 packages update with system updates (see EasyApache 4).
- CloudLinux, LiteSpeed and Imunify360 update through the package manager or their own updaters (see LiteSpeed on cPanel).
Troubleshooting
upcp fails with a lock error
Another update is running. Wait, or check for a stale process with ps aux | grep upcp.
Update blocked by a "blocker"
WHM shows blockers such as an unsupported OS or old MySQL version on the update screen. Resolve the blocker, then rerun upcp.
Licence errors after update
Refresh the licence with /usr/local/cpanel/cpkeyclt (see licence invalid errors).
Frequently asked questions
Does updating restart customer websites?
Most updates reload services briefly without visible downtime. Major updates may restart services; schedule them for quiet hours.
Can I go back to an older cPanel version?
Downgrades are not supported. Test major changes on a staging server first.
How do I know an update ran?
Check the latest file in /var/cpanel/updatelogs/ or the version shown at the top of WHM.
Should OS updates really be automatic?
For security patches, yes. Kernel updates still need a reboot to take effect; plan reboots monthly or use live patching such as KernelCare.
What are cPanel version numbers?
Versions look like 11.124.0.x; the middle number is the major version. Release notes on cPanel's site list changes per version.