In reply to Knut Sparhell.

running with auto update on is actually less secure than off.

Bad security issues in core are rare, but when you have the auto update on to get them automatically, it means that every plugin can override core files, and there is huge number of security issues with plugin.

When you do not let the server overwrite core file, the worst that can happen is that you will be defaced, but if overwrite is possible, your whole server might be owned and by the time you will discover it you will probably not have a "clean" backup (or more likely, you will not know which backup you can trust).