Features Pricing Demo Docs Download News Changelog About Us Log in Sign up

PremiumComes with the add-on reqad-account. Installing add-ons

WordPress Toolkit

The WordPress Toolkit in the account panel finds every WordPress site of your account and lets you sign in to it, install new ones, update them safely, harden and speed them up, and make a staging copy to test changes before they go live.

Everything here works on your own files as your account, the same way you would with wp-cli over SSH. The server's admin has the same tools in the server panel (WordPress Toolkit, staging & Push to live).

Sites

WordPress sites in the folders of your domains show up here: the main site, addon domains and subdomains, and installs in a subfolder such as /blog. Each row shows the WordPress version, the updates waiting and the certificate.

Log in opens the WordPress dashboard in a new tab as the site's first administrator, without its password. Each link works once, within 2 minutes, and leaves nothing behind on the site.

Install WordPress

Choose the site, a folder (empty for the site itself, or a subfolder such as blog), the site title, the language and the first administrator: a user name (not "admin"), a password and an email address. You get:

  • the latest WordPress from wordpress.org, in the language you chose;
  • a new database and database user of its own, with a long random password in wp-config.php;
  • an https:// address. While the site has only a self-signed certificate, browsers warn: get a free one under SSL certificates.

The folder must be empty, apart from the placeholder page and other sites' folders. If anything fails on the way, everything made so far is taken back.

Updates

The Updates page lists, for every site, the WordPress, plugin and theme updates waiting. Ask wordpress.org for updates now checks again. An update runs in the background, one at a time per site, so you can leave the page; its progress and what wp-cli said stay on the page. Before it:

  • the site's database is saved to ~/wp-backups/ (the 5 newest copies of each site are kept);
  • updates that need a newer PHP or WordPress than the site has are left out, with the reason.

If a plugin breaks WordPress while it loads, the step is run again with plugins and themes switched off for wp-cli, and the update ends with a warning so you can look at the site.

Auto-updates

For each site, choose what updates by itself: WordPress (off, fixes only, which change only the last number such as 7.1.3 to 7.1.4 and are very safe, or all releases, 7.1 to 7.2 too), all plugins or the ones you pick, all themes or the ones you pick, and when: every day or one day a week, at the hour you choose (the server's time). Sites start with nothing switched on. Wait after a release installs a plugin or theme version only once it has been out for a while, so the rare broken release is usually fixed before it reaches you. Each run:

  • saves the site's database to ~/wp-backups/ first and leaves out updates the site's PHP cannot run;
  • opens the home page before and after. If it stops working, the plugins and themes just updated are put back as they were (WordPress itself is not put back);
  • shows on the Updates page, and is mailed to you if your Profile asks for Updates messages. Runs that find nothing send nothing.

WordPress's own automatic updates are switched off for what the panel updates, so the two never run at the same time.

Security

Tick the measures you want and save; Tick the recommended ones picks the safe set. They include web server rules (block xmlrpc.php, no PHP in uploads, wp-includes or caches, block wp-config.php and files that give away the version, security headers, block author scans and aggressive crawlers), WordPress settings (no file editing in the dashboard, no pingbacks...), new security keys and tighter file permissions. Two need a choice of yours:

  • Move the login page to an address of your own (4 to 40 of a-z, 0-9 and dashes). Keep it: besides Log in in the panel, it is the only way to the login page.
  • Allow login only from these addresses: one IP or range per line. Use one of the two, not both.

Unticking a measure takes it away again, except new keys and tighter permissions, which stay. Web server rules protect the whole site, so they also cover other WordPress installs in its folders.

Performance

Each switch works at once:

  • Page cache: the web server keeps finished pages and sends them without running PHP. It empties itself when content changes.
  • WordPress cron: scheduled tasks run from a real cron job every 2 minutes instead of on visitors' page loads. It shows under Cron jobs but is changed only here.
  • Search engines: ask them not to index the site, for one that is not ready.
  • Maintenance mode: visitors see a "back soon" page; you still see the site when signed in.
  • Empty the caches, when the site still shows something old: the page cache, PHP's code cache, the object cache, the caches of cache plugins (WP Rocket, LiteSpeed, W3 Total Cache and others) and Elementor's CSS.

Clone or staging

A copy of a site, made as a new site of your account with its own folder, database and certificate: a staging copy to test changes (no email, not indexed, no scheduled tasks, optionally only for your addresses) or a clone to start another site. From a staging copy, Push to live sends the code back to the live site, never its database. All of it, with what is and is not pushed: Staging & Push to live.

Need a hand? Create a free account or contact us.