WP Toolkit - Product News

[custer]

Hi everyone,

WP Toolkit v6.2 is out. Changelog:

6.2.0 (12 Apr 2023)​

• [+] Added new API methods for working with plugins and themes on an installation
• [+] (cPanel) Extended Team Manager feature support
• [+] (cPanel) Added AlmaLinux 9 support
• [+] Added help output for the updated --clear-cache CLI command
• Adjusted the logic of displaying warnings about outdated PHP versions to make sure alt-php doesn't incorrectly trigger them anymore
• (Plesk) Updated integration with Dynamic list to accommodate for corresponding changes in Plesk
• [-] WP Toolkit no longer shows Failed to find set with specified ID error when installing WordPress under certain rare circumstances. (EXTWPTOOLK-9898)
• [-] Unaccessible free trial offer is no longer displayed for Smart Updates. (EXTWPTOOLK-10312)
• [-] Once mitigated via WP Toolkit, CVE-2022-3590 vulnerability is now always properly shown as mitigated. (EXTWPTOOLK-10298)
• [-] Smart Update no longer reports certain combinations of square brackets as a false positive "broken shortcode" issue. (EXTWPTOOLK-10050)

 

[custer]

@custer

In my humble opinion, you should really consider to

1 - give a roadmap of planned future premium features that will be included in WPT Deluxe

2 - give an option for Plesk license holders and/or endusers to give the WPT Deluxe a try during a brief period of time......


I hope that you can at least share some insight into the expected roadmap of WPT Deluxe .......

Kind regards....

Hey trialotto,
1. Good point. We don't have a roadmap to share at the moment, but we should, as such transparency should help users make the decision.
2. In-product trial is definitely on the roadmap.

 

[trialotto]

@custer

I have been probably missing some of the new developments with respect to WPT, but is there any support for the wc cli (WooCommerce command line) utility that normally is supported by the wp cli (WordPress command line) utility? I could not find that in the release notes - after a very quick check.

In essence, the WPT does not update the WooCommerce database after WooCommerce updates that require WooCommerce database updates.

It would be really good if that (and other wc cli) functionality is available by default in the WPT.

Kind regards....

 

[Peter Debik]

6.2.1 (13 April 2023)​

13 April 2023

• [-] Login to WordPress from Dynamic List now properly works again. (EXTWPTOOLK-10409)

 

[custer]

@custer

I have been probably missing some of the new developments with respect to WPT, but is there any support for the wc cli (WooCommerce command line) utility that normally is supported by the wp cli (WordPress command line) utility? I could not find that in the release notes - after a very quick check.

In essence, the WPT does not update the WooCommerce database after WooCommerce updates that require WooCommerce database updates.

It would be really good if that (and other wc cli) functionality is available by default in the WPT.

Kind regards....

Hi trialotto, thanks for letting me know -- we'll look into it.

 

[custer]

Hey everyone, here's the long-awaited WP Toolkit version 6.3! Here's changelog:

6.3.0 (27 Mar 2024)​

• [+] Added integration with Wordfence vulnerability database:
  • WP Toolkit now displays combined information from Patchstack and Wordfence vulnerability databases, with links to both services
  • Some vulnerability entries might happen to be duplicates, but we're working on merging them as well
• [+] Introducing new vulnerability management UI based on WP Guardian
• [+] Added the ability to filter out vulnerabilities based on their CVSS score to reduce alert fatigue
• [+] (Plesk) Full-featured integration of WP Toolkit into Plesk Dynamic list is now available:
  • Most WP Toolkit features are now accessible directly from Dynamic list in Plesk without having to visit the separate WP Toolkit interface
  • Mass management operations are not in scope of this integration, please use the separate WP Toolkit interface for them
  • To enable this feature, add appModeFeature = on under the [ext-wp-toolkit] section of the panel.ini file
• [+] Added a link to Codeable platform for site admins:
  • Codeable provides access to WordPress experts and developers for WordPress site administrators
  • Unlike many freelancers, Codeable experts and developers will never recommend against the current host
  • To hide the link to Codeable, add codeableIntegrationFeature = off under the corresponding section of the panel.ini (Plesk) or config.ini (cPanel) file.
  • To put your company's name on the Codeable landing page, add codeableUrlCustomer = your company name under the corresponding section of the panel.ini (Plesk) or config.ini (cPanel) file.
• [+] Added API for managing WordPress backups
• [+] Added API for managing Sets
• [+] Backup file name and timestamp are now added to the corresponding meta.json file
• [+] Backup API now allows to add an arbitrary description to the corresponding meta.json file
• [+] (cPanel) WP Toolkit now works on Ubuntu 22.04
• Security improvements
• Minor assorted improvements to Maintenance Mode
• Improved WordPress installation speed on CloudLinux OS
• Reduced memory consumption when working with vulnerabilities
• (cPanel) Improved WP Toolkit performance via opcache shenanigans
• (cPanel) Improved WP Toolkit responsiveness in case of cPanel user account modifications
• [-] Fixed a bunch of PHP errors and notices appearing in server-level log files
• [-] WP Toolkit now honestly reports if a site could not be added after the scan due to improper directory ownership. (EXTWPTOOLK-9679)
• [-] Scan info message now provides info about reattaching a previously detached site. (EXTWPTOOLK-10109)
• [-] Autoupdate policies are now properly applied to plugins and themes installed via set. (EXTWPTOOLK-10699)
• [-] Mitigate action is no longer displayed for vulnerabilities that cannot be addressed by security measures. In fact, since the interface was reworked, this action does not appear at all because it was renamed to Apply security measure. (EXTWPTOOLK-11390)
• [-] Scheduled task execution no longer overlaps on servers with thousands of sites. (EXTWPTOOLK-11017)
• [-] Maintenance mode timer is now limited to a maximum of 99 days because come on, really!? (EXTWPTOOLK-11181)
• [-] (cPanel) Smart PHP Update is no longer unable to find the right PHP version on the server. (EXTWPTOOLK-10701)
• [-] (cPanel) Multiple Smart PHP Update processes can now be launched simultaneously. (EXTWPTOOLK-10958)
• [-] (cPanel) Customers can now run scan procedure without getting disappointed by the Task is not responding, error code 1 error. (EXTWPTOOLK-11184)
• [-] (cPanel) Removed banner in WHM about WP Toolkit Deluxe not being enabled in any packages. (EXTWPTOOLK-10468)

 

[lightingman2003]

Great to see the updates to the WordPress Toolkit!
Can I check one thing though, is there anymore information that can be given about the following entry:
[+] (Plesk) Full-featured integration of WP Toolkit into Plesk Dynamic list is now available

 

[burnley]

Is there any more info on how this new feature works, as I can't seem to work out where to how to apply the filter in the Toolkit or plesk notifications pages? ?

• [+] Added the ability to filter out vulnerabilities based on their CVSS score to reduce alert fatigue

 

[trialotto]

Hey everyone, here's the long-awaited WP Toolkit version 6.3! Here's changelog:

6.3.0 (27 Mar 2024)​

• [+] Added integration with Wordfence vulnerability database:
  • WP Toolkit now displays combined information from Patchstack and Wordfence vulnerability databases, with links to both services
  • Some vulnerability entries might happen to be duplicates, but we're working on merging them as well
• [+] Introducing new vulnerability management UI based on WP Guardian
• [+] Added the ability to filter out vulnerabilities based on their CVSS score to reduce alert fatigue
• [+] (Plesk) Full-featured integration of WP Toolkit into Plesk Dynamic list is now available:
  • Most WP Toolkit features are now accessible directly from Dynamic list in Plesk without having to visit the separate WP Toolkit interface
  • Mass management operations are not in scope of this integration, please use the separate WP Toolkit interface for them
  • To enable this feature, add appModeFeature = on under the [ext-wp-toolkit] section of the panel.ini file
• [+] Added a link to Codeable platform for site admins:
  • Codeable provides access to WordPress experts and developers for WordPress site administrators
  • Unlike many freelancers, Codeable experts and developers will never recommend against the current host
  • To hide the link to Codeable, add codeableIntegrationFeature = off under the corresponding section of the panel.ini (Plesk) or config.ini (cPanel) file.
  • To put your company's name on the Codeable landing page, add codeableUrlCustomer = your company name under the corresponding section of the panel.ini (Plesk) or config.ini (cPanel) file.
• [+] Added API for managing WordPress backups
• [+] Added API for managing Sets
• [+] Backup file name and timestamp are now added to the corresponding meta.json file
• [+] Backup API now allows to add an arbitrary description to the corresponding meta.json file
• [+] (cPanel) WP Toolkit now works on Ubuntu 22.04
• Security improvements
• Minor assorted improvements to Maintenance Mode
• Improved WordPress installation speed on CloudLinux OS
• Reduced memory consumption when working with vulnerabilities
• (cPanel) Improved WP Toolkit performance via opcache shenanigans
• (cPanel) Improved WP Toolkit responsiveness in case of cPanel user account modifications
• [-] Fixed a bunch of PHP errors and notices appearing in server-level log files
• [-] WP Toolkit now honestly reports if a site could not be added after the scan due to improper directory ownership. (EXTWPTOOLK-9679)
• [-] Scan info message now provides info about reattaching a previously detached site. (EXTWPTOOLK-10109)
• [-] Autoupdate policies are now properly applied to plugins and themes installed via set. (EXTWPTOOLK-10699)
• [-] Mitigate action is no longer displayed for vulnerabilities that cannot be addressed by security measures. In fact, since the interface was reworked, this action does not appear at all because it was renamed to Apply security measure. (EXTWPTOOLK-11390)
• [-] Scheduled task execution no longer overlaps on servers with thousands of sites. (EXTWPTOOLK-11017)
• [-] Maintenance mode timer is now limited to a maximum of 99 days because come on, really!? (EXTWPTOOLK-11181)
• [-] (cPanel) Smart PHP Update is no longer unable to find the right PHP version on the server. (EXTWPTOOLK-10701)
• [-] (cPanel) Multiple Smart PHP Update processes can now be launched simultaneously. (EXTWPTOOLK-10958)
• [-] (cPanel) Customers can now run scan procedure without getting disappointed by the Task is not responding, error code 1 error. (EXTWPTOOLK-11184)
• [-] (cPanel) Removed banner in WHM about WP Toolkit Deluxe not being enabled in any packages. (EXTWPTOOLK-10468)

@custer

Two questions :

1 - any update on wc cli (WooCommerce command line utility) integration?

2 - can you have a look at migration consistency?


With respect to question 2, please note that migration of a WPT managed WP instance to a target server CAN result in notifications (on the target server) of

Website "" (<full path>): Failed to reset cache for the instance #8: Error: This does not seem to be a WordPress installation.
The used path is: <path>
Pass --path=`path/to/wordpress` or run `wp core download`.

even in the case that these messages are not showing on the source server.

This is unpredicted migration behavior, very likely to be the result of how WPT manages and shows issues on both source and target server.

Moreover, it is "dangerous" behavior, since the migrated WP instance might not or often does not work as expected within WPT on the target server.

Could you be so kind as to have a look?


Kind regards.....

 

[Kaspar]

Great to see the updates to the WordPress Toolkit!
Can I check one thing though, is there anymore information that can be given about the following entry:
[+] (Plesk) Full-featured integration of WP Toolkit into Plesk Dynamic list is now available

A picture says more than a thousand words. Two screen shots for comparison.

Old WP Toolkit integration into Plesk Dynamic list


New (Full-featured integration of WP Toolkit into Plesk Dynamic list)

 

[Kaspar]

Is there any more info on how this new feature works, as I can't seem to work out where to how to apply the filter in the Toolkit or plesk notifications pages? ?

• [+] Added the ability to filter out vulnerabilities based on their CVSS score to reduce alert fatigue

Open the WP toolkit and open the Settings to adjust the CVSS score.

 

[burnley]

@Kaspar
We have set a default via settings but it doesn't appear the filter is applied. Seems to be off by default for all users? I'd assumed when set it would be applied to all, perfectly happy for them to be able to change it up / down to taste. I couldn't see a toggle to enable filtering by default.

Side note: When a filter is applied and there are no CVSS above the threshold it says 'No vulnerabilities found' this is perhaps misleading and could be improved to indicate some were filtered out as I could easily see many not being aware. Especially if they cranked it up really high.

Otherwise I really think this is a great improvement.

One last suggestion, have you considered making it possible to compare plugins and theme checksum with source similar to what you have for the WordPress core?

 

[Kaspar]

@Kaspar
We have set a default via settings but it doesn't appear the filter is applied. Seems to be off by default for all users? I'd assumed when set it would be applied to all, perfectly happy for them to be able to change it up / down to taste. I couldn't see a toggle to enable filtering by default.

I've only briefly played with the CVSS filter and hadn't noticed this yet. I also would have assumed that the filter setting would be applied to all instances.

View attachment 25862
Side note: When a filter is applied and there are no CVSS above the threshold it says 'No vulnerabilities found' this is perhaps misleading and could be improved to indicate some were filtered out as I could easily see many not being aware. Especially if they cranked it up really high.
Otherwise I really think this is a great improvement.

Hmm, yeah agreed. @custer?

One last suggestion, have you considered making it possible to compare plugins and theme checksum with source similar to what you have for the WordPress core?

No really to be honest. I am not on the Plesk team nor employed by Plesk. Good suggestion though.

 

[custer]

Hi everyone, here's the changelog for the WP Toolkit v6.4, just out:

6.4.0 (11 Jun 2024)​

• [+] Introducing Vulnerability Protection: a new security feature for WordPress websites provided as a part of WP Guardian offer. Vulnerability protection is a non-invasive, automated, lightweight way to neutralize vulnerabilities in WordPress plugins, themes, and WordPress core. Once enabled on a site, vulnerability protection neutralizes high and medium risk vulnerabilities automatically whenever they appear without any need for user engagement.
  • A WordPress plugin will be installed when protection is enabled to automatically neutralize dangerous vulnerabilities by applying special protection rules.
  • Protection rules work like a firewall, so they never touch or modify the site code.
  • Protection rules are applied and removed only for specific vulnerabilities on any given site, so they have minimal effect on site performance.
  • This feature and its corresponding upsell prompts are not visible to control panel users by default. Only the server administrator can see it.
  • You can control the access to this feature via separate limit in your Service Plans (Plesk) or Packages (cPanel).
  • Vulnerability protection is a part of the security suite provided by WP Guardian platform. It requires purchasing a separate license called either WP Guardian (Plesk addon) or WP Guardian (cPanel addon), depending on your control panel.
  • WP Guardian (Plesk addon) is an upgraded version of WP Toolkit Deluxe bundle, combining all previous Deluxe features with Vulnerability Protection (and with more features to be included in the future).
  • WP Guardian (cPanel addon) only includes Vulnerability Protection, as all other features are already available in WP Toolkit on cPanel by default.
  • The technical name of this feature is virtual patching, and it's powered by Patchstack. Protection rules (also known as virtual patches) are released for high-to-medium-risk vulnerabilities present in Patchstack vulnerability database
• [+] CVSS rating used for ranking and sorting vulnerabilities was replaced with Risk rank
  • Risk rank is an aggregate rating of vulnerability impact based on CVSS rating, EPSS rating, Patchstack Patch Priority and other factors
  • Vulnerability filtering feature was changed from specifying a CVSS score threshold to a simple knob for ignoring low-risk vulnerabilities
  • Low-risk vulnerabilities are now ignored by default on all websites after the upgrade to WP Toolkit v6.4
• [+] Added the ability to change the destination of "Hire a developer" link or hide it completely in global WP Toolkit Settings
• [+] (cPanel) Server administrators can now automatically provision WordPress and sets for user accounts
  • New autoprovisioning options were added to Packages interface as a Package Extension
  • A separate option allows admin to automatically install the latest version of WordPress when a new user account is created
  • A set of plugins & themes can also be selected for automatic installation.
  • Note: selected set will be installed every time when WordPress itself is installed.
• [+] Must-use plugins are now correctly displayed in the list of plugins with corresponding tags
• [-] WP Toolkit no longer stops working with Initial data load error: some required fields are not provided error in some rare cases. (EXTWPTOOLK-11652)
• [-] Certain WP Toolkit processes no longer hang indefinitely if they cannot be finished for some reason. (EXTWPTOOLK-10647)

 

[Hangover2]

As it was not mentioned in the changelog - if you want to disable the paid and advertised "Vulnerability Protection" feature set the following rule in your "Panel.ini Editor":

[ext-wp-toolkit]

virtualPatchesFeature = false

 

[mediengestalter]

I was told there will be an update very soon to be able to purchase vulnerability protection for single sites. Is there a estimated release date?

 

[Kaspar@Plesk]

This has already been released. You can view the details to purchase vulnerability protection for single sites in the change log.

 

[custer]

Hi everyone, changelog for WP Toolkit v6.6 update:

6.6.0 (26 Nov 2024)​

• [+] WordPress Vulnerabilities screen now has additional widgets that help site administrators focus on addressing the most important issues first. In particular, users can now see how many vulnerabilities were blocked by Vulnerability Protection feature in the past
• [+] Site card header now includes an icon that shows vulnerability protection status for easier identification and management
• [+] Vulnerability Protection feature API is now available
• [+] Additional vulnerability protection licenses were added for both cPanel (50 sites license) and Plesk (more site choices for each Plesk edition)
• [+] Vulnerability labels were improved and moved to a more visible place
• [+] Smart PHP Update API now allows to specify custom subdomain name for the website clone
• [+] Added an option to disable email notifications sent by WordPress about password changes. To disable the notifications, add sendWordPressPasswordChangedNativeEmail = false to the panel.ini or config.ini file
• Updated wp-cli to version 2.11
• Vulnerabilities in inactive themes are now properly marked as such
• Adjusted the icons and naming of WP Toolkit links
• Clarified wording in email notifications about unresponsive WordPress installations (also known as "quarantined")
• The icon of X (formerly known as Twitter) was updated in the Maintenance Mode server template
• Check WordPress integrity dialog now displays the name and the URL of the corresponding site
• Improved cloning logic to properly support Redis Object Cache plugin
• (cPanel) Certain mass actions performed by WP Toolkit no longer cause web server to restart multiple times
• [-] WordPress installations linked with non-existent main domain ID no longer prevent website screenshots being made for properly working WordPress installations. (EXTWPTOOLK-12376)
• [-] Temporary database dumps left after interrupted operations of cloning or data copying are now properly removed from existence. (EXTWPTOOLK-12360)
• [-] WP Toolkit no longer reports a false positive vulnerability in the "Master Slider" plugin. (EXTWPTOOLK-12304)
• [-] Addressed vulnerabilities are now properly grayed out and moved to the bottom of the pecking order. (EXTWPTOOLK-12297)
• [-] Search is now working again on WordPress Vulnerabilities tab. (EXTWPTOOLK-12223)
• [-] Signing in to WebPros account during the purchase of Vulnerability Protection addon for a single site no longer fails with AggregateError: Issuer.discover() failed. RequestError: Timeout awaiting 'request' for 5000ms error. (EXTWPTOOLK-12102)
• [-] Themes with numeric slugs no longer prevent WP Toolkit from opening Updates or WordPress Vulnerabilities windows. (EXTWPTOOLK-11710)
• [-] Refreshing outdated WordPress installations (we're talking version 5.4 or older here) no longer generates the Error: Could not get 'auto_update_themes' option error in the logs. (EXTWPTOOLK-11707)
• [-] Copying data from a multisite WordPress installation no longer fails with Argument #2 ($haystack) must be of type array, null given error. (EXTWPTOOLK-10814)
• [-] (cPanel) Global Settings screen now properly states that WP Toolkit configuration file is called config.ini on cPanel instead of panel.ini. (EXTWPTOOLK-12241)
• [-] (cPanel) Sets screen now refreshes automatically when a set is removed. (EXTWPTOOLK-11824)
• [-] (Plesk) Link to configuring of HTTPS redirection under Issues is now properly working again. (EXTWPTOOLK-12331)
• [-] (Plesk) Smart Update now displays correct error message if it fails due to disabled WP Toolkit cloning management permission. (EXTWPTOOLK-12210)

Please note that this release will be going through a gradual rollout procedure to make sure we can catch any breaking bugs before they do too much damage, so it might not be available on your servers immediately.

 

[custer]

Hi everyone,

WP Toolkit v6.7 is here. Changelog:

6.7.0 (18 Jun 2025)​

• [+] Servers using WP Toolkit can now be connected to wpguardian.com platform for centralized management and fleet-wide licensing for WP Guardian addon. WebPros partners also have access to fleet-wide Pay-As-You-Go licensing for WP Guardian addon
• [+] Site administrators can now run wp-cli commands directly in WP Toolkit GUI
• [+] Site backup in WP Toolkit now gives site administrators an option to delete existing website data before restoring the backup
• [+] WP Toolkit settings related to a specific site can now be backed up, restored, or cloned when these operations are performed via API
• [+] Server administrators can filter out vulnerabilities from Wordfence database for all sites on the server by adding the vulnerabilityAllowPrefix option to panel.ini (Plesk) or config.ini (cPanel) file and setting its value to CVE-PS
• [+] WP Toolkit now properly works on PHP 8.4
• [+] The following new hooks for running custom scripts were added:
  • Vulnerability check completed
  • WordPress core updated
  • Plugin updated
  • Theme updated
• [+] (cPanel) Server administrator can specify a custom directory for storing all site backups via the customBackupsDirectory option in the config.ini file (for example, customBackupsDirectory="/home/$USER$/wordpress-backups")
• [+] (cPanel) Codeable integration is being rolled out on selected cPanel servers. Server administrators will see a Feature Showcase about the integration with ability to configure or disable it right away. Integration settings can always be adjusted later via config.ini file or global WP Toolkit settings (see changelog entry for WP Toolkit 6.3.0 for more details)
• [+] (Plesk) Users can access wp-cli via chrooted shell (note: read here how to first set this up on a server)
• [+] (Plesk) CloudLinux 9 support added
• [+] (Plesk) Windows 2025 support added
• Links to PHP settings and Smart PHP Updates are now displayed in a more consistent and less confusing way
• Certain WP Toolkit dialog windows are now closing more smoothly
• (Plesk) Fixed a number of issues related to WP Toolkit work on PHP 8.x on Windows servers
• [-] Removing temporary installations created by Smart Updates & Smart PHP Updates no longer generates confusing error messages in log. (EXTWPTOOLK-12638)
• [-] Cleaned up false-positive vulnerabilities mistakenly reported by Wordfence. (EXTWPTOOLK-13006)
• [-] Incomplete backup files are properly removed if backup was not finished due to insufficient disk space. (EXTWPTOOLK-10874)
• [-] Smart PHP Update no longer fails when switching back to server-default PHP version. (EXTWPTOOLK-11737)
• [-] (cPanel) WP Toolkit now uses proper location (user home directory) for wp-cli cache when running wp-cli for site operations. (EXTWPTOOLK-11005)
• [-] (cPanel) WP Toolkit no longer leaves old & useless files behind after it’s updated on CloudLinux. (EXTWPTOOLK-12585)
• [-] (cPanel) Fixed log rotation settings for sw-engine.log. (EXTWPTOOLK-13164)

As usual, this release will be going through a gradual rollout procedure to make sure we can catch any breaking bugs before they do too much damage, so it might not be available on your servers immediately.

 

[custer]

Hi everyone, WP Toolkit v6.8 is now available. Changelog:

6.8.0 (21 Aug 2025)​

• [+] (Plesk) WP Toolkit now has its own WordPress plugin that provides access to certain WP Toolkit functionality from within WordPress admin dashboard
  • Currently site admins can access vulnerability information inside the plugin GUI. More features will be added in the next plugin updates
  • The plugin detects when plugins and themes are installed directly through WordPress, so it will apply mitigation strategies immediately, without waiting for the regular check from WP Toolkit
  • To install the plugin on all new WordPress installations automatically, add installIntegrationPluginToNewSites = true line to panel.ini (Plesk) or config.ini (cPanel) file.
    • Set this option to false if you want to disable this behavior before it becomes default in the subsequent WP Toolkit updates
    • To enable the GUI on all non-manual plugin installations, make sure to add the following lines as well:
      • integrationPluginApi = true
      • integrationPluginUiModuleEnabled = true
      • integrationPluginEventModuleEnabled = true
• [+] WP Toolkit now shows how many attempts to exploit vulnerabilities on a site were blocked by Vulnerability Protection
• [+] Grouping of controls on a site card was rearranged to make it more logical
• [+] Support for the upcoming “temporary domains” feature in cPanel was added
• [+] Support for AlmaLinux 10 OS was added
• [+] (cPanel) Added extra keywords to make finding WP Toolkit in WHM interface easier starting with cPanel v132
• Certain wording for vulnerability info and Vulnerability Protection feature was updated and made more consistent
• WP Toolkit v6.8 now requires Plesk version not older than 18.0.61
• Certain security fixes and improvements were implemented