WordPress updates

Safe automatic WordPress updates for every customer site, the policy new sites get, bulk actions and the vulnerability list.

The WordPress updates screen shows every customer WordPress site on the server with its version, waiting updates, the last safe update and known security problems. You can update or check many sites at once, set their schedules, choose the policy new sites get and look after the vulnerability list. Resellers see the same screen for their own customers' sites; customers see their own (WordPress updates).

Where: Server Admin › Hosting › WordPress updates · Reseller Panel › Hosting › WordPress updates

The sites table

The table works like the customers' one, with an extra Account column. Click Look for sites to scan every account for WordPress sites now (it also happens once a day by itself). Sites that disappear are hidden; their settings and history are kept.

Bulk actions

Tick the sites (the box in the header ticks all of them).
Choose an action:

Button	What it does
Update selected	Starts a safe update of each ticked site in the background: backup first, checks after every update, automatic rollback.
Check now	Reads each site's versions, waiting updates and security problems again (at most 20 sites at a time; every site is also checked once a day).
Set schedule	Sets the same schedule on every ticked site.

Policy for new sites

New WordPress sites start with this schedule; each customer can change their own afterwards.

Field	Default
Updates	Notify only
How often	Daily
Window starts at / Window length (hours)	02:00, 4 hours (the server's time)
WordPress itself	Minor releases only
Plugins, Themes	on

Click Save. Sites found before the change keep their own schedule.

How runs are scheduled

The worker runs every 15 minutes. It starts the sites whose window has come and the runs people asked for.
One site never runs twice at once, and one account runs one site at a time.
At most 2 sites run at the same time per server (setting wp_update_parallel in /etc/hostfog/config.json).
Each site gets its own minute inside its window, so a server's sites are spread over the window.
Pre-update backups are kept in the account's ~/backups/pre-update/ for 7 days, then removed.

Note: the events wordpress.updated and wordpress.rollback are sent to your webhooks and script hooks.

Vulnerability list

The security check compares every site's WordPress, plugin and theme versions with the publisher's vulnerability list.

On a paid server, the list is fetched from the licence server once a day. Fetch now gets it at once. If it can't be reached, the screen says so and the copy kept from last time is used.
The card shows how many entries the list has and when it was last updated.
Config wp_vuln_feed: false switches the security check off.

The format of the list is described in WordPress vulnerability list.

The API

Two token API endpoints follow the same rules: GET /v1/accounts/{username}/wordpress lists an account's sites with their status, and POST /v1/accounts/{username}/wordpress/{site}/update starts a safe update (optionally of a few items). See the API reference.