WordPress Toolkit is a single management interface that enables you to easily install, configure, and manage WordPress. It is available if the WordPress Toolkit extension is installed in Plesk.

Note: WordPress Toolkit can install, configure, and manage WordPress version 3.7 or later.

Note: The WordPress Toolkit extension is free with the Web Pro and the Web Host Plesk editions and is available for a fee for the Web Admin edition.

Installing WordPress

To install a new WordPress installation, go to WordPress and click Install.

image-installation

Here you can:

  • Install the latest version of WordPress with the default settings by clicking Install.

  • Change the default settings (including the desired WordPress version, the database name, the automatic update settings, and more) and then click Install.

    image-installation-settings

Note: To install WordPress, WordPress Toolkit retrieves data from wordpress.org. By default, if WordPress Toolkit cannot establish connection in 15 seconds, wordpress.org is considered to be unavailable. If you experience connectivity issues (for example, due to the poor quality of the Internet connection), consider increasing the timeout value. To do so, go to WordPress, click “Settings”, specify the desired value in the “HTTP timeout for retrieving data from wordpress.org (in seconds)” field, and then click OK.

A new installation appears in the list of all existing WordPress installations in WordPress.

image-installations_list

Adding Existing WordPress Installations to WordPress Toolkit

All WordPress installations added using the WordPress Toolkit or through the Applications page appear in WordPress Toolkit automatically; those installed manually need to be attached to WordPress Toolkit. If you have upgraded from an earlier version of Plesk and you used WordPress, we recommend that you attach all existing WordPress installations to WordPress Toolkit.

To attach WordPress installations to WordPress Toolkit:

  1. Go to WordPress.
  2. Click Scan.

The WordPress installation was attached and is now shown in the list of existing WordPress installations in WordPress.

Importing WordPress Installations

You can use the “Web Site Migration” feature to migrate WordPress websites owned by you but hosted elsewhere to Plesk. When you migrate a WordPress website, Plesk copies all its files and the database to your server. Once a website has been migrated, you can manage it using WordPress Toolkit.

To migrate an existing WordPress website, follow the instructions here.

Preinstalling WordPress on Customers’ Domains

Watch the video tutorial

With Plesk WordPress Toolkit, you can have WordPress preinstalled on newly created domains. You can have predefined lists of plugins and themes installed on those domains. In addition, you can give your customers the ability to enable Smart Updates.

For every hosting plan, you can choose among the following options:

  • Do not preinstall WordPress.
  • Preinstall WordPress only.
  • Preinstall WordPress with a predefined set of plugins and themes.
  • Preinstall WordPress with or without a predefined set of plugins and themes and give ability to enable Smart Updates.

If you choose any of the last three options, WordPress will be automatically installed on the first domain of every subscription based on the hosting plan (main domain).

To preinstall WordPress on newly created domains:

  1. Go to Service Plans.
  2. On the “Hosting Plans” tab, either click Add a Plan to create a new plan, or click the name of an existing plan to edit it.
  3. If you have installed the Smart Updates license, customers can also enable Smart Update. You can specify the exact number of customers’ installations that can use Smart Update. To do so, clear the “Unlimited” checkbox next to “WordPress sites with Smart Update” and specify the desired limit. Regardless of the specified number, customers cannot use Smart Update on more WordPress installations than your Smart Updates license allows.
  4. Go to the “Additional Services” tab.
  5. Choose whether to preinstall WordPress only or WordPress with a predefined set of plugins and themes:
    • To install WordPress only, select “Install WordPress” under “WordPress Toolkit”.
    • To install WordPress with a predefined set of plugins and themes, select “Install WordPress with the … set” under “WordPress Toolkit”.
  6. Click OK (or Update & Sync if editing an existing plan).

Now every time you create a new subscription based on this hosting plan, WordPress will be installed automatically on that subscription’s main domain. Existing subscriptions based on this hosting plan will not be affected.

Managing Sets

A set is a predefined list of WordPress plugins and themes. WordPress Toolkit comes with a number of preconfigured sets, and you can always create more. By default, every set you create becomes available to customers. You can use sets in the following ways:

  • You can preinstall sets on customers’ websites. To do so, configure a hosting plan to preinstall WordPress and choose to add a single set. When you do this, all plugins and themes included in the set will be installed together with WordPress.

  • You and your customers can select a set to install it together with WordPress when performing a custom installation. Customers can see which plugins and themes are included in a set.

    Note: If you do not want customers to install sets on their WordPress installations, go to WordPress, click “Settings”, and clear the “Allow customers to use sets when they install WordPress” checkbox.

  • You can install sets on already existing websites that belong to you or your customers.

To create a set:

  1. Go to WordPress, go to the “Sets” tab, and then click Create Set.
  2. Give your set a name and click Create.
  3. Click “Add Plugins”, and then click Add Plugin. Search for the desired plugin, select it from the list, and then click Add. When you have added all desired plugins, click Close.
  4. Repeat the previous step for themes.

Now you can select the set as a preinstallation option in the hosting plan or during custom installation of WordPress.

To add plugins and themes to a set:

  1. Go to WordPress, and then go to the “Sets” tab.
  2. Click “Add Plugins” for the set you want to modify, and then click Add Plugin. Search for the desired plugin, select it from the list, and then click Add. When you have added all desired plugins, click Close.
  3. Repeat the previous step for themes.

Adding plugins and themes to a set does not affect existing subscriptions to which this set has been applied.

To install a set on existing WordPress installations:

  1. Go to WordPress, go to the “Sets” tab, and then click the image-three-dots icon corresponding to the set that you want to install.
  2. Click Install Set, select websites on which you want to install the set, and then click Install.

The set will be installed on the selected WordPress installations.

To remove the selected plugins and themes from a set:

  1. Go to WordPress, and then go to the “Sets” tab.
  2. Click the number displayed under the “Plugins” or “Themes” columns (for example, 2 total) to show the list of plugins or themes currently included in the set.
  3. Click the image-79122.png icon next to the names of the plugins or themes you want to remove.

To remove all plugins and themes from a set:

  1. Go to WordPress, and then go to the “Sets” tab.
  2. Click the image-three-dots icon corresponding to the set you want to modify, click either Remove All Plugins or Remove All Themes, and then click Yes.

Removing plugins and themes from a set does not affect existing subscriptions to which this set has been applied.

To rename a set:

  1. Go to WordPress, and then go to the “Sets” tab.
  2. Click the name of the set you want to rename, type a new name, and then click the image-79125.png icon.

To remove a set:

  1. Go to WordPress, and then go to the “Sets” tab.

  2. Click the image-three-dots icon corresponding to the set you want to remove, click Remove Set, and then click Yes.

    image-79126.png

Removing a set does not affect existing subscriptions to which this set has been applied. For all hosting plans that used the removed set, WordPress preinstall settings are reset (on the “Additional Services” tab, “WordPress Toolkit” is set to “None”).

Managing WordPress Installations

Go to WordPress to see all WordPress installations hosted on the server.

WordPress Toolkit groups information about each installation in blocks we call cards.

image-card

A card shows a screenshot of your website and features a number of controls that give you easy access to frequently used tools. The screenshot changes in real time to reflect the changes you make to your website. For example, if you turn on maintenance mode or change the WordPress theme, the screenshot of the website will change immediately.

Note: Changes you make directly in WordPress are synchronized with WordPress Toolkit once every 24 hours. To sync manually, click the image-79475.png button.

When you move the mouse cursor over the screenshot of the website, the Open Website button appears. Click the button to open the website in a new browser tab.

Security

WordPress websites are frequently targeted by hackers. WordPress Toolkit analyzes how safe your installation is by checking the following security aspects and showing the result below the screenshot of the website:

image-security

If you see “warning” or “danger”, or “available” next to one of these aspects, click “View” and fix it.

General Information

In the “General Info” section, you see the WordPress website’s title and its WordPress version. Here you can:

  • Click “Change” next to the default title to give your website a custom name.
  • Click “Log in” to log in to WordPress as an administrator.
  • Click “Setup” next to “Log in” to change general WordPress settings.
  • Click the domain name to go to the domain’s screen in Websites & Domains.

Tools

In the “Tools” section, click to access the following WordPress Toolkit features:

image-tools

The controls below give you easy access to the following settings and tools:

On the remaining three tabs you can manage the installation’s plugins, themes, and change the database username and password.

Website Labels

Website labels are preconfigured identifiers that you can give to your websites (for example, “staging”, “production”, “testing”, and so on).

Depending on your project, it might be necessary to host multiple copies of a website for various purposes. Labels will help you distinguish one website from another.

By default, a website has no label. To label it, click “ADD LABEL” (on the website card next to the website name) and select the desired label. Labels are optional and you can change or remove a label at any time.

image-label

Managing Cards View

You can choose the way WordPress Toolkit shows cards. The default “Cards” view is best suited for a small number of installations. If you have a large number of installations, collapse cards image-79466.png, or switch to the “Tiles” or “List” view.

image-79467.png

You can also Filter installations to manage them easier.

Removing and Detaching Installations

You can detach WordPress installations that you do not want to see and manage in WordPress Toolkit. Detaching does not remove the installation, merely hides it from WordPress Toolkit. A detached installation will be attached to WordPress Toolkit again after you scan for WordPress installations. You can detach WordPress installations individually or multiple installations at a time.

To detach WordPress installations:

  1. Go to WordPress, choose one or more installations you want to detach, and then click the  image-79476.png button (to detach an individual installation) or click Detach (to detach multiple installations).
  2. Click Detach.

Unlike detaching, removing completely deletes a WordPress installation. You can remove any installation, no matter how it was installed: using WordPress Toolkit, through the Applications page, or manually. You can remove WordPress installations individually or multiple installations at a time.

To remove WordPress installations:

  1. Go to WordPress, choose one or more installations you want to remove, and then click the image-79477.png button (to remove an individual installation) or click Remove (to remove multiple installation).
  2. Click Remove.

Search Engine Indexing and Debugging

By default, a newly created WordPress Toolkit website is shown in search results of search engines. If your website is not yet ready for public viewing, turn off Search engine indexing.

If you are installing WordPress for testing or development, you can enable Debugging to automatically find and fix errors in the website code. To do so, click “Setup” next to “Debugging”, select the WordPress debugging tools you want to activate, and then click OK.

Managing Remote WordPress Installations

You can connect and manage individual WordPress installations or servers with multiple WordPress installations (including servers managed via WordPress Toolkit) from one server with WordPress Toolkit.

Note: Remote management is a beta feature and is available to Plesk administrators only. Should you face any bugs, missing features, and any other problems with the feature, write to beta-extensions@plesk.com.

Remote WordPress installations will be added to the list on the “Installations” tab.

A card of a connected remote installation is shown below.

image-remote-1

Remote management features are limited at the moment but you can update remote installations, secure them, install and remove their plugins and themes, turn on and off maintenance mode, and much more.

If you have the root SSH access to a server with WordPress website(s) installed, you can connect all WordPress websites at once and then manage them. If you do not have the root SSH access, you can connect each WordPress website individually.

To connect an individual WordPress website:

  1. Secure a remote WordPress website with a valid SSL/TLS certificate if it is not done yet.
  2. On the WordPress Toolkit server, go to WordPress and click Connect [Beta].
  3. Fill in the required fields and then click Connect.

The remote WordPress will be added to the list of all installations on the “Installations” tab.

To connect all WordPress websites installed on the server:

  1. On the remote server, add the WordPress Toolkit server to the Fail2ban whitelist.
  2. Make sure that the firewall rules on the remote server (in particular, SSH rate limits) do not conflict with the WordPress Toolkit remote management feature.
  3. On the WordPress Toolkit server, go to WordPress > the “Servers [Beta]” tab, and then click Add server.
  4. Fill in the required fields and click Start.

Remote WordPress website(s) will be added to the list of all installations on the “Installations” tab. To add WordPress websites that were created on the remote server after it had been connected, click “Refresh list”.

image-remote-2

Updating WordPress Installations

To keep your website secure, you need to regularly update the WordPress core, as well as any installed plugins and themes. You can do this either automatically or manually:

  • Manual updates give you control over when updates are installed. For example, you can wait and see if installing a particular update caused issues for other WordPress users. However, you need to remember to update regularly to avoid falling behind.
  • Automatic updates give you peace of mind by keeping your WordPress installation up-to-date. However, updates can sometimes break your installation, and with automatic updates, you may not learn about it right away.

For security reasons, we recommend that you configure automatic updates.

To update a WordPress installation manually:

  1. Go to WordPress. If your WordPress installation needs updating, you will see “available” next to “Updates” (below the website screenshot).

    image-79493.png

  2. Click “View” next to “Updates”, wait for WordPress Toolkit to load the list of available updates, and then select the updates you want to install.

    Note: If an update of a WordPress core is available, you will see the “Restore Point” checkbox. Keep this checkbox selected to create a restore point you can use to roll back the update if something goes wrong.

    image-79496.png

  3. Click Update.

The selected updates will be applied.

To configure automatic updates for a WordPress installation:

  1. Go to WordPress and choose the WordPress installation that you want to update automatically.
  2. Click “View” next to “Updates”, and then click “Update Settings”.
  3. Choose the desired automatic update settings. You can configure automatic updates separately for WordPress core, plugins, and themes (for example, you can choose to enable automatic updates for plugins and themes, but not for WordPress core). Follow these recommendations:
    • Selecting “No” next to “Update WordPress automatically” turns off automatic updates of WordPress core. This is insecure.
    • If your website is publicly available (production) and you are concerned that applying updates automatically may break it, select “Yes, but only minor (security) updates”.
    • If your website is a non-public (staging) version of a WordPress website, select “Yes, all (minor and major) updates”. This will keep your staging website up-to-date and ensure that, should an update break something, it happens to the staging website and not to the production one.
  4. Click OK.

If you are concerned that WordPress automatic updates may break your website, use Smart Updates. With Smart Updates, WordPress installations are always updated safely without breaking your website.

Smart Updates

Smart Updates is a premium feature available in WordPress Toolkit 3.x and later. It helps you keep your production websites up-to-date without the risk of breaking your website. Smart Updates analyses the potential consequences of installing updates and advises you whether doing so is safe.

To keep your websites secure, you need to regularly update WordPress: themes, plugins, and core. However, these updates can potentially break you websites. Manual updates require your attention and cannot guarantee that your websites will continue working.

To ensure a WordPress installation is always updated safely without breaking your website, we developed the Smart Updates feature, which does the following:

  1. Clones the installation, and then analyses the clone and takes screenshots of the website’s pages (including dynamic content and carousels).
  2. Updates the clone, analyses it again, and then takes screenshots of the website’s pages again.
  3. Detects issues (PHP issues, HTTP response code errors, changed page titles, and others): not only those the update can cause but also those that existed before the update.
  4. With manual updates, Smart Updates shows you the “before” and “after” screenshots and the forecast whether it is safe to update or not. Here you can compare the screenshots, see and download the detailed report about the found issues, and then decide whether to update the production website or not.
  5. With automatic updates, Smart Updates automatically updates the production website unless there is at least one issue caused by the update. Otherwise the update is not performed and you receive an email with the results of analysis and the “before” and “after” screenshots.

Using Smart Updates

Smart Updates is a paid feature, which you buy on a per installation basis. You can use Smart Updates with both manual and automatic updates.

To enable Smart Update:

  1. Buy Smart Updates and install the received additional license key. You enable Smart Update separately for each installation.
  2. Go to WordPress and turn on Smart Update on the installation card.

You have enabled Smart Update. Now you can use it with manual or automatic updates.

Note: Smart Update is not an alternative for backups. We recommend that you regularly backup your WordPress installations especially if you use automatic updates.

To use Smart Update manually:

  1. Make sure you have enough disk space for a full copy of the installation that you want to update.

  2. On the installation card, click “View” next to “Updates”, select updates you want to install, and then click Update.

  3. Wait while Smart Update clones and analyses your website (this may take some time depending on the size of the website). The analysis is performed in the background, so closing the window will not interrupt the update.

  4. See the “before” and “after” screenshots of the different pages of your website separately or in the Comparison mode.

    image-79421.png

  5. Select one website page at a time and see issues found for each one. You can also see issues found for the whole website and download a report about them on the “Website Summary” tab.

  6. If Smart Update did not detect any issues regarding the update and the screenshots appear to confirm it, click Apply Updates and then click OK. Smart Update will update the production installation and delete the clone.

    If you do not want to update the production installation, click Discard.

To use Smart Update automatically:

  1. Make sure you have enough disk space for a full copy of the installation that you want to update.
  2. When an update is available, Smart Update will clone the installation, update the clone and analyze the clone after update.
  3. If the update causes no issues, Smart Update automatically updates the production installation. If Smart Update detects at least one issue the update may cause, the update is not applied. In both cases, you receive the email with the link. Follow the link to open a report with the comparison of “before” and “after” screenshots of your website in a new browser window.

Managing Plugins

A WordPress plugin is a type of third-party software that adds new functionality to WordPress. With WordPress Toolkit, you can install and manage plugins on one or more WordPress installations.

Installing Plugins

In WordPress Toolkit, you can install plugins on one or more WordPress installations.

You can search for and install plugins found in the wordpress.org plugins repository. You can also upload custom plugins, which is useful if:

  • You cannot find a suitable plugin in the wordpress.org repository.

  • You need to install your own plugin.

    Note: Any plugins you upload become available for installation by customers.

To install plugins on a particular WordPress installation:

  1. Go to WordPress, go to the “Plugins” tab of an installation card, and then click Install.

    image-plugins_tab

  2. Search for plugins, and then click Install next to the plugin you want to install. Installed plugins are activated immediately.

To install plugins on multiple WordPress installations:

  1. Go to  WordPress > the “Plugins” tab, and then click  Install.

    image-plugins_tab2

  2. Search for plugins, select the plugins you want to install, and then click Select websites.

    Note: Selecting one or more plugins and then performing a new search without installing the selected plugins resets the selection.

    image-79233.png

  3. By default, newly installed plugins are activated immediately. You can prevent this by clearing the “Activate after installation” checkbox.

  4. Select websites on which you want to install plugins and then click Install.

To upload a plugin:

  1. Go to  WordPress > the “Plugins” tab, and then click Upload plugin.

  2. Click Browse… and browse to the location of the ZIP file containing the plugin you want to upload.

    image-79247.png

  3. You can add the uploaded plugin to a set. To do so, select the set from the drop-down list. If you do not want to add the uploaded plugin to a set, keep the “None” option. You can read more about sets in Managing Sets.

  4. Click OK.

At this point, the uploaded plugin has become available for installation by customers. You can also install the uploaded plugin on your own WordPress installations.

To install an uploaded plugin:

  1. Go to  WordPress > the “Plugins” tab.

  2. Click Install next to a plugin you have uploaded.

    image-install_uploaded_plugin1

  3. Select the WordPress installations on which you want to install the uploaded plugin.

  4. By default, a newly uploaded plugin is not activated. You can activate it by selecting the “Activate after installation” checkbox.

  5. Click Install.

Removing Plugins

You can remove plugins from a particular installation or from all installations hosted on the server.

To remove plugins from a particular installation:

  1. Go to WordPress, and then go to the “Plugins” tab of an installation card.
  2. To remove one plugin, click the image-trashcan_icon icon on the plugin’s corresponding line. To remove several plugins, select them and click Remove.
  3. Click Yes.

To remove plugins from all installations hosted on the server:

  1. Go to WordPress > the “Plugins” tab.
  2. Select the plugins you want to remove, click Uninstall, and then click Yes.

Activating and Deactivating Plugins

You can activate or deactivate plugins installed on a particular installation or on all installation hosted on the server.

To activate or deactivate plugins for a particular installation:

  1. Go to WordPress, and then go to the “Plugins” tab of an installation card.
  2. Turn on or turn off a plugin to activate or deactivate it, respectively.

To activate or deactivate plugins for all installations hosted on the server:

  1. Go to  WordPress > the “Plugins” tab.
  2. Select the plugin you want to activate or deactivate.
  3. Click Activate or Deactivate.

Updating Plugins

If a plugin needs updating, you will see “Updates” next to the plugin on the “Plugins” tab of an installation card.

image-plugin_updates

You can do the following:

To update plugins on multiple installations:

  1. Go to WordPress > the “Plugins” tab.

  2. Click Update to version … next to the plugin you want to update. To learn more about the update, click “View Details”. This will take you to the plugin’s page on wordpress.org.

    image-update_plugins_multiple

    Note: Before updating the plugin, WordPress Toolkit prompts you to back up your subscription. If you are concerned that the update may break your website, create a backup or use Smart Updates.

  3. Click Yes.

Managing Themes

A WordPress theme determines the overall design of your website including colors, fonts, and layout. By selecting a different theme, you change the look and feel of your website without changing the content. With WordPress Toolkit, you can install and manage themes.

Installing Themes

In WordPress Toolkit, you can install themes on one or more WordPress installations.

You can search for and install themes found in the wordpress.org themes repository. You can also upload custom themes, which is useful if:

  • You cannot find a suitable theme in the wordpress.org repository.

  • You need to install your own theme.

    Note: Any themes you upload become available for installation by customers.

To install themes on a particular WordPress installation:

  1. Go to WordPress, go to the “Themes” tab of an installation card, and then click Install.

    image-79526.png

  2. Search for themes, and then click Install next to the theme you want to install. By default, a newly installed theme is not activated.

To install themes on multiple WordPress installations:

  1. Go to WordPress > the “Themes” tab, and then click Install.

    image-themes_multiple

  2. Search for themes, select the themes you want to install, and then click Select websites.

    Note: Selecting one or more themes and then performing a new search without installing the selected themes resets the selection.

    image-install-themes

  3. Select websites on which you want to install themes and then click Install.

To upload a theme:

  1. Go to WordPress > the “Themes” tab, and then click Upload theme.
  2. Click Browse… and browse to the location of the ZIP file containing the theme you want to upload.
  3. You can add the uploaded theme to a set. To do so, select the set from the drop-down list. If you do not want to add the uploaded theme to a set, keep the “None” option. You can read more about sets in Managing Sets.
  4. Click OK.

At this point, the uploaded theme has become available for installation by customers. You can also install the uploaded theme on your own WordPress installations.

To install an uploaded theme:

  1. Go to WordPress > the “Themes” tab.

  2. Click Install next to a theme you have uploaded.

    image-colormag

  3. Select the WordPress installations on which you want to install the uploaded theme.

    image-colormag_install

  4. By default, a newly uploaded theme is not activated. You can activate it by selecting the “Activate after installation” checkbox.

  5. Click Install.

Activating a Theme

You can activate a theme installed on a particular installation or on all installations hosted on the server. A WordPress installation can have only one active theme at a time.

To activate a theme for a particular installation:

  1. Go to WordPress, and then go to the “Themes” tab of an installation card.
  2. Switch on a theme to activate it. The theme that was previously active will be automatically deactivated.

To activate a theme for all installations hosted on the server:

  1. Go to  WordPress > the “Themes” tab.

  2. Click Activate next to a theme you want to activate.

    image-activate_theme

Removing Themes

You can remove themes from a particular installation or from all installations hosted on the server.

Note: You cannot remove an active theme. Before removing a currently active theme, activate another theme first.

To remove themes from a particular installation:

  1. Go to WordPress, and then go to the “Themes” tab of an installation card.
  2. Click the image-trashcan_icon icon next to theme you want to remove. To remove several themes, select them and click Remove.
  3. Click Yes.

To remove themes from all installations hosted on the server:

  1. Go to WordPress > the “Themes” tab.
  2. Select the themes you want to remove, click Uninstall, and then click Yes.

Updating Themes

If a theme needs updating, you will see “Updates” next to the theme on the “Themes” tab of an installation card. You can do the following:

  • Update themes for one particular installation. Read how to do so in the “To update a WordPress installation manually” procedure.
  • Update themes installed on multiple installations.
  • Configure automatic updates for themes. Read how to do so in the “To configure automatic updates for a WordPress installation” procedure.

To update themes on multiple installations:

  1. Go to WordPress > the “Themes” tab.

  2. Click Update to version … next to the theme you want to update. To learn more about the update, click View Details. This will take you to the theme’s page on wordpress.org.

    Note: Before updating the theme, WordPress Toolkit will prompt you to back up your subscription. If you are concerned that the update may break your website, create a backup or use Smart Updates.

  3. Click Yes.

Securing WordPress

WordPress Toolkit can enhance the security of WordPress installations (for example, by turning off XML-RPC pingbacks, checking the security of the  wp-content folder, and so on). You can see an installation’s security status on its card, below the screenshot of the website. If you see “warning” or “danger” next to “Security status”, we recommend that you secure your installation.

image-79492.png

We call individual improvements you can make to an installation’s security “measures”. We consider certain measures to be critical. For that reason, WordPress Toolkit applies them automatically to all newly created installations.

Note: Some security measures, once applied, can be rolled back. Some cannot. We recommend that you back up the corresponding subscription before securing a WordPress installation.

You can secure WordPress installations individually or multiple installations at a time.

To secure an individual WordPress installation:

  1. Go to WordPress, choose the installation you want to secure, and then click “View” next to “Security status” on the installation card.
  2. Wait for WordPress Toolkit to display the security measures you can apply.
  3. Select the security measures you want to apply, and then click Secure.

All selected measures will be applied.

To secure multiple WordPress installations:

  1. Go to WordPress and then click Security.
  2. You will see the list of your WordPress installations. For every installation, you can see how many critical (indicated by the image-79670.png icon) and recommended (the image-79671.png icon) security measures can be applied to it. To see the list of measures that can be applied, click the corresponding icon. If all security measures are applied, you will see the image-79672.png icon instead.
  3. (Optional) To see more information about all security measures and to manage them for an individual WordPress installation, click image-white-arrow-right next to the desired installation. To return to managing security of multiple installations, click image-blue-arrow next to “Security Status Of Selected Websites”.
  4. Select installations to which you want to apply security measures and then click Secure.
  5. By default, only critical security measures are selected to be applied. You can also select:
    • Security measures of your choice.
    • The “All (critical and recommended)” radio button to select all security measures at once.
  6. Click Secure.

The selected measures will be applied.

Rolling Back Security Measures

In rare cases, applying security measures can break your website. In this case, you can roll back security measures you have applied. Not all security measures can be rolled back. Those that can be are marked as “(can be reverted)”. You can roll back security measures for an individual WordPress installation or for multiple WordPress installations at a time.

To roll back applied security measures for an individual installation:

  1. Go to WordPress, choose the installation for which you want to revert an applied measure, and then click “View” next to “Security status” on the installation card.
  2. Wait for WordPress Toolkit to display the list of security measures.
  3. Select the security measures you want to revert and then click Revert.

The applied security measures will be rolled back.

To roll back applied security measures for multiple installations:

  1. Go to WordPress and then click Security.
  2. You will see the list of WordPress installations hosted on the server and whether critical and recommended security measures were applied to them or not.
  3. (Optional) To see more information about all security measures and to manage them for an individual WordPress installation, click image-white-arrow-right next to the desired installation. To return to managing security of multiple installations, click image-blue-arrow next to “Security Status Of Selected Instances”.
  4. Select installations for which you want to roll back security measures and then click Revert.
  5. Select security measures you want to roll back and then click Revert.

The applied security measures will be rolled back.

Cloning a WordPress Website

Cloning a WordPress website involves creation of a full website copy with all website files, the database, and settings.

You may want to clone your WordPress website in one of the following situations:

  • You maintain a non-public (staging) version of a WordPress website on a separate domain or subdomain, and you want to publish it to a production domain to make it publicly available.
  • You have a publicly available (production) WordPress website and you want to create a non-public (staging) copy of it, to which you can make changes without affecting the production website.
  • You want to create a “master” copy of a WordPress website with preconfigured settings, plugins, and theme, and then clone it to start a new development project for a client.
  • You want to create multiple copies of a WordPress website and make different changes to each one (for example, to show them to a client so that he or she can choose the one he or she likes best).

Note: By default, on cloned WordPress installations, the “Search engine indexing” option is turned off. To turn this option on for cloned WordPress installations, go to WordPress, click “Settings”, and then clear the “Turn off Search Engine Indexing for cloned websites” checkbox.

Clone a WordPress website:

  1. Go to WordPress and then click “Clone” on the card of the WordPress installation you want to clone.

    image-clone1

  2. Select the target where to clone the website:

    • Keep “Create subdomain” to have WordPress Toolkit create a new subdomain with the default “staging” prefix. You can use it or type in a desired subdomain prefix.

    Note: You can change the default subdomain prefix. To do so, go to WordPress, click “Settings”, specify the desired prefix in the “Default subdomain prefix for cloning” text field, and then click OK.

    • Select “Use existing domain or subdomain” and then select the desired domain or subdomain from the list.

    image-clone2

    Caution: Make sure that the domain or subdomain selected as the target is not being used by an existing website. During cloning, website data existing on the target may be overwritten and irrevocably lost.

  3. (Optional) Change the name of the database automatically created during cloning.

  4. When you are satisfied with the selected target and the database name, click Start.

    image-clone3

When the cloning is finished, the new clone will be displayed in the list of WordPress installations.

Copying Data from One WordPress Website to Another

You can copy the content of your WordPress website including files and database to another WordPress website.

Let us say you maintain a non-public (staging) version of a WordPress website on a separate domain or subdomain and a publicly available (production) version of this website on a production domain. You may want to copy data from one website to another in the following situations:

  • You want to copy the changes you have made to the staging version to the production version.
  • You want to copy the data from the production website to the staging website to see how the changes (for example, a new plugin) work with the production data. After checking that everything works fine, you may copy your changes to your production website.
  • You have made some changes (for example, installed a new plugin) to the staging website, and these changes resulted in new tables being added to the database. You want to copy only these tables to the production website without affecting other data.
  • You have upgraded the staging website to a newly released version of WordPress and fixed the post-upgrade issues (if any). You now want to push these changes to the production website.
  • You can choose to copy the WordPress files, the WordPress database, or both the files and the database. When copying the database, you can choose to copy all tables, or tables that are present on the source but absent from the target, or you can specify individual database tables to be copied.

When performing the copying, keep in mind the following:

  • The selected data are copied from the source website to the target website. Any files and/or database tables present both on the source and the target that are not identical are copied from the source to the target. Files and database tables present only on the target are not affected unless you select the “Remove missing files” option during copying.
  • During copying, the target website enters maintenance mode and becomes temporarily unavailable.
  • If the WordPress version on the target website is earlier than on the source website, WordPress Toolkit first upgrades WordPress on the target website to match the version installed on the source website, and then runs copying.
  • If the WordPress version on the source website is earlier than on the target website, copying is aborted. To copy data, you need to upgrade WordPress on the source to the version installed on the target or a later version.
  • If the database prefix on the source and the target differs, WordPress Toolkit will change the database prefix on the target website to match that on the source during copying.
  • Copying of data between a regular WordPress installation and a multisite one is not supported. We recommend that you use cloning instead.

Note: During copying, files and database tables copied from the source overwrite those present on the target. Any changes made to the files and database tables on the target prior to copying will be discarded and lost without warning.

Note: If you have caching plugins installed on a WordPress website you want to copy from, clear the cache on the source website before copying. Otherwise, the target website might work incorrectly.

To copy data of one WordPress website to another:

  1. Go to WordPress and then click “Copy Data” on the card of the WordPress installation which data you want to copy.

    image-sync1

  2. Next to “Target”, select the target WordPress installation (under the same or another subscription) you want to copy the data to.

    image-sync2

  3. Under “Data to Copy”, select which data you want to copy to the target WordPress website:

    • “Files Only” - copies only the website files, including the WordPress core files and the files related to themes and plugins.

      Note: By default, the htaccess, web.config, and wp-config.php files are not copied because modifying these files may disrupt the operation of WordPress. You can have WordPress Toolkit copy the wp-config.php file by selecting the “Copy wp-config.php” checkbox. To make the checkbox visible, go to WordPress, click “Settings”, select the “Allow to copy wp-config.php when using Copy Data feature” checkbox, and then click OK.

      Note: Even if you choose to copy the wp-config.php file, the information related to the database will not be copied. This prevents the target WordPress installation from corruption. Custom settings specified in the wp-config.php file on the target will be overwritten with those from the source.

    • “Database Only” - copies only the database. You can select to import all, new, or selected database tables (for details, see step 5 below).

    • “Files and Database” - copies both the website files and the database. You can choose to import all, new, or selected database tables (for details, see step 5 below).

  4. If you selected “Files Only” or “Files and Database” during step 3, two more options become available:

    • “Replace files modified on target” - by default, if a file with the same name exists both on the source and the target, the file from the source will be copied and will replace the file on the target even if the source file is older. To prohibit overwriting files on the target with the files from the source that are older clear the checkbox.

    • “Remove missing files” - by default, if a file exists on the target but is missing from the source, the file is untouched. Select this checkbox to remove files on the target that are missing from the source.

      Note: You can hide these options, making them unavailable to yourself and your customers. To do so, go to WordPress, click “Settings”, clear the “Use rsync for file copy operations” checkbox, and then click OK.

  5. If you selected “Database only” or “Files and Database” during step 3, select which database tables you want to copy:

    • “All Tables” (the default option). If you want to copy all changes except for pages, posts, and users, keep the “Except: _postmeta, _posts, _usermeta, _users” checkbox selected.
    • New tables only
    • Selected tables. Click “Select tables to copy”, select those tables you want to copy, and then click Select.
  6. Before copying data, WordPress Toolkit suggests creating a restore point. You can use it to roll back the changes made during copying. If you do not want to create a restore point, clear the “Create a restore point” checkbox. Learn how you can recover your WordPress installation using the restore point in “Restoring a WordPress Installation” section below.

    Note: Every WordPress installation can only have a single restore point. Creating a restore point overwrites the existing restore point, if any.

  7. When you are satisfied with the selected options, click Start to start copying data.

image-sync3

Restoring a WordPress Installation

When you update a WordPress installation or copy its data, WordPress Toolkit suggests creating a restore point before beginning the operation. If you are not happy with the results, you can use the restore point to roll back the changes and restore your installation to the state it was in before the operation.

Making Full Restore Points

By default, a restore point contains only the data that will be affected when copying data or updating. You can have WordPress include all the target installation data, both files and the database, in the restore point. To do so, go to WordPress, click “Settings”, select the “Always make full website snapshots” checkbox, and then click OK. Full restore points provide the maximum chances of successful recovery, but take longer to create and take up more disk space than regular restore points.

To restore a WordPress installation from a restore point:

  1. Go to WordPress and find the card of an installation you want to restore.

  2. Click “Restore” next to “Restore Point” and then click Continue.

    image-restore

The restoration will begin. Your installation will be restored to the state it was in before the operation.

The restore point takes up disk space which is included in your allowed disk space quota. After you have restored your WordPress installation, or once you have determined that all is good and there is no need to restore, you can delete the restore point.

To delete a restore point:

  1. Go to WordPress and find the restore point you want to remove.
  2. Click “Delete” next to “Restore Point, and then click Remove.

Note: Every WordPress installation can only have a single restore point. Creating a restore point overwrites the existing restore point, if any.

It is important to note that a restore point is not the same as a backup. Making any changes to the target installation after you copy data or update it may make restoring from the restore point impossible. If you are copying data or updating a live production WordPress installation, consider backing up your subscription beforehand in addition to creating a restore point.

Note: WordPress Toolkit suggests creating a restore point only when you update a single WordPress installation.

Protecting a Website with a Password

You can set a password to protect access to your WordPress website. Anyone visiting a password-protected website must enter the valid username and password to view the website content.

image-78646.png

Password protection is useful in the following cases:

  • The website is under development and you do not want anyone else to see it.
  • You want to show a demo version of the website only to certain visitors.

To protect a WordPress website with a password:

  1. Go to WordPress, choose the installation you want to protect with a password, and then turn on “Password protection”.
  2. Create or generate a password. If desired, you can also change the username (the installation’s administrator username is used by default).
  3. Click Protect.

To disable “Password protection”, turn it off.

Maintenance Mode

When a WordPress website enters maintenance mode, the website’s content is hidden from visitors without being changed or otherwise affected. Visitors accessing your website when it is in maintenance mode see a maintenance screen webpage instead of the website content.

image-79478.png

Turning on the maintenance mode

Your WordPress website enters maintenance mode automatically when you are:

  • Upgrading your WordPress installation.
  • Copying data from one WordPress installation to another.

If you are making changes to your website and want to temporarily hide it from visitors, you can manually put it into maintenance mode.

To put a WordPress website into maintenance mode:

  1. Go to WordPress and choose the WordPress installation you want to put into maintenance mode.
  2. Turn on “Maintenance mode” on the installation card.

To take your website out of maintenance mode, turn off “Maintenance mode”.

Customizing the maintenance page

With WordPress Toolkit, you can change certain attributes of the maintenance page to make it more informative. For example you can:

  • Change the text displayed on the maintenance page.
  • Add a countdown timer.
  • Provide or remove links to social network pages.

To customize the maintenance page:

  1. Go to WordPress, choose the WordPress installation whose maintenance page you want to customize, and then click “Setup” next to “Maintenance mode” on the installation card.

  2. In the “Screen Text” section, you can change the text displayed. Use HTML tags to format the text’s appearance.

  3. In the “Timer” section, you can set up and turn on the countdown timer, which will be displayed on the maintenance page.

    Note: The timer is only meant to inform visitors about the estimated duration of the remaining downtime. Your website is not taken out of maintenance when the countdown is finished; you must do that manually.

  4. In the “Social Network Links” section, provide or remove links to social network pages (Facebook, Twitter, and Instagram).

  5. (Optional) To see how the configured maintenance page looks, click Preview.

  6. When you are satisfied with the changes made to the maintenance page, click OK.

If you have coding skills, you can customize the maintenance page beyond the options described above. You can do this for a particular WordPress website or for all WordPress websites hosted on the server.

To customize the maintenance page for a particular website:

  1. Go to WordPress, choose the WordPress installation whose maintenance page you want to customize, and then click “Setup” next to “Maintenance mode” on the installation card.
  2. Click Customize and edit the maintenance page template in Code Editor.
  3. Click OK.

To customize the maintenance page for all WordPress websites hosted on the server:

  1. Edit the server-wide maintenance page template:
    • (Plesk for Linux) /usr/local/psa/var/modules/wp-toolkit/maintenance/template.phtml
    • (Plesk for Windows) %plesk_dir%\var\modules\wp-toolkit\maintenance\template.phtml
  2. When you put a WordPress website in maintenance mode for the first time, the customized maintenance page template is applied automatically.

The customized server-wide maintenance page template is applied only to WordPress websites that had never been put in maintenance mode before. To apply it to a WordPress website that had already been put in maintenance mode, do the following:

  1. Go to WordPress and choose the WordPress installation to which you want to apply the customized server-wide maintenance page template.
  2. Click “Setup” next to “Maintenance mode” on the installation card and then click Restore Default.

This replaces the website-specific maintenance page with a copy of the server-wide template.

Restoring the default maintenance page

If necessary, you can restore the default maintenance page. You do it differently depending on whether you have customized the server-wide template or not.

To restore the default maintenance page if the server-wide template has not been changed:

  1. Go to WordPress and choose the WordPress installation whose maintenance page you want to reset to default.
  2. Click “Setup” next to “Maintenance mode” on the installation card and then click Restore Default.

To restore the default maintenance page if the server-wide template has been changed:

  1. Revert the changes made to the server-wide maintenance page template by replacing the file:

    • (Plesk for Linux)
      /usr/local/psa/admin/plib/modules/wp-toolkit/resources/maintenance/template.phtml
    • (Plesk for Windows)
      %plesk_dir%\admin\plib\modules\wp-toolkit\resources\maintenance\template.phtml

    with the following file:

    • (Plesk for Linux)
      usr/local/psa/var/modules/wp-toolkit/maintenance/template.phtml
    • (Plesk for Windows)
      %plesk_dir%\var\modules\wp-toolkit\maintenance\template.phtml
  2. When you put a WordPress website in maintenance mode for the first time, the default maintenance page template is applied automatically.

The default server-wide maintenance page template is applied only to WordPress websites that had never been put in maintenance mode before. To apply it to a WordPress website that had already been put in maintenance mode, do the following:

  1. Go to WordPress and choose the WordPress installation whose maintenance page you want to reset to default.
  2. Click “Setup” next to “Maintenance mode” on the installation card and then click Restore Default.

This replaces the website-specific maintenance page with a copy of the default server-wide template.

Access WP-CLI

WP-CLI is the official WordPress command-line interface for managing WordPress websites. More information can be found here .

You can access WP-CLI directly from the Plesk command-line interface using the wp-toolkit utility with no need to install WP-CLI on the server.

Read more about the wp-toolkit utility.

To call a WP-CLI command via the Plesk command-line interface:

Connect to your Plesk server via SSH (on Linux) or via RDP (on Windows) and, in the command line, run the command:

plesk ext wp-toolkit --wp-cli -instance-id [ID] [command] [options]

where:

  • [ID] is the ID of the WordPress installation in Plesk. To learn the ID, go to WordPress and click the name of the WordPress installation. The ID will be displayed at the end of the URL in the browser. For example, if the URL ends with /id/2, then the ID=2.
  • [command] is a WP-CLI command prefixed by -- (for example, -- core).
  • [options] is the list of the WP-CLI command’s options.

The full list of WP-CLI commands and their options can be found here .

Examples:

To get the main WordPress information (a blog name, a website URL, a version, an update version, plugins, and themes):

plesk ext wp-toolkit --wp-cli -instance-id 4 -- core info

To get help for the core command:

plesk ext wp-toolkit --wp-cli -instance-id 4 -- help core

To install and activate the latest version of the bbPress plugin from wordpress.org:

plesk ext wp-toolkit --wp-cli -instance-id 4 -- plugin install bbpress --activate

Note: To make the changes performed by running a WP-CLI command visible in the Plesk user interface, go to WordPress, click the name of the WordPress installation, and then click Refresh.