If your hosting comes with cPanel, WP Toolkit may be there too. Through it you update WordPress, make backups and see whether a plugin has a known vulnerability, without logging in to the admin of each site separately.
Here you will see where it is, how to update a site by hand, how to turn on automatic updates, how to make and restore a backup and what the security check means. We will also say what is in the base edition of WP Toolkit and what depends on the host's licence, so you do not look for a button that is not there.
Where is WP Toolkit in cPanel and which edition do you have?
Open cPanel and choose WP Toolkit from the menu on the left. In the classic view the icon is also in the Domains section. If you cannot see it, search for "WP Toolkit" in the cPanel search. The host can turn the interface off, so if it is missing, ask your host's support.
WP Toolkit comes in two editions, base and Deluxe. The table follows the cPanel documentation.
| What you do | Base | Deluxe |
|---|---|---|
| See all sites in one place and log in to the admin with one click | yes | yes |
| Update the core, the plugins and the themes by hand | yes | yes |
| Set up automatic updates for a single site | yes | yes |
| Make a backup and restore it | yes | yes |
| Check the WordPress files (Integrity Check) | yes | yes |
| Change the database password | yes | yes |
| Clone a site and make a test copy (Staging and Cloning) | no | yes |
| Apply the security measures with one button (1-Click Hardening) | no | yes |
| Manage many sites at once (Mass Site Management) | no | yes |
| Test updates on a copy (Smart Updates) | no | yes |
Whether the host has Deluxe depends on the licence it has bought. So below we describe the base edition and say when something belongs to Deluxe. The button names are as in the English interface, and their placement may differ slightly between versions.
How to update a site from WP Toolkit
WP Toolkit arranges the sites as cards. A card has a screenshot of the site, a Log in button to enter the admin with one click, and Updates and Security sections with the status of the site. When there is an update, you see a message such as Install plugin updates. If you have many sites, filter them or collapse the cards.
WP Toolkit checks for updates by itself, but you can click Check for Updates whenever you want. It sees the changes you make directly in WordPress once a day, so click the sync icon if you do not want to wait.
A manual update lets you choose the moment. You can wait and see whether the new version has broken something for others, but you have to remember to do it.
- Make a backup, as described below. WordPress recommends a backup before every update.
- Click the message about updates on the card and wait for WP Toolkit to load the list.
- Choose the updates. You can take all of them at once or only some.
- When you update the core, keep the Restore Point checkbox on, if you see it.
- Click Update, then open the site and check the home page, the login and the most important pages. If you have a shop, go through an order.
If something breaks, click the icon next to Restore Point and then Continue. The site goes back to its state before the update.
If you want to update only one plugin or one theme, open the Plugins or Themes tab on the card. Next to every item with an available update it says Updates. From there you turn plugins on and off, remove them and install them.
WP Toolkit also updates paid plugins, but only if their licence is present and they update in the standard WordPress way. Updating many sites at once (Mass Site Management) is in Deluxe.
How to turn on automatic updates
WordPress updates only some things by itself. According to the documentation, existing installations receive the minor versions of the core by default, while plugins and themes update automatically only in special cases. WP Toolkit has its own settings.
Click Autoupdate settings on the card. The settings are separate for the core, the plugins and the themes. The WP Toolkit documentation recommends these:
| What | Setting | What it does |
|---|---|---|
| WordPress core | Yes, but only minor (security) updates | Updates only the minor versions with security fixes. |
| Plugins and themes | Defined individually, but security updates are autoinstalled | Each plugin and each theme has its own switch, and the security fixes are installed by themselves. |
The Forced mode updates all plugins and themes regardless of their individual switches. With Defined individually, a vulnerable plugin with automatic updates turned off stays without an update, so follow the WP Toolkit notifications. If you are afraid that a security update will break the site, turn on the checkbox Deactivate vulnerable plugins instead of updating them. Turning off automatic updates of the core (the option No) is insecure, the documentation says.
An automatic update can break the site without you noticing at once. So the documentation advises regular backups, especially when you use automatic updates. In Deluxe there are Smart Updates, which test the updates on a copy of the site and apply them only if they find no problem.
How to make a backup and restore it
Click Back Up / Restore on the site card and then Back up. When the backup is ready, it appears in the list. WordPress advises making a backup before every update and keeping both the database and the files, because both are needed for a full restore.
To restore a backup, click the icon next to it and then Restore. Restoring deletes everything changed after the date of the backup, so first save the current state if it contains new orders or comments.
WP Toolkit keeps the backups in the folder wordpress-backups, which you can open in File Manager. Download them to your computer, because WordPress advises keeping copies in different places, for example on the server and on your computer. Backups take space in the account, so delete the old ones you do not need.
A backup from WP Toolkit is a different thing from the automatic backups of the hosting. The automatic ones are made by the host, if it offers them, while the ones from WP Toolkit you make yourself, when you want, and they stay in your account. The two kinds complement each other.
What the security check shows
What exactly you see here depends on the WP Toolkit version and on the host's licence. When WP Toolkit finds a known vulnerability in the core, in a plugin or in a theme, the site gets a Security risk label with a number that rates how serious the threat is. In the lists of plugins and themes, the vulnerable ones carry the mark Vulnerable, and when you try to activate one, WP Toolkit asks for extra confirmation. The data comes from the Patchstack and Wordfence databases.
Click the label to see what the vulnerabilities are, how serious they are and what their CVE number is. Most often the fix is an update from the plugin's author. If there is none, deactivate or remove the plugin, or change the theme. The documentation advises following the WP Toolkit notifications about vulnerable plugins and themes.
Check WordPress Integrity compares the core files with the originals and, if they differ, offers Reinstall WordPress Core. The check does not cover wp-config.php and the other files with data for the installation. If it finds changed files, see what to do about a hacked site.
If your card shows a message such as Apply critical security measures, it leads to a list of security measures. According to the cPanel documentation, applying them with one button (1-Click Hardening) is in Deluxe, so whether you can do it from here depends on the host's licence.
If you do not want to follow updates yourself
Not every site needs manual work. If it is small and rarely changes, a backup before an update and automatic security updates are enough.
If the site is a shop or you simply would rather not think about updates, monthly maintenance takes over monitoring, updates, vulnerabilities and backups every month, wherever the site is hosted. Write to us through the inquiry form and we will get in touch.
Checklist
- I found WP Toolkit and I can see all my sites.
- I know which features are in my edition and which depend on the licence.
- Before every update I make a backup with Back Up / Restore.
- When I update the core, I keep the Restore Point checkbox on.
- I set Autoupdate settings for the core, the plugins and the themes.
- I downloaded the latest backup to my computer.
- I watch the Security risk and Vulnerable marks and update or remove the affected plugins.
- I delete old backups so they do not fill the account.
- I check the site after every update.
Frequently asked questions
Where is WP Toolkit in cPanel?
Open cPanel and choose WP Toolkit from the menu on the left, and in the classic view the icon is also in the Domains section. If you cannot see it, search for "WP Toolkit" in the cPanel search. The host can turn the interface off, so if it is missing, ask your host's support.
What is the difference between the base edition of WP Toolkit and Deluxe?
The base edition of WP Toolkit shows all your sites in one place, updates the core, plugins and themes, makes backups and checks the WordPress files. Cloning and test copies (Staging and Cloning), one-button security measures, managing many sites at once and Smart Updates are in Deluxe. Whether your host has Deluxe depends on the licence it has bought.
Is a Restore Point in WP Toolkit a backup?
No. Each site has only one Restore Point, the new one replaces the old one, and if you change the site after the update, restoring may become impossible. The point takes space from the account quota, so delete it once you are sure everything is fine, and make a real backup with Back Up / Restore before updating.
Which automatic updates should I turn on in WP Toolkit?
The WP Toolkit documentation recommends "Yes, but only minor (security) updates" for the WordPress core, meaning only the minor versions with security fixes. For plugins and themes it recommends "Defined individually, but security updates are autoinstalled", where each has its own switch and security fixes install themselves. The documentation calls turning off automatic core updates insecure.
Does WP Toolkit update paid plugins?
Yes, but only if their licence is present and they update in the standard WordPress way. A single plugin or theme is updated from the Plugins and Themes tabs on the site card, where every item with an available update says Updates.
Where does WP Toolkit keep backups?
In the wordpress-backups folder in your account, which you can open in File Manager. Download them to your computer as well, because WordPress advises keeping copies in different places. Backups take space in the account, so delete the old ones you do not need.
What does the Security risk label in WP Toolkit mean?
WP Toolkit has found a known vulnerability in the core, a plugin or a theme, and the number next to the label rates how serious the threat is. Vulnerable plugins and themes carry the Vulnerable mark, and the data comes from the Patchstack and Wordfence databases. Click the label to see the vulnerabilities and their CVE numbers, then update, or deactivate or remove the plugin if there is no fix.
What does Check WordPress Integrity check?
Check WordPress Integrity compares the core files with the originals and, if they differ, offers Reinstall WordPress Core. The check does not cover wp-config.php and the other files holding data for the installation. If it finds changed files, that can be a sign the site has been hacked.