WP Toolkit in cPanel: updates, security and backups for WordPress
PrintWP Toolkit lets you look after every WordPress site in your hosting account straight from cPanel, without opening each site's dashboard. From one screen you can update the core, plugins and themes, apply security settings, check that core files were not altered, clone a site for tests and make backups. WP Toolkit is part of the TopHost WordPress Hosting and Business Hosting plans; this guide walks through the tasks you will need most often.
Opening WP Toolkit
- Sign in to cPanel through the client area.
- Click WordPress Management in the left-hand menu. You can also type "WP Toolkit" in the search field at the top of cPanel.
- Each WordPress site in the account appears as a card with its address, version and status. If a site you uploaded by hand is not listed, click Scan and WP Toolkit will look for it.
Updating WordPress, plugins and themes
Outdated plugins are the most common way into a WordPress site, so check this screen regularly. The site card tells you whether everything is current or how many updates are waiting.
- Make a backup first, with Back Up / Restore on the card, or rely on the daily copy that you can restore with JetBackup 5.
- Click Updates on the card. A window lists the WordPress core, the plugins and the themes that have a newer version.
- Tick the items to update, then press Update.
- Open the site and check the home page, a few inner pages, the contact form and, for a shop, the cart.
Update a few plugins at a time rather than all at once: if something breaks, you will know which one caused it. Before a major jump, such as a new main WordPress version, a page builder or WooCommerce, clone the site and try the update on the copy. A full routine is in A safe routine for WordPress, plugin and theme updates.
Automatic updates
Under Autoupdate settings on the card you choose what WP Toolkit may update without asking: for the core, nothing, only minor and security releases, or every release; for plugins and themes, all, none or selected ones. A sensible setting for most sites is automatic minor and security releases for the core and automatic updates for small, well-maintained plugins, while large plugins are updated by hand after a backup.
Smart Update
Where the site card offers Smart Update, WP Toolkit first applies the updates to a hidden copy of the site and compares screenshots of its pages before and after. You review the comparison and choose to apply the update to the real site or to cancel it. If the option is missing on your card, use a clone for the same purpose.
Security settings
Click Security on the site card to see a list of protective measures with their state, for example blocking file editing from the WordPress dashboard, blocking access to sensitive files, disabling PHP execution in the uploads folder or changing the default database table prefix.
Tick the recommended measures and click Secure. Some measures can disturb older plugins; if a function of the site stops working right after you applied them, revert the last measure in the same window.
Checking whether core files were changed
Visitors sent to strange sites, pop-ups you did not add, unknown administrator accounts or a warning from Imunify are reasons to check the integrity of WordPress. WP Toolkit compares the checksums of your core files with the original files published on wordpress.org.
- On the site card, open Security and choose Check WordPress Integrity.
- Click Verify Checksums and wait for the result.
- If files differ from the originals, click Reinstall WordPress Core. This replaces only the core files; pages, posts, uploads, plugins, themes and
wp-config.phpstay as they are.
A clean core does not mean a clean site: malicious code often hides in plugins, themes or the uploads folder. Continue with the guide for modified core files and the steps for a site with viruses.
Other tools on the site card
- Log In opens the WordPress dashboard as administrator, without typing a password.
- Clone makes a copy of the site, for example on a subdomain, for tests. Copy Data later moves the changes you approve from one copy to the other.
- Back Up / Restore creates and restores manual copies. They are kept inside your hosting account and use its disk space, so delete the old ones. The daily TopHost backups exist independently of them.
- Password protection closes the whole site behind a login, useful while the site is still being built.
- Search engine indexing decides whether search engines may index the site. Turn it off on test copies and make sure it is on for the live site.
- Debugging shows PHP errors for a short investigation. Turn it off when you are done, because errors on screen reveal details of the site.
- Maintenance mode shows visitors a notice while you work on the site.
When something goes wrong
If an update broke the site, restore the copy made before it from Back Up / Restore, or restore the files and the database from JetBackup. If the problem continues, open a ticket with the site address and what you changed last.
