Force software updates on WordPress Hosting?

Jean Egan

Jean Egan

New Member
First I have to say I am extremely happy with KnownHost servers and support. This has been the best hosting company I've ever had and I wish you all the best going forward. My question is on your "WordPress Hosting" but couldn't find very much information on it. (Just what I found on that linked page.)

Most of my client's sites on my VPS here at KnownHost are WordPress sites. When I created these sites I overly-optimistic that my clients would be more "hands-on" with their sites and keep them updated, but most clients are intimidated and fear "breaking" their site by upgrading. My concern is that if they're not updating their site, it's opening their site (and the whole VPS) up for security vulnerabilities.

For a bit, I tried using CPAddons to manage the installations on a couple of my own sites but I found the process much less than smooth. In fact, that cPanel extension was awful. It continually errored out for not having unnecessary files like unused default themes and plugins. As a test, I "fixed up" one of my sites to see if subsequent upgrades would be smoother - but it wasn't, so I gave up on trying that.

A colleague who offers (ugh) GoDaddy hosting said that she/they are now offering a hosting option where WP and possibly the site plugins are kept current. I was considering moving/giving some of my smaller client's sites to my colleague but thought I'd look to KnownHost first, because I'd love to keep these clients if I can find a solution here. KnownHost servers and support is much better than the servers and support I've experienced on GD and honestly, I'd rather not "inflict" that company on any of my clients.

Does KnownHost (or if not, will KH in future) offer any hosting that can effectively and automatically force regular updates of installed WordPress software? If anyone has experience with KH's WordPress hosting, I'd appreciate hearing your feedback on that product.

Thanks!
 
Hey @Jean Egan

Thanks for the inquiry and post! I'm not positive this is the answer that you're looking for, however the newer versions of WordPress should now have an options to automatically update WordPress for you. Optionally some plugins should auto-update WordPress for you as well, such as WordFence. But, I'm not quite positive on the avenue or method(s) that you'd like to take. There are other more complicated strategies that can be used, such as WP-CLI and cron jobs.

Let me know if this helps or what other questions I may specifically help with.
 
Please do not, ever, use GoDaddy WordPress hosting. You have zero control over your sites because GoDaddy sets root ownership of most files, they force you to use a custom database driver that restricts your access to the database, and they enable their own plugins to track your site usage which you cannot deactivate/remove.

I write WordPress plugins, and a phrase I dread hearing from clients is "I use GoDaddy WordPress hosting.".
 
Hi KH-DavidL - I'm aware that WordPress will auto-update within a release and definitely appreciate WordFence updating itself, but WordPress does not update between major releases and other plugins are all manual - with wonderful email notification from WordFence but still, I'd be running in circles keeping up with the updates of about 50 sites. I am not able to keep up with them and am looking for something that is more automated/scripted and don't mind paying more for that service/luxury.

Dion - thank you. I'm also not keen on GD hosting because developing a site on their servers is ridiculously delayed. (For instance: waiting 1+ minute for a page refresh after css updates, yikes!) I've "rescued" most of my clients from GD hosting and would hate to shift them back there but I don't want to sacrifice the integrity of my VPS for clients who don't care to keep their sites updated. I'm definitely looking for an alternative because I'm personally not able to keep up with everyone's site updates.

Hmm... perhaps I should take a look at a plugin that will help me auto-update all plugins and force WP to even update major releases. I wish WordFence could also auto-update other plugins, too! A quick look, I find this - though it's a bit out of date (last release 11/2013) which makes me not quite as interested in trying it, but it seems to do what I'm looking for: https://wordpress.org/plugins/automatic-updater/

Maybe there's a premium plugin that is sold (and kept current) that can help take care of this. Hmm... I have to figure something that will bring some balance and sustainability to my work. I was hoping that KnownHost's "WordPress Hosting" would be the solution. Drat!
 
Perhaps something like Softaculous is what you're after? It won't let you force plugin updates but WP itself it will update and it works pretty well.

I'm not aware of any utilities external to WP that will keep plugins up to date.
 
Thanks KH-Jonathan for quick reply and the heads-up on Softaculous. I was not familiar with it. It seems reasonably priced. So you say it works? I'm coming from a tough time with CPAddons so I'm a little nervous, but hopeful! Specifically, do you know if I install Softaculous in my cPanel if my previously installed WP sites are auto-recognized? (I'm hoping so! I can't imagine having to re-install almost 50 sites.)

~~~

I found a more current "plugin updater" plugin but it doesn't have many reviews yet: https://wordpress.org/support/view/plugin-reviews/automatic-plugin-updates

I'll may check out both those updater plugins on my personal sites to see if either work well. I really have to find something that will work and save me from running in circles.

Thanks again for your time and for the help you've offered. I really appreciate it!
 
  • Like
Reactions: VoX
Oh nice - thanks again for your recommendation, Jonathan! Thanks also for finding that info regarding "informing" it of existing installs. I looked for that information but couldn't find it.

Looks like this is a good lead - thanks for your help!
 
Not sure if this is what you are after, but I use infinitewp (http://infinitewp.com/) to keep track of all my updates across my wordpress sites. It's designed to be run as a standalone website so, set up an account on your VPS, and upload it to that. Their add-ons are expensive but their core product is free and it should provide the basic stuff you need, like a central place to update your sites (WP, Plugins and themes)from.

Just a note though that it was subject to a security breach several months back, and everyone had to update their version, rather hastily. If you run the latest version then it will be ok - just remember to treat it like any other site and keep it patched properly!
Cheers
Andrew
 
I agree with gabba
+1 for infinitewp.com
I have it set up on my VPS now.

You can manage WP updates, and plugin updates, and much more.

P.S. - IMO, I would NEVER auto update all plugins, and WP automatically.
I would always recommend:
(1) backing up the live site prior to updating plugins (or major releases of WP);
(2) cloning the site to a test environment;
(3) testing plugin and/or WP updates in test environment;
(4) after successful site testing, make changes to the live site

You can never be too careful, as plugins can conflict with each other, have a bug in a new release, or not work with a newer version of WP.

Just my 2 cents...
 
I feel your pain, Jean. Most clients don't care...plus, if they're just paying you for hosting, usually it's not worth the $$$ for the time to manage everyone's Wordpress installs for them. I've been phasing out Wordpress hosting for this very reason.

Now that I'm phasing it out I did recently find a good tool. Not that you need yet another suggestion, but I use this tool to manage plugin upgrades, etc:

https://ithemes.com/sync/

Works well for me. Also that company's "BackupBuddy" tool can come in quite handy, especially if you need to move a site to another domain or into another Wordpress install (it is SO much better than Wordpress's infamously poor import/export).
 
Thanks for the recommendation, Aurelius. I've been using WordFence to notify me or my clients when plugins need updating (and for security and page caching), but it's good to know about ithemes.com/sync if things get unmanageable. I also appreciate your recommendation that BackupBuddy can be a good tool to move a site. Thanks!
 
I wanted to belatedly thank Gabba - I've jumped onto InfiniteWP and have loved it! Much easier way to manage many WP sites. I love that I can back everything up, then update. I also love that I can log into any dashboard without having to sign in to each one. Perfect.

Thanks again!!
 
I have a VPS with several wordpress sites (all people I know, so your situation might be different)

I subscribe to WP release update emails.

I use a bash script that, when (manually) run, will automatically downloads the latest WP package, searches the drive for any WP installs, and slaps it over any it finds. I'm not sacrificing the security of my server because people are lazy so I choose to take this heavy handed approach. If their site breaks, then they either need to deal with it or get me to fix any issues that arise. With that said, it actually works quite well. And I take the time to visit each site and make sure it's not completely broken after the update. Obviously with a lot of clients, that might not be feasible. But with minor security releases, it's been pretty painless. I did do a 3.x to 4.x (if I remember right) and that causes some headaches with old plugins, but at least I know everyone is on the same version.

If anything goes completely wrong, I always have my nightly backups.
 
I use a bash script that, when (manually) run, will automatically downloads the latest WP package, searches the drive for any WP installs, and slaps it over any it finds. I'm not sacrificing the security of my server because people are lazy so I choose to take this heavy handed approach. If their site breaks, then they either need to deal with it or get me to fix any issues that arise.
Click to expand...

Quoted for posterity. Seldom am I left speechless, but this accomplished the task.
 
Yes, quote it without the context of I personally know all 5 people with WP installs, aside from my own 3 from it. Because what fun is leaving the context in if ruins your snide remark? :rolleyes:

I'll say again, my situation is very specific, so I posted it in case anyone else was in a similar situation. Obviously if you have clients you don't know exactly what they are doing on their site, you can't take my approach. I do, so I do. My approach works for my situation, works well, and is very quick in making sure my server is secure from known WP vulnerabilities.
 
Virtually all WordPress vulnerabilities have been caused by themes and plugins, not by the WordPress core. Unless you are also overwriting all installed themes and plugins, your script isn't accomplishing its intended goal.

That's why I was speechless...you chose a "nuclear" option on the wrong target.
 
Making sure all installs are up to date is hardly the "nuclear" option. And keeping the core up to date is obviously the first defense against known attacks. My script's goal is to easily deploy WP security updates to all installs on the server, which it succeeds in quite well for my situation. So we'll have to agree to disagree.
 
You must log in or register to reply here.
Top