WP Overview, Optimization, and Security Updates

WP Overview & Inventory

WP Overview only lists WordPress sites, showing core, plugins, themes, available updates, and recent scan status. This displays the result of the most recent successful scan and does not imply that components have been automatically updated.

Core, Plugin, and Theme Updates

Updates must be previewed and confirmed by the administrator. The panel checks the environment and creates a dedicated backup before updating, and performs a health check after updating; if it fails, it attempts to restore based on the steps already completed.

Commercial plugins or themes can only be updated when the website„s own license allows WordPress to fetch the installation package. Seeing “new version available„ does not mean the panel will perform unattended automatic updates.

Image Optimization

Image optimization is located in the „Image Optimization“ tab of the companion plugin settings page and is disabled by default.

• Optimization mode: Recompress JPEG and perform lossless compression on PNG.
• WebP mode: Convert newly uploaded images to WebP and fix common mobile photo orientation issues.
• Historical library optimization: Compress existing media files in the background without changing file names or image URLs in posts.

Historical tasks display the number processed, the number automatically skipped, and cumulative space saved. Closing the browser will not interrupt the task, and you can click Stop at any time. During operation, write operations to the same site, such as updates and backup restores, will temporarily wait for each other.

WordPress Protection Items

• You can control XML-RPC, debug mode, revisions, memory limit, update checks, and background file editing.
• File locking restricts writes to plugins, themes, and core files; controlled updates temporarily handle file locks and restore them after completion.
• Password reset protection affects the WordPress password reset entry. Before enabling, confirm that there is still a usable administrator login method.

WordPress Installation Package

The Software Management settings page displays the current local WordPress installation package version. Creating sites, reinstalling, and core updates share this verified local cache, and multiple tasks requiring the same version do not download it repeatedly.

„Automatically check for new versions“ is enabled by default and checks WordPress.org for stable versions every 7 days. When a new version is found, it is downloaded and verified first, and only after success is the existing cache replaced; failure does not affect the current installation package, and you can wait for the next check or manually disable it.

Reinstall WordPress

Reinstalling recreates the website files and database, which is a clean rebuild, not a core upgrade that preserves posts and settings. For daily upgrades, use the core update feature; before reinstalling, you must separately back up data you need to keep.

Companion Plugin

The WP Panel companion plugin displays panel management status in the WordPress admin and connects features such as caching, preloading, image optimization, temporary maintenance, and exception monitoring. The plugin files are provided uniformly by the current WP Panel version and will not download installation packages from external sources on their own.

View and restore plugin status

Open „Website Management“, enter the website details, and in the „WordPress Optimization“ card you can refresh and view the companion plugin status. The action area will always be displayed and will not be hidden because other optimization switches are turned off.

• Not installed:The first installation can be performed from WP Panel; when file protection is enabled, it must be temporarily unlocked first.
• Not activated:The plugin files are still present, and you need to go to the „Plugins“ page in the WordPress admin to activate it manually.
• Activated:The plugin and panel can work together normally.
• Status unknown:The panel cannot currently confirm the real status. Please refresh and try again, and check whether the website and PHP are functioning normally.

Update companion plugin

When the plugin is lower than the version embedded in the panel, the WordPress plugin settings page will show an available update. Administrators can click „Update Now“ to install the plugin files provided with the current WP Panel version. After updating, the original activated or deactivated status will be maintained.

• File protection for AI development access, temporary maintenance, and health work will not prevent updates to an already installed companion plugin.
• The update will replace the entirewp-panel-optimizermanaged directory; directly modifying files within it may be overwritten during the next update.
• After the plugin is deleted, panel startup or update checks will not automatically reinstall it; the first installation is still completed from the panel.
• The first installation or rebuilding the plugin identity configuration still requires disabling file protection.
• If the website is suspended, being migrated, has other write tasks in progress, or if file locking fails or the status is unknown, the current status should be handled first.

The plugin settings page supports English and Simplified Chinese. „Security and Maintenance“ displays read-only information about file protection, temporary maintenance, XML-RPC, application passwords, exception monitoring, and password recovery policies managed by the panel; to modify these policies, return to WP Panel. The API Key only displays the first 8 characters for verification, and the feedback entry is located in „About and Panel Sync“.

File Protection and Temporary Maintenance

File protection is used to reduce the amount of time that WordPress core, plugin, and theme files remain writable. Daily editing of posts and pages is usually unaffected; when installing, updating, or modifying protected files, a short maintenance window can be used.

Prerequisites for enabling

• The website must be running normally, file locking must have been successfully applied, and standard or strict mode must be used.
• legacy, empty values, or invalid lock modes should first reapply standard or strict mode.
• Ifwp-config.phpcontains non-literal, duplicate, or conflictingDISALLOW_FILE_MODSdefinitions, the panel will not open the window; please have the server administrator verify first.
• WordPress multisite is not currently supported; it also cannot be enabled while conflicting tasks such as updates, migration, AI development access, or image processing are in progress.

Set and use the maintenance password

The maintenance password is configured per site and is disabled by default. The password must be at least 4 characters and at most 72 bytes; a 16-character random password can also be generated. The same password field can be used to set, modify, view, generate, and copy; saving with the field left empty retains the original password, and it cannot be modified while the window is active.

Passwords from older versions that stored only a hash must be reset before they can be viewed. If the server'smaintenance.keyis missing or corrupted, the old password copy cannot be viewed, but administrators can directly set a new password; the original passwords of other sites can still be verified, and their viewable copies can be reset per site as needed. WP Panel does not provide old password recovery or forced bulk modification.

1. Open the maintenance entry from the WordPress admin top toolbar or the companion plugin settings page.
2. Enter the maintenance password and select 3, 5, or 10 minutes; the default is 5 minutes.
3. Perform the necessary plugin, theme, or file maintenance.
4. Re-lock immediately after completion; do not wait for expiry without reason.

Extensions, repeated verification, and password freezing

The window can be extended by 1, 3, or 5 minutes, accumulating from the current expiry time. The maintenance password divides verification into 30-minute intervals based on the window start time: extensions within the current interval require no re-entry; if an extension crosses the next boundary, the panel server verifies again. Reaching the boundary exactly does not require re-verification; only exceeding it does.

Immediate re-locking never requires the maintenance password. The password field is cleared when hidden, closed, or submitted; the system does not distinguish between keyboard, paste, mobile input, or password managers, and verification boundaries are determined by the server.

• Five incorrect entries within the last 10 minutes will suspend verification for 10 minutes.
• During the freeze, even the correct password will not be verified; repeated requests will not increase the count or extend the freeze.
• Extensions already granted and immediate re-locks within the current 30-minute interval are not affected by the freeze.

Expiry and automatic re-locking

When the window expires or the WP Panel main service restarts, the site is forcibly returned to its original standard or strict locking mode. The system does not wait for native WordPress updates to finish, and an overly short window may interrupt updates; when you see the final-minute prompt, extend in time.

• Re-locking actually verifies file ownership, file and directory permissions, andDISALLOW_FILE_MODS=true。
• The page displays „Locked“ only when both permission verification and state saving succeed.
• Legacy states such as updates, migrations, or AI will not prevent secure re-locking.
• After a failure, the site freezes new write operations, retries continuously at intervals of at least 60 seconds, and raises alerts, while other sites continue running.
• The locking transition state displays „Processing“; only after confirmation of failure does it display „File lock application failed“.

Optimization settings when file protection is enabled

File protection does not broadly disable the entire plugin settings page. When „Save Settings“ or „Start Bulk Optimization“ is unavailable, the specific reason and unlock method are explained next to the button. Bulk optimization rewrites media files, so temporary unlocking may still be required.

Debug mode

After enabling debug mode, WP Panel will setWP_DEBUG=true, and write errors towp-content/debug.log. If modifyingwp-config.phpfails, the page will not show a successful save. The panel also correctly recognizesWP_DEBUG_DISPLAY=TRUEand other PHP boolean notations.

„Display errors in browser“ is an independent high-risk option, disabled by default. It may leak server paths, code, and database information, and should only be used for short-term troubleshooting and disabled immediately afterward.

Application passwords

Application passwords are used for mobile apps, automated publishing tools, and third-party REST API integrations, and are different from regular admin login passwords. The „WordPress Optimization“ section in site details provides a disable switch: new sites are disabled by default, while existing sites remain allowed after upgrade to avoid sudden interruption of existing integrations.

• After disabling, mobile apps, automated publishing, and third-party REST integrations that rely on application passwords cannot authenticate; admin editing is unaffected, and the REST API is not disabled entirely.
• Disabling does not delete existing credentials; after re-enabling, old credentials that were not revoked may become usable again.
• Before re-enabling, revoke any unrecognized or unused credentials on the WordPress user profile page.
• When the companion plugin is not installed, the panel only saves the settings intent; it takes effect only after installation. The plugin page displays status read-only and cannot be modified.

Anomaly monitoring

Anomaly monitoring is located at the bottom of „Site Details → WordPress Optimization“ and is disabled by default. It samples hourly, can also be checked immediately, and compares with the last successful result. Full functionality requires companion plugin version 1.1.18 or higher; it is recommended to update directly to the latest version provided by the panel.

• The default publishing volume threshold is more than 5 posts in the last 24 hours, i.e., alerts start from the 6th post, and can be set from 1 to 10000.
• The first successful check mainly establishes a baseline; existing application passwords and database persistent objects will additionally prompt for review.
• Collection is paused during suspension, migration, or conflicting tasks; on failure, the old baseline is retained, and empty results are not treated as a return to normal.
• After disabling, collection stops; re-enabling establishes a new starting point. The page shows the last successful result, not real-time security status.

Administrators, content, and critical settings

The panel alerts on administrator additions, deletions, privilege escalations, demotions, and changes to login names, roles, emails, display names, or WordPress master password credentials; it also monitors post and page publishing volume, deletion or unpublishing of published content, concentrated modifications within 24 hours, and changes to site address, open registration, and default role.

Newly published content is counted only toward publishing volume and is not double-counted as existing content modification. A baseline of up to 5000 published posts and pages is saved; the panel does not save content bodies, only compares stable field fingerprints. Changes that occur and are reverted between hourly samples may be missed.

How are notifications handled for consecutive edits to a static homepage?

When content changes are first detected on the same static homepage, an alert is immediately recorded and notified. As long as adjacent changes are less than 6 hours apart, subsequent edits are merged into the same continuous event: the count is accumulated and message history is retained, but no duplicate emails or Webhooks are sent. After 6 hours without changes, the next change triggers a new notification.

Switching to another homepage, or when the original homepage is deleted, trashed, or unpublished, still triggers an immediate alert and does not participate in silent merging. This alert uses the „WordPress content change“ wording.

Application password monitoring

Alerts are triggered when an administrator's existing credentials are first discovered, new credentials are added, existing credentials are used for the first time, and when the last-used IP changes. Account demotion or deletion only indicates leaving the administrator sampling scope, not that credentials have been revoked; upon re-promotion, alerts are aggregated by account for review.

The page only displays counts and sampling status, not passwords, hashes, or raw UUIDs. If all fingerprints change simultaneously, only one aggregated alert will appear: it may be a site key rotation, or it may also include credential changes, requiring manual review. Each administrator can sample up to 100 items, and each site up to 1000; exceeding the limit or format anomalies will retain the old baseline.

Database Persistent Object Monitoring

The panel checks Triggers, Events, Procedures, and Functions in the WordPress database. Legitimate plugins may create them, and malicious objects may also rewrite content from the database layer, so initial inventory, additions, or modifications are worth reviewing; deletions only retain information history.

• The page only displays counts and sampling status, not full SQL, DEFINER, or database credentials.
• Each site can sample up to 100 items; when queries fail, definitions are unreadable, limits are exceeded, or format anomalies occur, the old baseline is retained.
• Restricted database accounts sometimes silently show unauthorized objects as zero; after importing a site or manually restricting permissions, verify view permissions.
• WP Panel only alerts, it does not automatically delete; when anomalies are found, first back up the database, then have an administrator familiar with the business verify.

What does anomaly monitoring not include?

• It does not monitor plugin or theme installation, deletion, activation/deactivation, or source, nor does it determine whether they come from WordPress.org.
• It does not detect SQL injection requests, nor does it scan products, orders, or all custom post types.
• It is not real-time auditing, complete history, or independent trusted forensics, and it will not automatically delete or repair content.
• If WordPress or its companion plugins are themselves compromised, sampling results may also be untrustworthy.