Installing and updating WordPress

Everything here happens on a domain's WordPress tab. Hosting → WordPress lists every site on your domains, and clicking one opens that tab.

If the tab says the WordPress Toolkit isn't installed, or that WordPress needs a MySQL or MariaDB database, ask your host to turn them on.

Installing WordPress

1. Get the domain's certificate first (see Getting an HTTPS certificate), so the new site's address starts with https://.
2. On the WordPress tab, press Install WordPress.
3. Choose where it goes under Install on: the domain or one of its subdomains. The folder must be empty; Hostctl's placeholder page is fine.
4. Fill in Site title, Admin username and Admin email. The username can't be admin, administrator or root.
5. Press Install WordPress.

Hostctl creates the database for you and installs the latest WordPress.

The admin password appears once, under Save the admin password now. It isn't stored anywhere. Press Copy, keep it somewhere safe, then press I've saved it.

Sign in at example.com/wp-admin once the install shows as done under Activity. If you lose the password, Reset password on the site's card gives that administrator a new one, also shown once.

If you installed before the certificate, the site's address starts with http://. Change it in WordPress under Settings → General once the certificate is active.

New installs have the theme and plugin file editor in wp-admin turned off, so code can't be changed from there.

Finding a site you installed yourself

Scan for WordPress looks in the domain's folder and each subdomain's, two levels deep. Every domain is scanned again about once a day, so new sites show up by themselves.

A site whose database isn't on this server is listed, but it can't be updated from here.

Updating safely

The Updates list on a site's card shows what's available, all ticked. Untick anything you want to leave, then press Update selected (safe):

1. Hostctl saves a restore point: the site's database and the files the update can change.
2. It runs the updates.
3. It loads the home page and the sign-in page again.

If a page that loaded before now fails (a server error, a timeout, WordPress's "critical error" page, a database error or a PHP fatal error), the update is undone straight away. Activity shows Rolled back automatically, and that version is held back from automatic updates until you apply it by hand.

Nothing is updated if the restore point can't be saved, for example when the server has less than 2 GB of free disk space.

The site "looks different" after an update

When the server takes pictures of sites, it compares the home page before and after. If 30% or more of the page changed, the update is kept but flagged: "example.com looks different after…", with both pictures.

• Looks fine clears the flag.
• Roll back undoes the update (see below).

A new post on the home page can be enough to trigger it, so look at the pictures before deciding.

Rolling back an update

Every finished update, plugin or theme change with a restore point has Roll back under Activity. It asks what to put back:

• Files only, keep the current database (the default): posts, comments, orders and settings saved since then stay.
• Files and database: the database goes back to the restore point. Anything added since then is lost. Pick it only when the update changed the database in a way the older version can't use.

Restore points aren't backups. Each holds only what the change touched, never uploads or wp-config.php, and only the newest three per site are kept. The tab says when the domain's files were last in a backup.

Choosing automatic updates

Each site's Automatic updates sets what happens every night, with the same safety checks:

• WordPress core: Security and minor releases (the default), All releases, or Off.
• Plugins and Themes: off unless you tick them.
• Security fixes, even when the above are off: on by default. A plugin, theme or core version with a known vulnerability gets the update that fixes it. For core, this needs WordPress core not set to Off.

Each site's turn comes at a fixed time between 01:00 and 06:00 UTC. WordPress's own automatic updates keep running alongside.

To update many sites at once, tick them on Hosting → WordPress and press Update selected or Apply security fixes.

Signing in with one click

Log in as on a site's card opens wp-admin in a new tab, already signed in. With several administrators, pick one first. The list comes from the last scan.

Sites Hostctl didn't install show Set up one-click login first. If the site's wp-config.php sits above the WordPress folder, Hostctl can't set it up and only the plain wp-admin link is there.

Maintenance mode and other site settings

Under Site settings on a site's card:

• Maintenance mode: visitors get a "back shortly" page. Anyone signed in who can edit posts sees the site as usual, and wp-admin keeps working.
• Visible to search engines: off asks search engines not to index the site.
• Debug log: PHP errors go to wp-content/debug.log, never to visitors. View log shows the end of it.

Installing plugins and themes

Open Plugins & themes on the site's card. Choose Plugins or Themes, type a name, and press Search to look on WordPress.org. Then press Install or Install & activate.

The same list can Activate, Deactivate and Delete what's installed. Only inactive plugins and themes can be deleted. Every change except deactivating saves a restore point and checks the site first, like an update, so it can be rolled back.

For security checks and vulnerability alerts, see Keeping WordPress secure.