Once WordPress is installed, WordPress Management in cPanel - WP Toolkit - is where you look after it. It lists every WordPress site on your account and lets you handle updates, plugins and themes across all of them from one screen, without logging in to each site's dashboard. This guide covers connecting existing sites, running updates safely, and using the toolkit to keep sites secure.
In cPanel, open WordPress Management - it appears both in the Domains section and in the left-hand sidebar. The three tabs are Installations, Plugins and Themes.
Connecting sites WP Toolkit does not already list
If you installed WordPress manually, by migration, or before using the toolkit, it will not appear until you attach it.
- Open WordPress Management.
- Click Scan.
- WP Toolkit searches your account for WordPress installations and adds any it finds.
Scanning is read-only - it detects and registers sites, it does not modify them. Run it after any migration onto the account.
Detach does the reverse: it removes a site from the toolkit's list while leaving the site itself completely untouched. Use it for a site you would rather manage by hand.
Running updates safely
Out-of-date plugins are the single most common cause of compromised WordPress sites, so updates are not optional. But an update is still a change to running code.
- Open WordPress Management and click Updates. You see what is available across core, plugins and themes.
- Take a backup first. A partial backup of the home directory and the database from Files → Backup takes under a minute, and it is the difference between a five-minute rollback and a bad afternoon.
- Apply the updates.
- Test the parts nobody looks at - contact forms, checkout, login, file uploads. The homepage almost always survives an update; the payment callback is what breaks.
- Check Metrics → Errors afterwards even if the site looks fine.
Automatic updates
WP Toolkit can apply updates for you. A sensible policy for most sites:
| Component | Recommendation |
|---|---|
| WordPress core, minor releases | Automatic. These are almost entirely security and bug fixes. |
| WordPress core, major releases | Manual, so you choose when to test. |
| Plugins | Automatic for everything except the two or three that are critical to revenue - keep those manual. |
| Themes | Automatic, unless the theme has been customised directly rather than through a child theme - an update overwrites those edits. |
Managing plugins and themes across sites
The Plugins and Themes tabs work across every connected installation, which is what makes the toolkit worth using when you run more than one site.
- See which plugins are installed where, and which are out of date.
- Install a plugin onto several sites at once.
- Activate, deactivate or remove across installations.
- Set update policy per item.
Use it for housekeeping as much as for installing: anything deactivated on every site is a candidate for deletion. Deactivated code is still on disk, still unpatched, and still exploitable - deactivating a plugin is not the same as removing it.
A maintenance routine that works
| How often | What to do |
|---|---|
| Weekly | Open the Updates view. Apply anything outstanding. |
| Monthly | Delete unused plugins and themes. Check Metrics → Errors. |
| Quarterly | Review admin users and remove any that should no longer exist. Clean the database. |
| Before any major change | Full backup, downloaded off the server. |
| Yearly | Move to a newer PHP version in MultiPHP Manager after testing. |
Troubleshooting
| Symptom | Cause and fix |
|---|---|
| "You don't have WordPress sites connected yet" | Nothing is attached. Click Scan to detect existing installations, or Install WordPress for a new one. |
| Scan does not find an existing site | The installation may be outside the scanned paths, or incomplete. Confirm wp-config.php and wp-includes exist in the document root. |
| Site broke immediately after an update | Restore your pre-update backup, or rename the offending plugin's folder in File Manager to disable it. Metrics → Errors names the file at fault. |
| White screen after updating | A PHP fatal error. Rename wp-content/plugins to disable everything, confirm the site returns, then re-enable one at a time. |
| Theme customisations disappeared | The theme was edited directly and an update overwrote it. Restore from backup, then move the changes into a child theme so it cannot recur. |
| Update fails part-way | Usually disk space or a memory limit. Check Statistics in cPanel, and raise memory_limit in MultiPHP INI Editor if needed. |
| WordPress asks for FTP credentials to update | File ownership is wrong, usually after a manual upload. Open a ticket with Technical Support and we will correct ownership. |
| Scheduled posts are not publishing | WordPress's built-in scheduler depends on visitor traffic. Replace it with a real cron job - see the cron jobs article. |
Frequently asked questions
Do I still need to log in to wp-admin?
For content, yes. WP Toolkit handles installation, updates, plugins and themes; writing posts and configuring the site still happens in the WordPress dashboard.
Does WP Toolkit back up my site?
Do not rely on it as your backup strategy. Use Files → Backup for partial backups you can restore yourself, keep a monthly full backup off the server, and remember the nightly server-side snapshots are there as a last resort via a support ticket.
Will removing a site from WP Toolkit delete it?
Detach will not - it only stops managing it. Remove will. Read the dialog carefully.
Can I manage several WordPress sites from one place?
Yes, that is the main benefit. Every installation on the account appears in one list, and the Plugins and Themes tabs act across all of them.
Is it safe to enable automatic updates on a live site?
For core minor releases and most plugins, yes, and it is safer than leaving a site unpatched. Keep manual control over the two or three plugins that are critical to revenue, and make sure you have backups either way.
What if a plugin has no update but is abandoned?
Replace it. A plugin that has not been updated in years will eventually break on a newer PHP version, and it will not receive security fixes in the meantime.
