Changelog

The application is updated for everyone at once, so what matters is the day a change reached you. Each entry names the part of the product it is in.

14-10-2026

• Security – websites: A package from another workspace can no longer be chosen when a website is created or saved
• Fixed – backups: The next backup moment shown for a website is the one that will actually be attempted
• Added – worker plugin: A workspace can choose how the plugin is named and styled on its websites and whether it appears in the plugin list
• Fixed – branding: Browser tabs and saved shortcuts now use WP Octo's own icon

13-10-2026

• Added – provisioning: Billing systems can create and manage clients and websites, suspend or end service, change packages and provide sign-in links
• Added – partners: Partners can manage customer workspaces and review their monthly website usage
• Improved – suspended websites: End customers are shown who to contact while their website is suspended
• Improved – navigation: Administrative pages are grouped by task, with a searchable menu and a central settings page

12-10-2026

• Security – clients: A client's contacts follow the rights to view and edit clients, and a contact belonging to another workspace is refused
• Security – members: Every action on an invitation takes the right to invite members
• Added – workspace: A workspace's own colour can be set for light mode and for dark mode
• Added – search: The search field offers what was searched and opened lately while it is empty
• Improved – website pages: Each page has its own title and one clear primary action
• Improved – navigation: Website pages no longer show breadcrumbs
• Improved – forms: A save bar appears as soon as something changes and offers to save or cancel those changes
• Added – notes: A note can be pinned across every page of its website until a chosen date
• Fixed – website pages: Deleting a note, backup or sitemap entry keeps the current website page open
• Added – update rounds: An update round can be started by hand with a choice of what it updates
• Fixed – updates: The action to update WordPress core now starts a round for WordPress core alone
• Added – integrations: A website has its own Integrations page, with each integration's details and actions in a drawer
• Added – sitemap: A website's sitemap can be synchronised from its Sitemap page
• Improved – connection: Every page of an unreachable website shows its connection problem
• Improved – sync: A website's data badge shows when each kind of information was last received
• Added – connection: A switched-off worker can be reactivated from the connection message after the site owner agrees
• Improved – setup: A website that never had the worker opens its setup instead of an error
• Improved – setup: The setup explains whether a worker is unpaired or the website belongs to another workspace
• Added – connection: An unpaired worker can be connected from the setup
• Added – setup: The current stable worker can be downloaded when a website needs it
• Added – websites: A website can be handed to another workspace with a short code
• Added – WordPress users: A website's administrator address can be viewed and changed
• Added – WordPress users: A person can sign in to WordPress as a chosen user
• Added – WordPress users: A user can be created with a chosen role and a strong password
• Improved – WordPress users: Deleting a user asks who should receive their content
• Improved – WordPress login: The action stays visible where it cannot work and explains why it is unavailable
• Fixed – members: Removing someone from a workspace removes only their membership and keeps their account
• Improved – website pages: An empty status area no longer leaves extra space below the page title
• Fixed – update rounds: A round's visual review stays available when its screenshots cannot be loaded and shows them once they return
• Added – backups: Backups and restores now share one place with separate tabs, a summary of what is available and a live panel for work in progress
• Added – backups: Add a note to a full or database-only backup and set the site's backup policy from the Backups page; once a site is on WP Octo plugin 2.7.0 or later, selected folders, files and tables can be backed up as well
• Added – restores: Once a site is on WP Octo plugin 2.7.0 or later, browse and search a backup, restore the whole site or chosen folders and files, and decide per folder whether files found only on the site are kept or removed
• Added – restores: Once a site is on WP Octo plugin 2.7.0 or later, WP Octo makes a safety backup before a restore changes the site, checks the site afterwards, keeps the safety copy for a week and offers it when the restore must be undone
• Added – backups: Once a site is on WP Octo plugin 2.7.0 or later, a backup or restore in progress can be stopped and a single file can be downloaded whether its backup copy is held by WP Octo or only by the site
• Fixed – backups: A backup sent to a site starts promptly instead of waiting for the site's next retry
• Added – Run code: Once a site is on WP Octo plugin 2.7.0 or later, save and send a PHP snippet to it or a chosen group of sites, optionally back up the database first, and follow what each run printed, returned or raised
• Added – feedback: Send a problem, idea or other feedback from any workspace page, optionally with marked page elements and a screenshot, and follow replies, fixes and roadmap placement in the same form
• Added – onboarding: A new workspace is guided through its details, packages, first client, first website and first backup before the rest of the workspace opens
• Improved – workspaces: The workspace menu marks the current workspace and can create another one, while empty dashboards explain the useful next step
• Added – agreements: When a new version of the terms or processing agreement requires acceptance, workspace members are informed, given the applicable grace period and guided through accepting it
• Added – API keys: A new workspace API key is shown once with its own description, rights and lifetime, and stored integration credentials remain hidden behind a Change action
• Improved – team: Invite a person from a dialog on the Team page without leaving the member list
• Added – websites: Each website has a Modules page where its available modules can be switched on or off and their allowed actions reviewed
• Improved – websites: A package request from the site is shown as a notice across that website's pages, where it can be accepted or declined
• Improved – updates: A running update round refreshes while it is active and stops polling when it has finished
• Improved – updates: A website's update rounds use the same list, status and actions as the workspace Control Center
• Improved – websites: The Core page opens with the site's last report and asks the site again only when Refresh now is chosen
• Security – access: Log in as follows the same website access permission whether the action is opened from the page or invoked directly
• Security – access: Workspace API keys are checked against the workspace in use, invitations cannot grant more access than their sender holds, and protected bulk actions stay hidden without the required access

09-10-2026

• Security – sign in: An account with two-factor authentication is asked for its code after signing in through another provider
• Added – WordPress login: Signing in to a website now shows a hand-off page with the website and workspace before WordPress opens
• Improved – update rounds: The update round list and details now show the work and its visual review together in a clearer layout
• Improved – sign in: A person returns to the workspace they last had open
• Improved – integrations: Integrations are organised as cards in categories with their settings beside them
• Improved – AI assistants: Assistant permissions can be chosen under presets and a new assistant can be connected in one step
• Improved – dashboard: The dashboard now brings fleet status, work that needs attention and active update rounds together
• Improved – plugins and themes: Plugin rows show an icon and open their details with less waiting
• Added – search: Search the whole workspace from the top bar with a keyboard shortcut
• Fixed – updates: A failed rollback now closes its update round instead of leaving the website busy

07-10-2026

• Security – updates: A shortened failure report from an update round no longer repeats text that could be a password or key
• Fixed – backups: A backup is offered for restore only while every backup it depends on is available and sound
• Improved – backups: A backup needed by another backup can no longer be deleted, and the screen explains what depends on it
• Improved – backups: Deleting a backup no longer overlaps with another operation on the same site

05-10-2026

• Added – packages: Each package now decides which plugin features its sites may use, and a feature can be switched off for one site; a site that departs from its package says so, and one action puts it back
• Added – packages: A package now sets how long a site may be out of contact with WP Octo before its features warn, switch off and the plugin removes itself, with a per-site override
• Added – packages: Once a site is on WP Octo plugin 2.5.0 or later, it can ask for another package from its own plugin; the request appears under Needs attention and on the website's page, where it is accepted or declined, and the person who asked hears by email
• Added – workspace: Whether a site's plugin shows the packages' prices, and in which currency, is a workspace setting
• Added – websites: Once a site is on WP Octo plugin 2.5.0 or later, the Actions card also lists what the site's own overview found, in your language; a point the site can fix itself opens there signed in, and what only the host can change can be marked resolved here
• Improved – websites: Once a site is on WP Octo plugin 2.5.0 or later, a change to its features or contact rules reaches the site at once, and the settings say so until the site has taken it
• Added – packages: A package can now set the disk space its hosting allows, with a per-site override; once a site is on WP Octo plugin 2.6.0 or later, it shows how much is still free
• Improved – backups: Once a site is on WP Octo plugin 2.6.0 or later, its Backups screen shows when its backup frequency or storage policy differs from its package, who changed it and when
• Added – websites: Once a site is on WP Octo plugin 2.6.0 or later, its caches can be cleared on request, and a package can choose to clear them after an update round installs something
• Added – update rounds: Once a site is on WP Octo plugin 2.6.0 or later, update rounds install available WordPress language packs as their own stage and list them with the rest of the round
• Added – update rounds: Once a site is on WP Octo plugin 2.6.0 or later, update rounds find and run pending database updates for WordPress, WooCommerce and plugins as their own stage where supported
• Added – backups: Once a site is on WP Octo plugin 2.6.0 or later, its package can plan a full backup at most every chosen number of days with incremental backups in between, with a per-site override

03-10-2026

• Fixed – updates: A theme update the site refused is recorded as refused, rather than as a success the site then disagreed with

02-10-2026

• Improved – updates: Regression-only results are now shown as completed, and completed rounds now say when an update was not carried out
• Fixed – update rounds: A plugin whose update was no longer on offer at the moment the round reached it is now tried again later in the same round instead of being left behind
• Improved – update rounds: An update that was planned and not carried out now says so plainly, with the reason, instead of being reported as a mismatch after a successful update

01-10-2026

• Security – access: Members can no longer trigger website, backup or setup changes that their access does not allow
• Security – health: A publicly readable WordPress error log is now consistently reported as Critical
• Fixed – integrations: Connecting a site to mail delivery now reuses a domain you already verified instead of creating a second one that can never verify

30-09-2026

• Added – security: Bot Protection's challenge widget now offers when it starts, how it is shown — standard, a compact floating bubble, or invisible until it needs to speak up — and whether the form's submit button waits for it to finish, alongside its existing colour theme
• Added – consent: A site's Consent page now recognises common analytics, marketing and video-embed scripts on its own, and lists any others it hasn't seen before so you can say what each one is for with one click
• Added – consent: Once you've said what an unrecognised script is for, publishing the change to the site remembers your choice, so the same script isn't shown as unknown again

29-09-2026

• Added – security: A site's Security page now offers WP Octo Bot Protection, a challenge in front of its forms, with which forms are protected, how hard the challenge is, what happens when a check fails, an optional hidden field trap, a rate limit, and the challenge widget's colour theme
• Added – security: A site's Security page shows the last 30 days of what Bot Protection caught for each protected form, issued, solved, refused, honeypot and rate limited
• Added – packages: A package can now decide which modules, starting with Bot Protection and Consent, its websites may use, and a website can switch an entitled module off for itself but never turn on one its package does not include
• Added – consent: A website with the WP Octo Consent module can set up its own cookie banner text and choices, publish it to the site, and see how many visitors saw it, accepted, rejected or customised their choice over the last 30 days
• Fixed – modules: Saving a website's settings no longer drops the configuration you had set for one of its switched-on modules
• Fixed – health: A site whose certificate check is out of date no longer shows as having an expired certificate
• Fixed – integrations: A Lettermint integration whose credential had rotated no longer gets stuck showing as not connected

28-09-2026

• Added – health: The health score now also weighs known vulnerabilities in your plugins and themes, updates left pending too long, whether your last backup can actually be restored, uptime over the last 30 days, whether the platform can still reach your site, and how soon your certificate expires
• Added – health: The health score now flags a site whose error log or an old remote-connection feature is left open to the public, with a note on how to close it
• Improved – health: A check that is only informational, such as a site having no monitor configured yet, is now shown on its own as a notice instead of counting against the score
• Security – health: A publicly readable error log now holds a site's health at Critical until it is fixed, whatever else about the site looks fine

27-09-2026

• Added – websites: A website's page shows the DNS status of a connected email sending domain, with a manual re-check
• Added – websites: A site with the WP Octo plugin can be connected to your workspace directly from its setup wizard, without copying a token by hand
• Added – connection: Approving a new connection — an AI assistant or a site — now lets you choose which workspace it joins and shows what it will be allowed to do there
• Security – connection: Approving a connection now asks again each time instead of silently reusing an old approval, so an app can no longer end up acting for a workspace you did not choose for it

24-09-2026

• Fixed – backups: A stalled backup that already showed progress no longer says it never reported any

23-09-2026

• Fixed – backups: A backup whose status the platform does not recognise no longer breaks the Backups pages of a website, the workspace or the admin panel; it is shown as unknown
• Improved – backups: The message for a stalled backup now says whether the site never reported any progress or stopped partway, so the two are no longer confused
• Added – API keys: The workspace API key list shows which abilities each key carries, and marks a key with full access
• Improved – monitoring: An uptime check that a firewall refuses now names the firewall instead of reporting a plain failure

21-09-2026

• Fixed – updates: A site reachable only through its own check-ins now receives a plugin update rollout instead of staying stuck

20-09-2026

• Added – workspace: AI assistants can now read your workspace and ask your sites questions within access set by an administrator

19-09-2026

• Added – overview: The Control Center overview lists what needs attention across your sites — critical plugin vulnerabilities, sites that are down, backups that failed last night, sites on a PHP version without security support and pending updates — each with a count, the sites behind it and one action

17-09-2026

• Improved – plugins and themes: Each plugin or theme appears once in the lists, however many sites carry it; duplicate entries have been merged with their sites, versions and advisories kept
• Improved – security: A vulnerability check that cannot judge one advisory continues with the rest, and the drawer says why a version is not checked instead of leaving it blank
• Improved – plugins and themes: A website's own Plugins and Themes pages show the same risk, version and status columns as the workspace lists, with their actions kept
• Added – plugins and themes: A plugin or theme whose author has not released anything in twelve months carries a label and a notice
• Improved – plugins and themes: The Info tab shows a component's description in full, and the drawer's tabs no longer shift after the first click
• Added – website overview: A website opens with its health score, the time of the last check, one row per aspect that is measured, and a list of what needs attention
• Improved – dashboard: Fleet health on the workspace dashboard is shown as the average health score of the checked sites
• Fixed – navigation: The active menu item has its marker and highlight back

16-09-2026

• Added – plugins and themes: One row per plugin or theme, with a drawer holding its vulnerabilities, information, changelog, sites and versions, a risk badge per row, icons, and a Vulnerable only filter
• Added – websites: A website's own Plugins and Themes pages open the same drawer, every website has an Activity page, and the Reports page carries the website header
• Added – navigation: Control Center is a navigation tree under Websites, and a website's pages open with the main menu collapsed
• Fixed – plugins and themes: Plugins are recognised by their folder, so information and vulnerability lookups resolve for components that were previously unmatched

15-09-2026

• Fixed – updates: An update round in a state the dashboard does not recognise is shown as an unknown status in the activity feed and on the Update Rounds pages instead of an error

14-09-2026

• Fixed – security: Vulnerability checks store their results again, and the plugin and theme lists show status, severity and the version that fixes an advisory
• Fixed – websites: The websites list summary and the fleet summary labels no longer overflow their space

13-09-2026

• Added – security: Plugins, themes and core versions across the fleet are checked against known vulnerabilities
• Security – updates: The bulk Run update round action is hidden from members without the permission to run update rounds
• Security – access: The Websites and Update Rounds lists are confined to the current workspace explicitly
• Fixed – subscriptions: The subscription lists skip a plan they cannot render instead of failing
• Fixed – websites: The website Settings header no longer overlaps its actions on desktop
• Fixed – announcements: An announcement no longer appears before its place on the page exists, and one dismissed from its close button stays dismissed
• Fixed – updates: The update-round chart draws in the panel's colours, and its link applies the completion filter it names
• Improved – plugins and themes: Plugin and theme icons sit on a surface that follows light and dark mode

12-09-2026

• Fixed – dashboard: On a phone the dashboard widgets no longer stay on loading or overlap the website header
• Added – websites: A site's thumbnail condition is readable in the panel, as a list column, a badge in the site header and a fleet metric for thumbnail issues
• Improved – updates: An update round that stalls is closed as abandoned and shown as such, instead of staying open indefinitely

08-09-2026

• Improved – backups: A backup completes on a site whose host blocks WP Octo's calls, and is far lighter on the site while it runs
• Improved – backups: A backup that is due starts promptly on a site WP Octo can reach, rather than waiting for the site's next scheduled task
• Improved – health: A site that reports as expected is no longer shown as stale between two of its reports
• Improved – worker updates: A site WP Octo could not reach during a worker update still receives the release through WordPress's own updates, and is recorded as updated once it has
• Fixed – worker updates: A site WP Octo could not reach for a worker update is recorded as unreachable rather than as failed
• Fixed – connection: A site whose host allows WP Octo, as its Health page instructs, is no longer reported as blocked by a firewall

07-09-2026

• Added – backups: Scheduled backups from the package with a per-site override, storage policies for the site, object storage or both, and restore from the external copy
• Added – backups: A central Backups page; Restore is offered only where a restore point exists, and the storage choice is limited to what the workspace has
• Improved – backups: The backup list is checked against what is actually on the site and in storage, so a backup whose copies are gone is no longer offered for a restore
• Improved – backups: A backup found on the site or in storage that WP Octo did not know about is verified in full before it is offered for a restore
• Added – health: A site WP Octo cannot reach is shown with the cause — DNS, certificate, timeout, a firewall with the provider named, plugin inactive, authentication failed — is checked again on its own, and receives the worker release it missed once it is reachable again
• Improved – health: A site blocked by its host's firewall shows on its Health page what to allow and where
• Added – sync: A site keeps WP Octo up to date on its own, so a host firewall no longer leaves its plugins, themes, users, core, health and backups stale, and every site shows when its data was last received
• Added – connection: A site running a JWT authentication plugin connects to WP Octo once its worker is current; that plugin used to stand in the way
• Improved – updates: A plugin update the site refused for a permanent reason, such as a missing licence, is not retried, and the reason is recorded
• Improved – roles: A member with the client role is read-only and can no longer log in to a site through the dashboard
• Security – access: A client member is limited to the sites of the clients they are attached to everywhere, the API included
• Fixed – sync: A site with many backups no longer fails its first report to WP Octo

06-09-2026

• Fixed – sign in: The login page refused every password; signing in with a password works again
• Fixed – updates: A plugin update the site refused is recorded as refused rather than as a success the site then disagreed with
• Improved – regression: The regression results table loads in a fraction of the time and shows its screenshots in one view

03-09-2026

• Improved – dashboard: Every screen follows the light or dark theme
• Improved – updates: The outcome of a plugin update is verified against the site rather than taken from the site's own report
• Security – access: The workspace API key is no longer visible to a read-only role