Plugin updates
How a new worker release reaches a site, and how the site protects itself while installing it.
The platform decides, per site
A worker release is published once, as a zip with a recorded checksum. The platform rolls it out in stages: a small group of sites first, then larger ones, each stage waiting a set time after the previous one settled before it starts. A stage that produces failures stops the rollout.
A site therefore never installs a release just because it exists. It installs the release the platform has released to it.
What the worker does
On the platform's instruction the worker:
- Checks that the release can be fetched and written, and that nothing else — a backup, a restore — is running on the site.
- Installs — downloads the zip, verifies its checksum, keeps a rollback copy of the running version outside the plugin folder, and swaps the plugin under maintenance mode so a visitor is never served a half-replaced plugin. On hosts where PHP cannot write the plugin directory directly, it installs through WordPress's own upgrader.
- Reports the version now running, which the platform confirms by asking the site again rather than trusting the report.
- Rolls back on any failure, from the copy it kept, and says so.
The rollback also works when the new version cannot load at all — Recovery.
The worker asks before it installs
Before installing anything the worker asks the platform whether this release is for this site, and installs nothing when it gets no clear answer. The same applies to WordPress's own updater: a site the platform cannot call can still pull a release through Plugins → Updates, but only one the platform has approved for it.
A site that missed a rollout
A site that was unreachable during a rollout — behind a firewall, say — is not left behind. The first time the platform reaches it again and finds it below the current release, it starts a rollout for that one site immediately, with the same checks, install, confirmation and rollback.
What you see in the dashboard
The site's header shows the version it reported last. Where a decision depends on the version, the platform asks the site rather than trusting the record. In the fleet's activity you see that a worker was updated.
Updating by hand
Uploading a newer zip through WordPress's plugin screen works and is the route for a site the platform cannot reach and that cannot pull through the updater either. The site reports the new version on its next contact, and the platform's record follows the site.