Description
WP Command and Control connects your WordPress site to a central WP Command and Control dashboard, so you can manage, update, and back up every WordPress site you run without logging into each one separately.
Just activate the plugin — your site registers with your WP Command and Control account automatically, no manual setup step required.
Features
- Centralized multi-site dashboard — track WordPress core, plugin, and theme versions across every connected install from one place.
- WordPress 5.5+ native auto-update controls — granular control over core (minor vs. major), theme, and per-plugin auto-updates, not just an on/off switch.
- Remote core/plugin/theme updates — trigger updates manually or on a schedule, individually or in bulk across sites.
- Automated, resumable backups — full-site backups (database + files) run as a batched job that reports progress and won’t time out on constrained hosting, alongside BackUpWordPress integration for scheduled backups.
- Update & backup reporting — generate plugin/core update and backup-run reports for each site.
- Zero-touch onboarding — a new site joins your account just by activating the plugin.
- Security & malware scanning — integrated with Sucuri for site-level security scans.
- Secure by design — every request is HMAC-SHA256 signed and verified; no arbitrary HTTP callbacks, all data returns directly in the API response.
Support
You can email us at support@wpcommandcontrol.com for support.
Installation
- Install the WP Command and Control plugin either via the WordPress.org plugin directory, or by uploading the plugin files to your server.
- Activate the plugin.
- Sign up for an account at wpcommandcontrol.com — your site is added automatically once the plugin is active.
FAQ
-
Do I need an account to use this plugin?
-
Yes. The plugin is the on-site agent; it connects to your WP Command and Control dashboard at wpcommandcontrol.com, where you view status and trigger actions across all your sites.
-
What happens when I activate the plugin?
-
It registers the site with your WP Command and Control account automatically — there’s no separate manual “add site” step.
-
What WordPress and PHP versions are supported?
-
WordPress 6.0 or later, and PHP 7.4 or later.
-
Is my site data sent to a third party during a backup?
-
No. Backups run entirely on your own server. The plugin doesn’t push files off-site itself — your dashboard account retrieves the finished backup archive from your site over an authenticated connection when you request it.
-
How are requests to my site authenticated?
-
Every request is signed with HMAC-SHA256 and verified against your site’s API key before anything runs. There are no unauthenticated or “secret URL” style endpoints.
-
Does this plugin slow down my site?
-
No. The plugin only runs when your dashboard sends it a signed request — it doesn’t add any always-on frontend or admin overhead.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“WP Command and Control Plugin” is open source software. The following people have contributed to this plugin.
Contributors
Translate “WP Command and Control Plugin” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
2.3.8
- Raised minimum requirements to WordPress 6.0 and PHP 7.4
- Resumable, batched full-site backups — backups now run as bounded steps with progress reporting instead of one long request, fixing timeouts on constrained hosting
- New authenticated backup archive retrieval and cleanup actions
- Unreadable files are now skipped and counted during a backup instead of failing the whole job
- Timeout guard for stalled backup jobs
- Paginated file manifest support (
get_files) for large sites - Hardened HMAC request verification (constant-time comparison)
- Sanitized and allowlisted filesystem credential handling
- Denylisted privilege-escalation-relevant settings from remote option changes
- Path-traversal fix on remote file reads, contained to the WordPress install directory
- Corrected content size reporting (database + core size)
- Added a
current_user_can('manage_options')capability gate across the whole remote API
2.3.7
- Enhanced WordPress 5.5+ native auto-update integration
- Improved plugin and theme auto-update management
- Fixed install_plugin endpoint for better JSON response handling
- Added comprehensive input validation and error handling
- Enhanced security with improved HMAC verification
- Better compatibility with modern WordPress versions
- Fixed fatal errors and improved plugin stability
2.3.6
- Improved auto-update status reporting
- Enhanced WordPress core update controls
- Better plugin management functionality
- Security improvements and bug fixes
2.3.5
- PHP 8.x compatibility
2.0
- New options page. Intergrated Security and Malware scans provided by Sucuri
1.25
- Improved security
1.11
- New file backup methods available
1.10
- New Plugin management functions
1.0
- Initial version