WordPress & web · updates.harborCI passing

WordPress Site Manager: Safe Updates

Plugin updates that check key pages before and after and roll back an update that breaks them, plus a dashboard for other sites.

View the code Evaluation report Demo tour Run it ›_ last push 2 days ago

100% vs 34%breaking updates caught on held-out sites (WordPress's error check: 34%), with no harmless update rolled back

59% vs 0%of breakage kinds written after freezing caught; the three missed kinds are documented

3 of 3breaking fixture updates rolled back on real WordPress, including a fatal error served as 200 OK

Site Manager's Updates screen: two updates waiting and five earlier updates, three rolled back with the reason on each page. Screenshot from the project's demo (synthetic data).

demo Demo tour

Screenshots from the running application, with its synthetic demo data. Select one to enlarge.

Updates waiting, and what happened to earlier ones: three rolled back, with the reason on each page.

The hub: another site's WordPress and PHP versions, waiting updates and last result, read over REST.

Settings: the pages to check, safe auto-updates, and a loopback address for hosts that cannot reach themselves.

Evaluation: breaking and harmless updates on held-out sites, and the kinds written after freezing, misses included.

01 The problem

Plugin updates are the most common way a working WordPress site breaks, and most breakage is quiet: a form that no longer renders, a shortcode printed as text, a missing stylesheet, a fatal error served as 200 OK. WordPress's own check after an auto-update only looks for fatal errors.

02 How it works

Snapshot key pages
Back up the plugin
Update
Snapshot again
Compare structure
Keep or roll back

03 What I built

Structural page snapshots (status, error markers, landmarks, forms, stylesheets, unrendered shortcodes, PHP warnings, visible text with nonces and counters masked) and a comparison that says page by page why an update looks broken.
Safe updates through WordPress's own upgrader: back up the plugin folder via WP_Filesystem, update, re-check, restore on a regression and confirm the pages recovered; daily safe auto-updates.
A hub dashboard that reads other sites' versions, waiting updates and results over REST with WordPress application passwords, stored encrypted with AES-256-GCM.

04 What I learned

The first version scored 100% on breakage I had written alongside the rules, so eight new kinds were written after freezing: 59% caught, and the misses are documented rather than tuned away.

On real WordPress a fatal error thrown while a shortcode rendered came back as 200 OK: the headers had already been sent, so a status check would have kept the broken update.

05 Known limitations

Every repository documents what it doesn't do yet. The main ones:

Misses an emptied menu, prices dropping to zero and duplicated content; only five pages are checked.
Plugins only, and files are rolled back but database migrations are not.

06 Stack

PHP 8.1WordPressREST APIWP_FilesystemApplication passwordsPHPUnitDocker

The repository has the design document, operations runbook, full evaluation report and known limitations. All data is synthetic, generated by code in the repository.

run Run it yourself

Every project runs on a laptop: no cloud account and no paid API needed.

git clone https://github.com/codeROCK-IZZY/wordpress-site-manager.git
cd wordpress-site-manager
docker compose up -d && bash tests/integration/run.sh
php eval/run.php --gate               # writes eval/reports/report.html