What WordPress Toolkit can do
| Feature | What it does |
|---|---|
| Install | Installs WordPress with a database, admin user and your chosen settings |
| Security | Applies hardening measures, such as blocking access to sensitive files and disabling file editing in the dashboard |
| Updates | Updates core, plugins and themes, by hand or automatically |
| Clone | Copies a site to another domain or subdomain, for staging or a new project |
| Copy data | Copies files and the database between two sites, for example from staging back to live |
| Maintenance mode | Shows visitors a holding page while you work |
| Mass management | Updates or secures many WordPress sites on the account at once |
Some advanced features, such as Smart Updates, which test updates on a copy first, are part of the paid edition of WordPress Toolkit. Your hosting plan determines which edition you have.
Install WordPress
- In cPanel, open WordPress Toolkit (in the sidebar or under Domains).
- Click Install.
- Choose the domain and, if needed, a folder. Leave the folder empty to install at the domain root.
- Set the site title, admin user name (not “admin”), a strong password and the admin email.
- Choose the automatic update setting, then click Install.
Secure the site
Open the site in WordPress Toolkit and click Security. Review the recommended measures and apply them. Check the site afterwards: some measures, such as blocking PHP execution in certain folders, can affect unusual plugins. For login protection, see our guide to changing the WordPress login URL.
Set up updates
| Setting | Recommendation |
|---|---|
| WordPress core | Automatic minor (security) updates on; major updates after testing |
| Plugins | Automatic for trusted, well-maintained plugins; manual for critical ones such as shop plugins |
| Themes | Automatic if you use a child theme for your changes |
The Toolkit also flags plugins and themes with known vulnerabilities, so you can update or remove them quickly.
Clone to a staging site
- Create a subdomain such as
staging.example.com. - In WordPress Toolkit, open the live site and click Clone, then pick the staging subdomain as the target.
- Make and test your changes on the staging copy.
- Use Copy Data to copy files, database tables or both back to the live site.
Keep staging copies password-protected and hidden from search engines. In the copy’s WordPress settings, tick Discourage search engines from indexing this site.
Other useful tools
- Maintenance mode: shows a simple holding page to visitors while you update or redesign.
- Password protection: puts a login in front of the whole site, ideal for staging copies.
- Debugging: turns WordPress debug settings on and off without editing wp-config.php.
- Change admin password: sets a new password for a WordPress user if you are locked out.
Manage many sites at once
If your account has several WordPress sites, the Toolkit’s main screen shows them all. Select several and apply updates or security measures in one step. This is one of the biggest time savers for agencies and owners of several sites. See our guide to managing multiple websites.
WordPress Toolkit or Softaculous?
Both can install and manage WordPress. WordPress Toolkit focuses on WordPress, with security checks, clone and copy data, and mass management. Softaculous covers hundreds of apps and has its own backups and staging. Use one tool per site, so settings do not conflict. See our Softaculous guide.
Need help with this?
Run WordPress with WordPress Toolkit, free SSL and daily backups on our hosting.
Frequently asked questions
Where is WordPress Toolkit in cPanel?
In the cPanel sidebar or under the Domains section, depending on your theme.
Can WordPress Toolkit manage a site I installed manually?
Usually yes. Use the Scan option to find existing WordPress installations on the account.
Does WordPress Toolkit make backups?
It works together with cPanel’s backups. Keep separate off-site backups as well.
What are Smart Updates?
A paid feature that tests updates on a hidden copy of the site and compares the result before updating the live site.
Can I undo a security measure?
Yes. Open the site’s Security screen in WordPress Toolkit and revert the measure that caused the problem.
Should I use WordPress Toolkit and Softaculous on the same site?
No. Choose one tool per site to avoid conflicting update and backup settings.
Related guides
