Docs

WordPress sites

Install WordPress, check core, plugins and themes, run guarded updates with automatic rollback, and harden a WordPress site.

Sites created with the WordPress runtime get a WordPress tab. It shows what is installed, what needs updating and how well the site is hardened, and runs updates safely.

The WordPress tab with core, plugins, themes and hardening
The WordPress tab with core, plugins, themes and hardening

Installing WordPress

Creating a site with the WordPress runtime installs WordPress for you (see Creating and managing sites). To install it on an existing WordPress-runtime site that does not have it yet:

  1. Open the site's WordPress tab and choose Install WordPress.
  2. Enter the Site title, Admin user (not admin, administrator or root) and Admin email.
  3. Confirm Install. Anything already in the site is replaced.

WordPress, its database and user, and an admin account are created. The admin password is generated on the server and shown on the tab once it is done; after that it is kept encrypted and can be revealed under Admin sign-in.

Checking the site

Press Check now to read the site's WordPress state. The tab shows when it was last checked, and:

  • WordPress core: the installed version and any update available.
  • Plugins and Themes: each with its name, slug, whether it is active, its version and any update.
  • Admin sign-in: the admin user created by Tenvara, its password (hidden) and Open wp-admin.
  • Hardening: how many of the six measures are in place.
  • Administrators: everyone with the administrator role in this WordPress.
  • Core checksums: whether WordPress's core files match the official release. A mismatch is flagged, as it can mean files were tampered with.

Updating safely

Updates are guarded. Before updating, the server snapshots the site and its database and checks that / and /wp-login.php answer. After updating it checks them again, and if they stop answering it rolls everything back by itself.

  • To update everything, press Update all.
  • To update one item, press Update on its row in Plugins or Themes, or update WordPress core on its own.

Confirm the list of items. The result shows what was updated and whether it was rolled back.

Note: WordPress updates in Tenvara run when you ask. Scheduled updates across your estate belong to patch management, and a nightly WordPress update policy is not offered.

Hardening

Hardening checks six measures:

Measure What it does
Theme and plugin editors are off Sets DISALLOW_FILE_EDIT so an admin account cannot edit code from the dashboard
xmlrpc.php is blocked Closes a common brute force and amplification route
PHP does not run from uploads Stops an uploaded file being executed
WP_DEBUG is off Keeps errors and paths off public pages
No user called "admin" Removes the most guessed user name
wp-login.php is rate limited Slows password guessing

Press Apply to put the missing ones in place. The list shows each measure with a tick once it is in place.

Alerts for WordPress sites

WordPress sites share the web server alerts: site not answering, certificate expiry, failed backups and failed operations. See Certificates, operations and alerts.

Was this page helpful?

Thanks for the feedback.