Smart Plugin Manager (SPM)

Smart Plugin Manager is a WP Engine feature that keeps your environments secure by automatically updating all of your WordPress plugins to ensure that they’re always up-to-date.

Additionally, Smart Plugin Manager will check to ensure that the updates are working as expected, and that the update did not cause any visual problems on your site. Read the press release.

In the event that a plugin update causes an issue, Smart Plugin Manager will automatically revert the updates and restore your site to its previous state.


About Smart Plugin Manager

Smart Plugin Manager (SPM) runs a script daily to check if there are any updates available for your plugins. Currently it will not update themes, however this may come in future iterations. You can select the time of day you’d like the service to check for updates from the Settings page.

Smart Plugin Manager is deployed on individual environments, using one license per install. Smart Plugin Manager can also be deployed on multisite networks (read more on this here).

If your WordPress site fulfills a basic purpose, such as providing marketing information for your business, we recommend enabling Smart Plugin Manager on your Production environment. If you do a lot of custom development or your website utilizes multiple applications (such as an eCommerce site), we recommend using Smart Plugin Manager on your Staging environment first so you can check that the updates didn’t cause any issues with custom code or third-party applications. If you’re happy with the results, feel free to enable it on your Production environment.

Determining a Successful Update

Utilizing a proprietary set of tests and machine learning algorithms, after plugins are updated, Smart Plugin Manager checks for server response errors, broken code, and visual changes immediately after plugins have been updated. Some example visual errors that will cause a reversion and restoration are missing images and forms, misplaced iconography, PHP errors, and other visual indicators that the plugin updates causes a material change to your site.

Smart Plugin Manager makes a judgement on site functionality based on a set of tests that verify site functionality. We’re constantly improving the technology and verification mechanisms so false positives/negatives may occur. If an update breaks your site but was passed by Smart Plugin Manager, you can restore using WP Engine’s backup system. Likewise, if Smart Plugin Manager believes the updates broke your site when it seems to be fine, you can manually update your plugins. If you experience one of these issues, please contact Support.


Visual Regression Testing

Visual regression testing (VRT) refers to the process of visually checking a series of pages before and after updates are performed for discrepancies. This is especially powerful because it can be used to determine if the website should automatically be rolled back after updates are performed.

Smart Plugin Manager checks the homepage by default. If you add a sitemap (whether through the sitemap setting or a sitemap plugin), it will check and run verification on up to 20 listed pages, including the homepage. If there are more than 20 pages listed in your sitemap, it will do your homepage and a randomized 19 other pages from the entirety of the sitemap. If there is a failure on any page, Smart Plugin Manager will roll back the plugin updates and restore your entire site to its previous state. Additionally, SPM can be told to ignore specific items if necessary. For example, a calendar widget is expected to vary visually but doesn’t indicate an update failure.

WooCommerce

For websites that have the WooCommerce plugin activated, VRT will automatically check the cart page, checkout page, my account page, up to 3 random category pages, and 13 random product pages. These specific URLs are:

/cart
/checkout
/my-account
/product-category/your-category-name
/product/your-product-name

In the case that you are not utilizing the above product or category URL structure, WooCommerce will be queried first for current URLs using the IDs (EX: domain.com/?product=111.)

If you prefer to override the VRT for these default URLs, this can be done simply by using a custom sitemap.


Multisite

Smart Plugin Manager supports WordPress multisite. SPM will enable maintenance mode on all subpages when updates are running.

If you wish to use SPM on a multisite network, we recommend the following configuration:

  • Activate plugins network-wide, or activate all plugins on the main site
  • For private and commercial plugins, enter the license credentials, subscription key, or download key on the main site
  • Use WP Engine’s backups instead of a 3rd-party WordPress plugin for backing up all of your subsites, to avoid keeping the main site for a long time in maintenance mode during SPM updates

Visual Regression Testing functions a little differently however when applied to multisite networks There are two ways pages will be tested for failures:

  • In a multisite network with under 20 sites (19 subsites + main site), VRT will test;
    • The homepage of the main site
    • The homepage of all subsites
    • Custom SPM sitemap
      • Up to 20 URLs in total, including any homepages that will be tested above.
      • Custom sitemap can be for the main site only and URLs only.
  • In a multisite network with over 20 sites (19 subsites + main site), VRT will test;
    • The homepage of the main site
    • The homepage of up to 49 subsites
  • In a multisite network with over 50 sites (49 subsites + main site), VRT will test;
    • The homepage of the main site
    • The homepages of the first 49 subsites created
    • A custom SPM sitemap will be ignored
    • Subsites 51 and greater will not be checked

*The main site is defined as the site ID 1 and uses the wp_options table (as opposed to wp_2_options, etc). This is the first site on the network and the site that cannot have the domain updated in the wp-admin.


Update Failures

If a plugin fails to update, we will stop trying to update your plugins and you will receive a notification alerting you to which plugin(s) failed to update so you can investigate. Smart Plugin Manager will attempt updates for three more days.

If plugins update successfully but we detect an issue after updating, such as a 4XX/5XX error or a material change to the look of your site, we will revert your site and plugins back to the state and version prior to running the updates.

After three days, the system will attempt to update each plugin individually and will skip updating the specific plugin that caused the failure while still updating the other plugins. You will need to manually update the plugin that causes the failure before it will properly update automatically.


Git Support

All of Smart Plugin Manager’s features, including Visual Regression Test, Auto Site Rollback and Notifications, can be leveraged for a Git-hosted plugin by first connecting your website with Github. This means you can push updates to a custom plugin via GitHub and have those updates download automatically to any website where Smart Plugin Manager is active.

In order to connect your website to the Github repository, we recommend using either the GitHub Updater or Plugin Updates Checker plugin. These plugins will automatically make a pending update for your custom plugin visible in the wp-admin area of your site, which will then notify Smart Plugin Manager to initialize that update. Details on how to configure your plugin to sync these tools can be found in their own documentation: Github Updater Setup Guide and Plugin Update Check Getting Started Guide.

Finally, when utilizing Git on a website using Smart Plugin Manager the following should be added to the gitignore file:

# smart plugin manager specific 
wp-content/plugins/*
wp-content/.logs/
autoupdater_maintenance_mode_enabled.tmp

Downloadable gitignore files including these SPM-specific paths can be found in the full Git guide here.


Limitations

Smart Plugin Manager is able to update plugins on any WordPress site. SPM can also update websites that are password-protected (HTTP Basic Authentication) only if it was set up in the WP Engine User Portal and not by a 3rd party solution.

NitroPack

If your website is utilizing the NitroPack optimization plugin you will need to exclude a Smart Plugin Manager cookie to prevent any interruption in our update services.

Cookie name: wpengine_no_cache

Cookie value: (empty)

Learn how to exclude a cookie in NitroPack.

Allowlist Smart Plugin Manager

If requests to a website from SPM could be denied by a WAF (web application firewall), you may need to add SPM requests to the allowed list. Those requests will contain the header named autoupdater and come from a static set of IP addresses:

  • 35.186.183.60
  • 35.221.41.251
  • 35.236.216.128
  • 35.245.159.253
  • 35.245.210.234
  • 35.245.251.214
  • 35.245.50.252

Stackpath WAF

Create a custom WAF rule with the WAF rule editor

  • Under Rule Type, select WAF.
  • Next to IF, select a rule type Header.
  • In the next drop-down menu select — to apply the rule only to the specified header.
  • In the field, enter the header key autoupdater
  • In the next drop-down menu select Contains.
  • In the field, enter the header value . (dot).

Learn more about Stackpath WAF rules.

Cloudflare WAF

Add a rule to allow access by header name:

any(http.request.headers.names[*] == "autoupdater")

Alternatively, add a rule to allow access by URI:

any(http.request.uri.args["autoupdater"][*] == "api") or any(http.request.uri.args.names[*] == "autoupdater_nonce")

Learn more about Cloudflare WAF rules.


Enable Smart Plugin Manager

Customers on shared hosting plans can add Smart Plugin Manager through the Modify Plans page. Customers on dedicated plans, please reach out to your Account Manager through this page.

After purchasing the addon, enable Smart Plugin Manager on the environment of your choice via the User Portal:

  1. Log into the User Portal
  2. Select Tools from the left menu
  3. Click Smart Plugin Manager
  4. Click Add Environments
  1. Select any environments you’d like to enable Smart Plugin Manager on
  2. Click Add to SPM
  1. The “WP Engine Smart Plugin Manager” WordPress plugin will automatically be installed on these environments.

NOTE: The number of remaining licenses will display at the top right of this page.


Smart Plugin Manager Status

A report detailed the previous Smart Plugin Manager run can be found in the User Portal. This report contains the same information that is sent via email notice when the process completes.

  1. Log into the User Portal
  2. Select Tools from the left menu
  3. Click Smart Plugin Manager
  4. Locate the environment name
  5. Click the 3 dot menu icon to the right
  6. Select View Status

The status page will show if the updates failed or succeeded and if a rollback was necessary. The page also details which plugins were updated and to which version. This status page only shows the previous round of updates and is not cumulative.

Additionally, SPM statistics for the current billing period can be found on the Billing > Plan Usage page of your User Portal. This includes the number of plugins updated, number of URLs tested, and a cumulative estimate of time saved.

Learn more about the Plan Usage page.


Smart Plugin Manager Settings

There are two ways to access the settings for Smart Plugin Manager in the User Portal. The method you use depends on if you wish to edit the settings for one environment at a time, or multiple.

  1. Log into the User Portal
  2. Select Tools from the left menu
  3. Click Smart Plugin Manager
  4. Check off environment(s) from the list to modify settings
  5. Click Edit Settings


Update Schedule

Select a timeframe to attempt the update process. It’s recommended to choose a low traffic period for your website.

  1. Frequency: Daily or Weekly rate the environment(s) will be checked and updated.
  2. Time of week: Whether the process will check only on weekdays or weekends, or if neither is preferred.
  3. Time zone: The time zone the update process should refer to. We suggest setting this to match your primary visitor time zone.
  4. Window: The time frame updates will be performed, times will reflect the time zone selected.



Notification Emails

Enter email addresses, separated by commas, to receive notifications. Notifications can be sent for successful updates, or only if an update fails.


Auto Rollback

Smart Plugin Manager creates a backup using WP Engine’s automated backup and restore system prior to making any changes to the website. SPM will restore to this previous version (“roll-back”) if it determines using visual regression testing or error codes that the updated version may have altered the website.

Choose whether or not the rollback process should be automatic by toggling.



Maintenance Mode

Turn maintenance mode on or off to protect against data loss or missed orders while Smart Plugin Manager is updating plugins.

Site visitors will see a default “Undergoing maintenance” page, temporarily denying any traffic to the site.

If you wish to customize this maintenance page copy the file wp-content/plugins/autoupdater/tmpl/offline.tmpl.php to wp-content/autoupdater/tmpl/offline.tmpl.php
and adjust the styling within it. It is not recommended to use any PHP code in this file.


Managed Plugins

Select which plugins Smart Plugin Manager should attempt to update or ignore. By default, Smart Plugin Manager will attempt to update all plugins.

Each list is generated uniquely for each environment. This option is only available when editing the SPM options for a single environment.


Hidden Content

Smart Plugin Manager uses visual regression testing to help determine if an update failed. Use this to hide content that may change regularly, such as ads, recent posts, or calendars.

This field accepts CSS selectors separated using the Enter or Return key.


Sitemap Override

By default, Smart Plugin Manager will check 20 random pages, always including the homepage, after an update.

To ensure specific pages are always reviewed by Smart Plugin Manager, provide the URL to a custom sitemap you’d like Smart Plugin Manager to choose from instead. This sitemap should be entered into the SPM options as an absolute path.

Sitemap override is only available when editing options for a single environment.


Release License

Releasing an SPM license will disable Smart Plugin Manager on the selected environments. The Smart Plugin Manager plugin will be removed automatically and a license will be freed up for use on another environment. This process may take a few minutes to complete.



NEXT STEP: Learn how to upgrade your PHP version

Automatically update plugins

WP Engine's Smart Plugin Manager keeps your site secure by updating plugins for you. It also uses visual regression to automatically revert to a backup if an update causes issues.