Smart Plugin Manager (SPM)

Smart Plugin Manager is a WP Engine feature that keeps your environments secure by automatically updating all of your WordPress plugins to ensure that they’re always up-to-date.

Additionally, Smart Plugin Manager will check to ensure that the updates are working as expected, and that the update did not cause any visual problems on your site. Read the press release.

In the event that a plugin update causes an issue, Smart Plugin Manager will automatically revert the updates and restore your site to its previous state.

NOTE: Smart Plugin manager is not supported for multisite configurations at this time.

About Smart Plugin Manager

Smart Plugin Manager (SPM) runs a script daily to check if there are any updates available for your plugins. Currently it will not update themes, however this may come in future iterations. You can select the time of day you’d like the service to check for updates from the Settings page.

Smart Plugin Manager is deployed on individual environments, as each one is a distinct installation of WordPress it requires a unique license per environment.

If your WordPress site fulfills a basic purpose, such as providing marketing information for your business, we recommend enabling Smart Plugin Manager on your Production environment. If you do a lot of custom development or your website utilizes multiple applications (such as an eCommerce site), we recommend using Smart Plugin Manager on your Staging environment first so you can check that the updates didn’t cause any issues with custom code or third-party applications. If you’re happy with the results, feel free to enable it on your Production environment.

Determining a Successful Update

Utilizing a proprietary set of tests and machine learning algorithms, after plugins are updated, Smart Plugin Manager checks for server response errors, broken code, and visual changes immediately after plugins have been updated. Some example visual errors that will cause a reversion and restoration are missing images and forms, misplaced iconography, PHP errors, and other visual indicators that the plugin updates causes a material change to your site.

Smart Plugin Manager makes a judgement on site functionality based on a set of tests that verify site functionality. We’re constantly improving the technology and verification mechanisms so false positives/negatives may occur. If an update breaks your site but was passed by Smart Plugin Manager, you can restore using WP Engine’s backup system. Likewise, if Smart Plugin Manager believes the updates broke your site when it seems to be fine, you can manually update your plugins. If you experience one of these issues, please contact Support.

Visual Regression Testing

Visual regression testing (VRT) refers to the process of visually checking a series of pages before and after updates are performed for discrepancies. This is especially powerful because it can be used to determine if the website should automatically be rolled back after updates are performed.

Smart Plugin Manager checks the homepage by default. If you add a sitemap (whether through the sitemap setting or a sitemap plugin), it will check and run verification on up to 20 listed pages, including the homepage. If there are more than 20 pages listed in your sitemap, it will do your homepage and a randomized 19 other pages from the entirety of the sitemap. If there is a failure on any page, Smart Plugin Manager will roll back the plugin updates and restore your entire site to its previous state. Additionally, SPM can be told to ignore specific items if necessary. For example, a calendar widget is expected to vary visually but doesn’t indicate an update failure.


For websites that have the WooCommerce plugin activated, VRT will automatically check the cart page, checkout page, my account page, up to 3 random category pages, and 13 random product pages. These specific URLs are:


In the case that you are not utilizing the above product or category URL structure, WooCommerce will be queried first for current URLs using the IDs (EX:

If you prefer to override the VRT for these default URLs, this can be done simply by using a custom sitemap.

Update Failures

If a plugin fails to update, we will stop trying to update your plugins and you will receive a notification alerting you to which plugin(s) failed to update so you can investigate. Smart Plugin Manager will attempt updates for three more days. If plugins update successfully but we detect an issue after updating, such as a 4XX/5XX error or a material change to the look of your site, we will revert your site and plugins back to the state and version prior to running the updates. After three days, we’ll attempt to update each plugin individually and will skip updating the specific plugin that caused the failure while still updating the other plugins. You will need to manually update the plugin that causes the failure before it will properly update automatically.


Smart Plugin Manager is able to update plugins on any WordPress site. SPM can also update websites that are password-protected (HTTP Basic Authentication) only if it was set up in the WP Engine User Portal and not by a 3rd party solution.

We do not recommend Smart Plugin Manager for multisites at this time.

Git Support

All of Smart Plugin Manager’s features, including Visual Regression Test, Auto Site Rollback and Notifications, can be leveraged for a Git-hosted plugin by first connecting your website with Github. This means you can push updates to a custom plugin via GitHub and have those updates download automatically to any website where Smart Plugin Manager is active.

In order to connect your website to the Github repository, we recommend using either the GitHub Updater or Plugin Updates Checker plugin. These plugins will automatically make a pending update for your custom plugin visible in the wp-admin area of your site, which will then notify Smart Plugin Manager to initialize that update. Details on how to configure your plugin to sync these tools can be found in their own documentation: Github Updater Setup Guide and Plugin Update Check Getting Started Guide.

Enable Smart Plugin Manager

Customers on shared hosting plans can add Smart Plugin Manager through the Modify Plans page. Customers on dedicated plans, please reach out to your Account Manager through this page.

After purchasing the addon, enable Smart Plugin Manager on the environment of your choice via the User Portal:

  1. Log into the User Portal
  2. Select Tools from the left menu
  3. Click Smart Plugin Manager
  4. Click Add Environments
  1. Select any environments you’d like to enable Smart Plugin Manager on
  2. Click Add to SPM
  1. The “WP Engine Smart Plugin Manager” WordPress plugin will automatically be installed on these environments.

NOTE: The number of remaining licenses will display at the top of the window.

Smart Plugin Manager Status

A report detailed the previous Smart Plugin Manager run can be found in the User Portal. This report contains the same information that is sent via email notice when the process completes.

  1. Log into the User Portal
  2. Select Tools from the left menu
  3. Click Smart Plugin Manager
  4. Locate the environment name
  5. Click the 3 dot menu icon to the right
  6. Select View Status

The status page will show if the updates failed or succeeded and if a rollback was necessary. The page also details which plugins were updated and to which version. This status page only shows the previous round of updates and is not cumulative.

Additionally, SPM statistics for the current billing period can be found on the Billing > Plan Usage page of your User Portal. This includes the number of plugins updated, number of URLs tested, and a cumulative estimate of time saved.

Learn more about the Plan Usage page.

Smart Plugin Manager Settings

There are two ways to access the settings for Smart Plugin Manager in the User Portal. The method you use depends on if you wish to edit the settings for one environment at a time, or many.

Single Environment Settings

  1. Log into the User Portal
  2. Select Tools from the left menu
  3. Click Smart Plugin Manager
  4. Locate the environment name
  5. Click the 3 dot menu icon to the right
  6. Select Edit Settings to view the following settings for this environment:

Bulk Environment Settings

The next method can be used if you wish to edit settings in bulk for several environments at a time.

  1. Log into the User Portal
  2. Select Tools from the left menu
  3. Click Smart Plugin Manager
  4. Check off environment(s) from the list to modify settings
  5. Click Edit Settings

All environments being modified will be listed at the top of the window, near the title. To retain settings changes and return to the main settings modification page, click the arrow to the left of the option title.

Update Schedule

Select a timeframe to attempt the update process. It’s recommended to choose a low traffic period for your website.

  1. Frequency: Daily or Weekly rate the environment(s) will be checked and updated.
  2. Time of week: Whether the process will check only on weekdays or weekends, or if neither is preferred.
  3. Time zone: The time zone the update process should refer to. We suggest setting this to match your primary visitor time zone.
  4. Window: The time frame updates will be performed, times will reflect the time zone selected.

Notification Emails

Enter email addresses to receive notifications. Use the Enter to Return key to apply additional emails.

Notifications can be sent for successful updates or only if the updates fail.

Auto Roll-back

Smart Plugin Manager will roll back updates if it determines (using visual regression testing or error codes) that the newest version may have altered the website.

Choose whether or not the roll-back process should be automatic.

Maintenance Mode

Turn maintenance mode on or off to protect against data loss or missed orders while Smart Plugin Manager is updating plugins.

Site visitors will see a default “Undergoing maintenance” page, temporarily denying any traffic to the site.

If you wish to customize this maintenance page copy the file wp-content/plugins/autoupdater/tmpl/offline.tmpl.php to wp-content/autoupdater/tmpl/offline.tmpl.php
and adjust the styling within it. It is not recommended to use any PHP code in this file.

Managed Plugins

Select which plugins Smart Plugin Manager should attempt to update or ignore. By default, Smart Plugin Manager will attempt to update all plugins.

This option is only available when one environment is selected to edit because the list is generated uniquely.

Hidden Content

Smart Plugin Manager uses visual regression testing to help determine if an update failed. Use this to hide content that may change regularly, such as ads or calendars.

Accepts CSS selectors separated using the Enter or Return key.

This option is only available when editing the options for one environment at a time.

Sitemap Override

By default, Smart Plugin Manager will check 20 random pages, always including the homepage, after an update.

To ensure specific pages are always reviewed by Smart Plugin Manager, provide the URL to a custom sitemap you’d like Smart Plugin Manager to choose from instead. For example, your cart page.

This sitemap should be entered as an absolute path.

Release License

Releasing an SPM license will disable Smart Plugin Manager on that environment.

Once selected you will be prompted to confirm the selection.

The Smart Plugin Manager plugin will be removed automatically and a license will be freed up for use on another environment. This process may take a few minutes to complete.

Allowlist Smart Plugin Manager

If requests to a website from SPM could be denied by a WAF (web application firewall), you may need to add SPM requests to the allowed list. Those requests will contain the header named autoupdater.

Stackpath WAF

Create a custom WAF rule with the WAF rule editor

  • Under Rule Type, select WAF.
  • Next to IF, select a rule type Header.
  • In the next drop-down menu select — to apply the rule only to the specified header.
  • In the field, enter the header key autoupdater
  • In the next drop-down menu select Contains.
  • In the field, enter the header value . (dot).

Learn more about Stackpath WAF rules.

Cloudflare WAF

Add a rule to allow access by header name:

any(http.request.headers.names[*] == "autoupdater")

Alternatively, add a rule to allow access by URI:

any(http.request.uri.args["autoupdater"][*] == "api") or any(http.request.uri.args.names[*] == "autoupdater_nonce")

Learn more about Cloudflare WAF rules.

NEXT STEP: Learn how to upgrade your PHP version

Automatically update plugins

WP Engine's Smart Plugin Manager keeps your site secure by updating plugins for you. It also uses visual regression to automatically revert to a backup if an update causes issues.