See WordPress updates across all sites

The WordPress updates page lists every WordPress site on the master and on every enrolled node, and sorts each one by what it needs from you. It reads the results of each node’s nightly sweep. It does not scan anything by itself.

Before you start

• You hold the View WordPress vulnerability scans permission with access to all hostings. Owners and Administrators have both. A user who only sees some hostings is sent to the dashboard with the message “admin role required”, and the sidebar entry stays hidden.
• To act on a row you also need the Manage WordPress (plugins, staging, …) permission. Without it you see the rows and no buttons.
• Nodes are enrolled and reachable. A node that does not answer is named in a warning and its sites are not listed.

Steps

1. Open WordPress updates in the sidebar, in the Security group. A dot beside it shows a red number when sites are waiting on you, and is green when none are.
2. Read the line under the page title. It is the fleet verdict, one of:
   • <n> sites need you — ... with the reasons, such as 1 major update, 2 paused plugins and 3 updates held back by auto-update off.
   • Nothing waits on you, but <n> sites couldn't be checked.
   • Nothing needs you — <n> updates are applied by the next sweep.
   • All <n> WordPress sites are up to date.
   • Each ends with · last checked <time>.
3. Filter with the Search — site, plugin or theme… box, the Node selector (shown when more than one node has sites), and the segment buttons All, Needs you, Couldn’t check, Updating itself and Up to date. Each shows a count.
4. Open a site’s row to see its components. The row summary shows a state pill, the domain, the node, the first component that matters, when it was checked and whether auto-update is on.
5. In the fold, each outdated item has the same button as on the site’s own Updates row: Update for a plugin or theme, Update to <version> for core. Core updates take a full backup first and run as a job. See Update WordPress, plugins and themes.
6. Click Open the site’s Updates → to go to the site’s WordPress tab. Auto-update is switched there.

What the states mean

• Needs you: a major update, an update held back because the site’s auto-update is off, or a plugin whose automatic updates are paused after repeated failures. These never apply themselves.
• Couldn’t check: the last scan could not read the site (Couldn't read the site), the nightly sweep has not reached it yet (Not checked yet — the nightly sweep reaches it within a day.), the last good scan is more than two days old (Not checked for <n> days — the nightly sweep is not reaching this site.), or the node’s agent is too old to say whether a minor update applies itself. A site that needs you stays under Needs you even if the last check failed.
• Updating itself: same-major updates that the next sweep applies. A component that failed in an earlier sweep reads failed <n> times — tried again in the next sweep.
• Up to date.

Every node sweeps its own sites once a night, between 02:00 and 06:00 server time. Opening a site’s WordPress tab checks it again on the spot and saves the result, so this page stops listing an update that was applied by hand.

Check that it worked

After you update a plugin or theme here, you return to this page with a message such as Plugin ok: .... Hyperion re-scans the site for up to 15 seconds before it redirects. If the scan takes longer, the message adds “The site is still being re-checked; reload in a minute.” The site moves to a lower bucket and its count in the segment buttons drops.

If it fails

• “Incomplete view. <node> didn’t answer — its sites are not listed.”: that node is offline or unreachable. Check Nodes in the sidebar.
• “No WordPress sites yet”: no site in the cluster has WordPress, installed by Hyperion, imported or uploaded.
• A site stays under Couldn’t check: open its WordPress tab. The Updates row prints the reason, for example a broken install. See Repair a broken WordPress site.