WP Toolkit is a premium WordPress management interface built into cPanel on Cynet WordPress Hosting plans. It provides a centralised dashboard to install, update, secure, stage, and manage every aspect of your WordPress site — without needing to log in to the WordPress admin panel.
On a Business Hosting plan? WP Toolkit is not available on Business plans. Use Softaculous instead — see How to Install WordPress Using Softaculous.
Accessing WP Toolkit
- Log in to cPanel (
yourdomain.com/cpanel) - Look for WP Toolkit — it's usually pinned in the cPanel sidebar or found under the Domains section
- Click WP Toolkit to open the management dashboard
WP Toolkit Dashboard Overview
The main dashboard shows each WordPress site with:
- Site name and URL
- WordPress version (with update indicator if outdated)
- SSL status — Whether HTTPS is active
- PHP version — The PHP version assigned to the site
- Plugin/Theme update counts — Number of available updates
- Security status — Whether security hardening is applied
Installing WordPress via WP Toolkit
New Installation
- In WP Toolkit, click Install
- Configure the settings:
- Click Install
Import Existing Installation
If WordPress was installed manually or via another tool:
- Click Scan in WP Toolkit
- WP Toolkit will detect existing WordPress installations
- They'll appear in the dashboard and can be managed normally
Updating WordPress
One-Click Updates
- On the WP Toolkit dashboard, look for the Update badges on your site card
- Click Update to see available updates for:
- Select what to update and click Update
Smart Update (Safe Update)
WP Toolkit's Smart Update feature tests updates before applying them:
- Click Update on a site card
- Enable Smart Update if available
- WP Toolkit will:
- If everything looks good, click Apply to push the update to live
Auto-Updates
- Click on your site card to expand it
- Go to Updates Settings
- Configure:
- Save settings
Security Hardening
WP Toolkit includes a security scanner that checks your WordPress installation and applies fixes.
Run Security Check
- Click on your site card
- Click Security → Check Security
- WP Toolkit scans for common vulnerabilities and displays results
Apply Security Fixes
Common security measures WP Toolkit can apply:
| Security Measure | What It Does |
|---|---|
| Block directory browsing | Prevents visitors from listing folder contents |
| Restrict access to files | Protects wp-config.php, .htaccess, etc. |
| Block PHP execution in uploads | Prevents malicious scripts in /wp-content/uploads/ |
| Change database table prefix | Changes the default wp_ prefix for security |
| Block author scans | Prevents username enumeration via ?author=1 URLs |
| Disable XML-RPC pingbacks | Prevents abuse of the XML-RPC endpoint |
| Disable file editing in Dashboard | Removes the Theme/Plugin Editor from WordPress admin |
Staging and Cloning
Create a Staging Site
- On the site card, click Clone or Create Staging
- Choose a staging subdomain (e.g.,
staging.yourdomain.com) or subdirectory - Click Create
- WP Toolkit creates an exact copy for testing
Push Staging to Live
After testing changes on the staging site:
- Open the staging site in WP Toolkit
- Click Copy Data
- Choose the live site as the destination
- Select: Files, Database, or Both
- Review and confirm — staging changes are pushed to the live site
Sync Live to Staging
To refresh your staging site with the latest live data:
- Open the staging site card
- Click Copy Data with the live site as the source
- This overwrites staging with fresh live data
Backup and Restore
Create a Backup
- On the site card, click Back Up/Restore → Back Up
- WP Toolkit creates a full backup (files + database)
- Backups are stored and listed in the backup manager
Restore a Backup
- Go to Back Up/Restore
- Select the backup to restore
- Click Restore
- Confirm — the site reverts to the backup state
Managing Plugins and Themes
From the WP Toolkit Dashboard (No WordPress Login Needed)
- Click on your site card to expand it
- Switch to the Plugins or Themes tab
- From here you can:
This is especially useful if a plugin has broken your site and you can't access the WordPress admin panel — you can deactivate it from WP Toolkit.
Changing PHP Version
- Click on your site card
- Find the PHP version displayed on the card
- Click it to change the PHP version
- Select the desired version (e.g., 8.1, 8.2, 8.3)
- Save — the change takes effect immediately
Tip: Always use the latest PHP version supported by your WordPress theme and plugins for best performance and security.
Troubleshooting
WP Toolkit not showing in cPanel
WP Toolkit is exclusive to WordPress Hosting plans. If you're on a Business, Premium, or other plan, use Softaculous instead. Check your plan type in the Cynet client area at manage.cynet.com.my → My Services.
"No WordPress installations found"
Click Scan to detect existing installations. If WordPress was installed in a non-standard location, WP Toolkit may need a manual scan to find it.
Plugin broke the site — can't access WordPress admin
- Open WP Toolkit → click on the site card
- Go to the Plugins tab
- Deactivate the problematic plugin
- Your site should be accessible again
- Investigate the plugin issue before reactivating
Update caused errors
- If Smart Update was used, the update wasn't applied to live — no action needed
- If a direct update caused issues, restore the pre-update backup from WP Toolkit → Back Up/Restore
- Test the update on staging first before trying again