Black Friday: 50% off. Your first year on any annual plan, until 1 December. See the dealFirst year on annual plans, until 1 December
WPClientHub V2 is live. Fewer plugins on your client sites: caching, forms and image optimization now come built into WPClientHub One. See what’s newCaching, forms and images, built in. See what’s new
WPClientHub
Start free
Sign in Start free

← Docs  /  Reference

Changelog

Reference Updated 2026-10-08

Every release in plain language: the private beta in August 2026, V1 in September and V2 in October 2026.

Browse documentation

V2 — October 2026

V2 is the biggest release since launch. The plugin on your clients’ sites becomes WPClientHub One 2.0 and takes over jobs that used to need a stack of plugins — page caching, SEO, forms and image optimization — each switched on from your dashboard and run on the client’s own server. Most of October’s other work ships with it.

What’s new in V2

  • 2026-10-08 — WPClientHub One 2.0.1. A fix release for the plugin on your clients’ sites. If an update of the plugin ever fails to load, the site now puts the previous version back on the same request instead of showing an error. SEO changes made in WPClientHub clear the page cache right away, so visitors and search engines see the new title and description at once. Disconnecting a site switches its page cache off. A failed plugin, theme or WordPress update now says why — for example that the host does not let WordPress write its own files, and how to fix that. Image optimization is now off until you turn it on for a site: sites where nobody had saved image settings are switched off by the update, and settings you saved are kept. Roll it out from Updates → Plugin, canary sites first.
  • 2026-10-08 — WPClientHub One 2.0. The plugin on your clients’ sites is no longer just a connector, so it has a new name: WPClientHub One. Version 2.0 carries page caching, SEO management, forms and image optimization alongside updates, backups, security and monitoring — one plugin doing the work of a stack, all on the client’s own server. It is the same plugin in the same folder with the same settings and pairing, so nothing needs reconnecting: roll it out from Updates → Plugin in waves, canary sites first. Nothing new switches on until you turn it on, and on Agency and Scale your white-label name still shows instead. See Connect your first site.
  • 2026-10-08 — Caching (every plan). Each site’s Performance tab gets a Caching card: switch on a full-page cache that runs on the client’s own server inside the WPClientHub One plugin — pages for visitors who are not logged in are stored once and answered by an advanced-cache.php drop-in before WordPress loads, or on Apache and LiteSpeed by the web server itself through self-checked .htaccess rules (nginx gets a snippet). Never cached: logged-in visitors, WooCommerce and EDD sessions and their cart, checkout and account pages, password-protected and private posts, previews, search, feeds, POST requests, redirects, error pages, pages that define DONOTCACHEPAGE, and any path or cookie you exclude. Smart purge: a post, page, comment or term change purges its page, the front page and its listings; theme, plugin, menu, widget, Customizer and core changes purge everything; and WPClientHub purges everything on its own after an update batch, a restore or rollback, a database cleanup and an image run — the site’s own cache, WP Rocket, LiteSpeed Cache, W3 Total Cache, WP Super Cache, WP Fastest Cache, Cache Enabler, Breeze and Speed Optimizer where one of those is active instead (then WPClientHub’s cache stays off and says who handles it), the host cache on Kinsta, WP Engine and Pantheon, and the Cloudflare zone on Scale. After a full purge the site warms its pages again in the background. The card shows the share of page views served from the cache over seven days, pages cached and their size, Purge all and Purge URLs, the settings (expiry, phone copies, browser caching and compression rules, optional HTML minify and script defer, exclusions, bypass cookies, ignored query parameters) and the site’s purge log; the Overview’s Performance card carries one line; client reports print “Cache: 90% of page views were served from the cache this week”; the Activity Log records every purge with its reason. Public API on Scale: GET /api/v1/sites/{site}/cache and POST /api/v1/sites/{site}/cache/purge. Switching off, deactivating or uninstalling the plugin removes the drop-in, the WP_CACHE line it added, its .htaccess block and the cached pages; the drop-in fails open without the plugin. Multisite is not supported yet. Sites need WPClientHub One 2.0. See Caching.
  • 2026-10-08 — SEO management (Studio and above). The SEO tab gains four sections next to Health. Pages: every published page with its title and meta description as the page actually gets them, length meters, noindex/nofollow, canonical and social-sharing fields — edited inline or in bulk, and written into Yoast SEO, Rank Math, All in One SEO or SEOPress’s own fields when one of them runs the site, so their editor, output and sitemap keep working and nothing is ever printed twice; on a site with none of them the WPClientHub One plugin keeps the fields and prints the tags. A save carries the values you saw, so a change made in wp-admin in between is a conflict, never an overwrite; every change keeps what it replaced, with Undo. Draft with AI writes a title and description from the page’s own text for one AI credit and never saves by itself. Redirects & 404s: 301/302/307/308/410 redirects with hit counts, CSV import and export, loops refused before anything is sent, and the site’s 404 log (the 500 newest, grouped, no IP addresses) with a one-click redirect. Sitemap & robots: a plugin’s sitemap is linked and left alone, WordPress’s own is tuned; a robots.txt editor that reads the text like a crawler, shows a diff, and refuses to block the whole site unless you confirm it twice; the list of pages hidden from search with key pages flagged. Schema: one JSON-LD graph (website, organization or local business, article, breadcrumbs) printed only where no plugin prints one. Activity Log lines name the fields changed, never the values; client reports get “SEO changes this period”; the public API gets GET/PATCH /api/v1/sites/{site}/seo/pages and GET/POST …/seo/redirects under new seo:read and seo:write scopes. Nothing is deleted on a downgrade. Needs WPClientHub One 2.0. See SEO management.
  • 2026-10-08 — Forms (Agency and above). Build the contact, quote, callback and sign-up forms your clients’ sites need in WPClientHub and publish them to each site through the WPClientHub One plugin: a drag-and-drop builder with seventeen field types (text, email, phone, website, number, paragraph, dropdown, radio, checkboxes, date, time, hidden values, file upload, consent, heading, text block, page break), conditional logic (show, hide or require a field by other answers — all or any of up to ten rules — decided on the server, not only in the browser), multi-step forms with a progress indicator, file uploads checked by their contents and kept in a web-denied folder on the site, spam protection on by default (honeypot, signed time-to-submit, a per-visitor rate limit) plus optional Cloudflare Turnstile, hCaptcha or reCAPTCHA, notifications with merge tags and Reply-To the visitor, an autoresponder, and a confirmation message or redirect. The markup is accessible, the stylesheet inherits the theme, there is no jQuery and the form works without JavaScript. Four templates to start from; a live preview in the builder; the draft saves itself and nothing reaches the site until you publish. Add a form to a page with [wpclienthub_form id="…"] or the new Form block. Every entry lands in a new Forms inbox across all your sites — filters, search, read/spam, one-time file downloads, CSV export, Create help-desk ticket from entry, and a per-form “Alert my team” switch that goes through your email, Slack and webhook routes. Entries of Gravity Forms, WPForms (paid), Fluent Forms, Contact Form 7 with Flamingo and Ninja Forms are read into the same inbox, read-only; where a plugin keeps no entries on the site we say “installed, entries unavailable” rather than guess. The Activity Log and client reports carry counts only (“N form submissions”), never an answer. GET /api/v1/sites/{site}/forms and …/forms/{form}/entries under a new forms:read scope, and the webhook event form.entry_received. Below Agency, published forms keep working on the sites and keep storing entries there; the hub stops collecting them and nothing is deleted. Needs WPClientHub One 2.0. See Form builder and Entries inbox, tickets & export.
  • 2026-10-07 — Image optimization (Agency and above). Each site gets an Images tab: compress every JPEG and PNG in the media library — the served full size and every registered size — strip metadata (the orientation is applied first), give oversized uploads a -scaled copy the way WordPress does, and write WebP and AVIF copies next to each file, served to browsers that accept them through rewrite rules in uploads/.htaccess (checked with a request to the site; Vary: Accept) or, on nginx and hosts where the rules don’t take, by turning <img> tags into <picture> on the page, with an nginx snippet to paste. Everything runs on the client’s own server with its Imagick or GD — no third-party service, no CDN, nothing leaves the site; the tab says when AVIF isn’t available on a host. Lossy (quality of your choice, default 82) or lossless, new uploads optimized as they arrive, an optional nightly run, and Optimize all images with live progress and Stop. Every file changed is kept first in a protected folder on the site, so one image or all of them can be put back. Smush, ShortPixel, Imagify, EWWW, Optimole and TinyPNG are detected — the site shows as handled by them, with their own savings where they publish them, and WPClientHub stays off unless you say otherwise. Totals in the Overview card, the Activity Log, client reports (“Images optimized”) and GET /api/v1/sites/{site}/images. Linked Cloudflare sites are purged after a run. Nothing is deleted on a downgrade; the originals stay for restore. Needs WPClientHub One 2.0. See Image optimization.

Also in V2

  • 2026-10-07 — Site notes (every plan). Each site now keeps your team’s own notes about it — client preferences, access details, hosting quirks, history — in a Notes card on the Overview tab and a new Notes tab with search. Notes are plain text (links are clickable) with who wrote them and when; pin up to 5 per site and they show under the site’s header, above the update buttons on its Updates tab, and next to its batches in the Updates approval queue, so “ask Priya before updating WooCommerce” is read before anyone presses the button. The Sites list shows a note icon with a count (hover for the newest pinned note) and its search matches note text. Owners and Admins edit any note, Techs their own, Viewers read. Notes are internal: never in client reports, the portal, help desk replies, AI diagnosis or the API; the Activity Log keeps who changed what with an excerpt of at most 80 characters. They aren’t a password vault — a hint says so when a note looks like a password or key. See Site notes.
  • 2026-10-07 — Public API, webhooks and a Zapier app (Scale). A versioned REST API at /api/v1 reads your sites (health score, plugin version, pending updates, last backup, uptime), update batches, restore points, incidents, security findings, clients, tickets, client reports and the Activity Log, and starts a sync, an update check, a backup or a safe update batch through the same safeguards as the app — nothing in v1 deletes, restores or disconnects. Keys live in Settings → API keys: scoped, optionally expiring, shown once and stored as a fingerprint, with last use and a limit of 120 requests a minute each. Settings → Webhooks sends signed events (X-WCH-Signature, HMAC-SHA256 with a timestamp) for downtime and recovery, backups, updates, new vulnerabilities, tickets and expiring domains, retried for about a day, with a delivery log and a test button. The Zapier app is invite-only until Zapier lists it. An OpenAPI 3.1 spec describes every endpoint; see the API docs. Notification-route webhooks now carry the same X-WCH-Signature header too.
  • 2026-10-07 — Client emails from your own domain (Agency and above). Settings → Email sending takes an address at your domain — say support@youragency.com — and a display name, and shows the DNS records to add: a DKIM key (required), a Return-Path CNAME, your SPF record with ours merged in (never a second SPF record, with a warning before it passes the 10-lookup limit) and a DMARC record at p=none if you have none. Once the DKIM record checks out, client reports, help desk sign-in links and invitations, request updates, estimates and their reminders, invoices and payment reminders go out from your address, signed for your domain; replies go to your reply-to address. Each record shows Verified, Waiting or Failing, with Check now; new domains are checked hourly for a week, verified ones daily. If a record breaks, client emails go back to our address at once (your name, replies to you) and you get an alert after a second check. A preview shows From and Reply-To for every client email, and a test email goes to you through the same pipeline. Emails to your team never change. Leaving Agency sends client emails back to our address and keeps the domain. See Client emails from your own domain.
  • 2026-10-06 — White-label plugin (Agency and above). Settings → White label shows the WPClientHub One plugin under your agency’s name on every connected site: its name, description, author and link on the Plugins screen and in Dashboard → Updates, your menu label under Settings or as its own menu item with a Dashicon or your own SVG icon (sanitized, never loaded from anywhere), your support link or email, and “WPClientHub” replaced in the plugin’s own notices if you want. You can hide it from the Plugins list — and its Deactivate and Delete links — for everyone except one WordPress login you name. A site’s administrator can always show it again with define( 'WPCH_SHOW_CONNECTOR', true ); in wp-config.php, WP-CLI always lists it, and we tell you when a site has done that. A live preview shows the Plugins row and admin menu before you save; each site shows applied, pending, not applied or plugin too old. Leaving Agency puts every site back on the standard plugin and keeps your settings. Needs the WPClientHub One plugin 0.13.0. See White-label WPClientHub One.
  • 2026-10-06 — Google Drive & Dropbox backup destinations (Studio and above). Connect your agency’s own Google Drive or Dropbox in Backups → Offsite storage and choose it on a site’s new Schedule & offsite copy panel; each site then uploads its backups straight there, never through WPClientHub. WPClientHub asks only for Google’s drive.file permission (the files it creates) or a Dropbox App folder, keeps the grant encrypted, and gives each backup a token used for an hour at most. Uploads go in resumable 8 MB chunks and are checked against Google’s or Dropbox’s own checksum; the newest 30 backups per site are kept (adjustable); restore downloads them back when the site no longer has them. A connection that stops working is marked “Needs reconnecting” and alerts once; storage over 90% full is flagged. Moving below Studio stops new uploads but keeps the backups and the restores. S3-compatible storage and SFTP stay on every plan. Needs the WPClientHub One plugin 0.12.0. See Google Drive & Dropbox backups.
  • 2026-10-06 — WordPress user management (Studio and above). Sites → WordPress users lists every WordPress account on every connected site, grouped by person, with their role on each site, last sign-in and two-factor status. Add someone to several sites with a role (WordPress’s set-password email, or a one-time password shown once and never stored), change a role, remove someone with their posts and pages handed to a user you pick on each site, send a password reset or sign someone out everywhere — with a summary to confirm first and a result per site. A site’s last administrator is never removed or demoted. Each site also has a Users tab. On every plan, the Security report now flags administrators called “admin”, “administrator” or “test” and administrators unused for 90 days. Needs the WPClientHub One plugin 0.11.0, which also starts recording last sign-in. See WordPress user management.
  • 2026-10-06 — Database cleanup (every plan). Each site now has a Database card: the database size, the free space in its tables, and what a cleanup can remove — old post revisions (the newest 5 of each post are kept), auto-drafts, trash and spam older than 7 days, orphaned post and comment data, orphaned category links, expired transients and, if you ask, oEmbed caches. Clean now takes a restore point first when the site has backups and does nothing if that backup fails (unless you choose to run without one); rows go in batches of 500 through WordPress’s own delete functions; tables are optimized only when that really frees space. Schedule it weekly or monthly per site. Each cleanup is one line in the Activity Log and in client reports (“removed 1,240 revisions and 3,200 expired transients — 48 MB smaller”). Needs WPClientHub One 0.10.0. See Database cleanup.
  • 2026-10-06 — Domain & DNS expiry monitoring (every plan). Every site’s domain is now checked daily: the expiry date, registrar and status flags straight from the registry’s RDAP service, and its nameservers, addresses, www and mail servers. Emails at 30, 14, 7, 3 and 1 days before it expires and on the day; straight away if it goes on hold, pending delete or redemption; and when its nameservers change or the site’s address is replaced (confirmed by a second look first). Each site has a Domain card with Check again, Sites has a new Domains tab sorted by soonest expiry, the Security report has a Domain registration row, and client reports carry the expiry date. Registries that don’t publish expiry dates are labelled as such — we never guess. See Domain & DNS expiry monitoring.
  • 2026-10-06 — Cloudflare integration (Scale). Connect your own Cloudflare account with a scoped API token in Settings → Integrations and link each site to its zone (found by domain, or picked by hand). The cache is purged automatically after safe updates, rollbacks and restores; each site gets a Purge cache button and a Development mode switch; SSL mode, Always Use HTTPS, proxy status and edge-certificate coverage are checked daily and appear in the Security report; and requests, cache hit rate, bandwidth saved and threats blocked appear on the site page and in client reports. We don't proxy traffic or sell Cloudflare plans, and Cloudflare's free plan works. See Cloudflare integration.
  • 2026-10-05 — New pricing. Studio is $19/mo, Agency $49/mo and Scale $99/mo (yearly is still two months free); Scale now includes unlimited sites under fair use. The client Help Desk and client portal are part of Agency and Scale, and every new account starts on a 14-day Agency trial so you can try them before you pick a plan. Organizations that already used the Help Desk keep it on their current plan. See Your WPClientHub plan & billing.
  • 2026-10-03 — Daily file-integrity check. With WPClientHub One 0.9.0, every site's WordPress core and WordPress.org plugins are checked daily against the official checksums, along with PHP in uploads, dropper folders, unknown PHP in the web root and unknown must-use plugins. Newly connected sites are checked within minutes. See File integrity, protection & response.
  • 2026-10-03 — Respond from the dashboard. Reinstall WordPress core or a plugin from WordPress.org, quarantine a suspicious file (restorable), rotate the security keys, mark a must-use plugin as yours, and see the last known-clean restore point and a 30-day security timeline.
  • 2026-10-03 — Hardening on by default. PHP can't run from the uploads folder and the wp-admin file editor is off on every site running 0.9.0; both can be switched per site.
  • 2026-10-03 — Stronger login protection. Repeat offenders are locked out for 24 hours, a username being guessed from many addresses is locked for unknown IPs, and refused attempts are logged as blocked rather than as failed passwords.
  • 2026-10-03 — Security alerts. A new alert kind for new suspicious files, password-guessing bursts, a sign-in right after a run of failures and new administrator accounts.
  • 2026-10-03 — Blank pages count as down. Uptime checks now treat an empty page or a WordPress error page served with a 200 as an outage.
  • 2026-10-03 — Stale health scores. A disconnected site, or one that hasn't synced for 48 hours, shows its score as Stale instead of a green number; disconnected sites send reminders at 1, 3, 7, 14 and 30 days.
  • 2026-10-03 — One-click connect. Connect or reconnect a site from its wp-admin with one button — no code to copy — and reconnect a site whose address changed.

V1 — September 2026

  • 2026-09-11 — A free plan and a 14-day trial. Free for up to three sites with 20 AI credits a month, and every new agency starts on a 14-day trial of a paid plan, no card needed.
  • 2026-09-10 — SEO Health, AI Visibility and Search Console. Technical and on-page SEO scans with a score for each category, AI Visibility (what ChatGPT, Claude and other assistants can read and say about a business), Search Console connect with up to 16 months of history, and a white-label PDF for each — plus Security and Performance reports you can hand straight to a client. See SEO Health.
  • 2026-09-07 — Client billing without Stripe Connect. Billing Suite no longer uses Stripe Connect. Connect your own Stripe account by pasting a restricted API key (Billing → Payments & Stripe), or use direct invoicing with no processor at all: numbered PDF invoices (INV-2026-0001), your own payment instructions and an optional payment link, mark-paid, and a new invoice issued automatically every subscription period. Clients see and pay invoices in the client portal. 0% platform fee on every plan, Free included.
  • 2026-09-07 — AI credit top-ups are live. Buy 100 credits for $9 or 500 for $39 from Settings → AI usage on any plan; credits land the moment Paddle confirms the payment, are spent after your plan credits, and never expire.
  • 2026-09-07 — Automatic rollback. A new per-policy switch on scheduled updates (auto mode): when the visual diff crosses the threshold, the site is restored to its pre-update restore point automatically while the batch waits for your review with the before/after pair attached. Off by default; every rollback is logged and sends an "update rolled back" alert.
  • 2026-09-07 — Refreshed marketing site. New home, features and pricing pages describing all fifteen modules; the docs nav now lists them too.
  • 2026-09-06 — Two-factor sign-in and help chat. Two-factor authentication and session management, keyboard shortcuts, onboarding and weekly digests, and a help chat that answers from these docs and hands over to a person.
  • 2026-09-05 — Documentation. This site — real docs generated from the product and its code, replacing a dead link from the Help panel.
  • 2026-09-05 — Security findings redesign. One row per finding (no grouping), with a "How to fix" panel and an "Ask AI to diagnose" option.
  • 2026-09-05 — AI credits. A visible, ledgered credit system replacing a hidden daily spend cap — balance, usage history, top-ups.
  • 2026-09-05 — In-row update progress. The Updates tab shows live per-row progress and a Retry on failure instead of a spinner that cleared before the batch actually finished.
  • 2026-09-05 — One health-score threshold. The Sites list, its stat tiles, and the health-score drawer now always agree, because they all read the same number.
  • 2026-09-05 — Uptime periods. 24h/7d/30d/90d/12mo/custom periods, MTTR, per-region breakdown, SLA target, and a real fleet-wide Uptime page.
  • 2026-09-05 — Notification routes. Route any alert to an external email, Slack channel, or webhook — beyond each person's own preference.
  • 2026-09-05 — Branded error pages, one designed confirm dialog, and consistent list filters/pagination/exports across Sites, Security, Backups, Billing and Help Desk.
  • 2026-09-05 — Attachment limits actually work in production — images up to 10 MB and videos up to 100 MB now upload successfully, with a friendly message if you go over.
  • 2026-09-03 — Client help desk and client portal. Clients send requests through a magic-link portal; each request arrives with an AI diagnosis of the site, and you can attach a fix estimate. See Help Desk.
  • 2026-09-01 — One-click restore. Put any backup back onto the site from the dashboard, with a safety copy of the current state taken first, and offsite copies that land in your own bucket. See Restoring a site.

Private beta — August 2026

  • 2026-08-31 — The plugin updates itself, in waves. Roll a new plugin version out from the hub: canary sites first, then waves, with a halt button and a one-click way back to the previous version.
  • 2026-08-30 — Activity Log. One log of what happened on every site and who did it.
  • 2026-08-27 — Teams and Pulse. Invite your team with roles, per-person notifications, a command palette, a health-score breakdown, and Pulse performance checks.
  • 2026-08-27 — Private beta opens. Safe updates with a restore point taken first and before/after screenshots (AutoPilot), backups kept on the client’s own server with offsite copies to S3-compatible storage and a standalone restore script, uptime monitoring with incidents (Watchtower), vulnerability scanning and hardening (Sentinel), client billing, white-label client PDF reports, and the plugin with signed requests and one-time pairing codes. Invite only.

How to read this

Newest first, grouped by release. For the engineering-level detail behind any item, ask WPClientHub support and quote its date.