WordPress Fleet Management Platform
One control centre for WordPress sites spread across many WHM/cPanel servers
Project Overview
WordPress Fleet Manager is an internal ZsTechLabs tool. It is a Laravel control centre that manages WordPress installations across many WHM/cPanel servers over SSH, and it sits on top of WP Toolkit's CLI and WP-CLI. From one dashboard an operator can discover sites and apply core, plugin and theme updates. The same dashboard handles maintenance mode, security checks, backups, database optimisation and cache clearing, on one site or across whole servers. Every command is queued, audited and permission-checked. The tool was designed for fleets that span hundreds of servers.
Skills Applied
The Challenge
Looking after a large number of WordPress sites means logging in to one cPanel account after another and repeating the same updates, checks and backups by hand. Every server has its own credentials. A plugin update that has to go out everywhere becomes an afternoon of clicking, and nothing records who ran what, where, or with what result. Running shell commands on production servers from a web app brings its own risks: credentials stored in plain text, commands built from unescaped input, a failed job quietly retried until it applies a change twice, and anyone with a login able to run anything.
Our Solution
We built the platform in Laravel 12 with a Filament v4 admin panel. A reusable SSH layer built on phpseclib3 (pure PHP, so the ext-ssh2 extension is not needed) supports key or password authentication. It enforces timeouts and retries at the transport level, but only for transient failures. WP Toolkit and WP-CLI commands are assembled by dedicated command builders that escape every argument for a POSIX shell, and those builders have their own unit tests. Actions are queued jobs. Bulk operations fan out as Laravel job batches, and the whole run shares a batch ID. Changing actions run with a single try, so a failed change is never silently repeated. Every run is stored as a command execution record with the command, output, exit code, duration and status. SSH passwords, private keys and key passphrases are encrypted at rest with Laravel's encrypted casts. Access follows four roles (super admin, admin, operator, viewer) with per-action permissions. Sign-in supports optional multi-factor authentication using an authenticator app, recovery codes or email. Website actions go through a command-proposal workflow. Read-only commands are approved automatically, while changing commands wait for a second person. The approver sees a preview with secrets redacted, and no one can approve their own proposal. A token-authenticated, rate-limited REST API mirrors the dashboard for automation.
Technical Stack
The technologies and tools we used to build this solution
Frontend
Backend
APIs & Libraries
Infrastructure
Key Features Implemented
Core functionality and technical implementations
Server Inventory Over SSH
WHM/cPanel servers are added with key or password authentication, then grouped, tagged, connection-tested and health-checked on a schedule.
WordPress Discovery & Sync
A server is scanned through WP Toolkit to register its installations. The platform syncs WordPress and PHP versions, plugins, themes, SSL, maintenance state and available updates.
Execution Engine With Retries
Commands run through a phpseclib3 executor that applies timeouts and retries transient failures. Changing actions run once, so a failed change is never re-applied behind the operator's back.
Queued Bulk Batches
Updates, scans and health checks fan out across many sites or servers as job batches. Each run records its batch ID so it can be traced from start to finish.
Encrypted Credentials & MFA
SSH passwords, private keys and passphrases are encrypted at rest. User accounts support authenticator-app, recovery-code and email multi-factor authentication.
RBAC, Audit Log & REST API
Four roles with per-action permissions, a full activity and command-execution history, approval for changing commands, and a token-authenticated REST API.
Results & Impact
What this project achieved
- Core, plugin and theme updates run from one dashboard, on a single site or across whole servers, without logging in to each cPanel account
- Every remote command leaves an audit record with its command, output, exit code, duration and who triggered it
- SSH credentials are never stored in plain text; they are encrypted at rest in the database
- Changing actions are never retried automatically, so a failed update is not silently re-run
- Operators can only do what their role allows, and no one can approve their own changing command
- Dashboard operations are mirrored by a token-authenticated REST API, so fleet tasks can be scripted