How to use WP Toolkit in cPanel to manage WordPress

Category: cPanel

WP Toolkit is the unified WordPress administration console inside cPanel. It lets you install, clone, back up, update, harden and migrate sites without touching FTP, phpMyAdmin or the WordPress admin. This guide covers the most useful day-to-day operations.

Before you start

  • Access to the domain’s cPanel (NubeHost plan with WP Toolkit enabled).
  • Know which domain or subdomain you want to operate on.
  • Prior backup if you are touching a production site.
  • Admin permissions on the WordPress site (for Smart Updates and full hardening).

Where to find it

  1. Log in to cPanel.
  2. In the search bar type WP Toolkit.
  3. Open the tool — you’ll see all WordPress installs detected on your account.

Note: WP Toolkit auto-detects any WordPress install, including ones uploaded manually via FTP. If your site doesn’t show up, click Scan.

Install a new WordPress

  1. Click Install (top right).
  2. Configure:
    • Installation Path: domain or subdomain.
    • Website title: visible name.
    • Plugin/theme set: leave “None” for a clean install.
    • Admin username: NEVER use admin — pick something unique.
    • Admin password: generate one with the button (minimum 16 chars).
    • Admin email: real account, not admin@domain.
    • Language: English or your target language.
    • Version: latest stable (default).
    • Database name and table prefix: change wp_ to something like wpx7_ (safer).
  3. Click Install.
  4. In 30–60 seconds you’ll have a working site.

Clone a site (staging)

Create an exact copy to test updates without risking production.

  1. On the site card click Clone.
  2. Pick the destination:
    • Existing subdomain: e.g. staging.yourdomain.com.
    • Create new subdomain: WP Toolkit creates it for you.
  3. Confirm the path (/staging/ or dedicated subdomain).
  4. Click Start.
  5. When done (1–5 min), open the clone and verify it loads.

Important: the clone inherits the original’s robots.txt. To prevent Google from indexing staging, go to Settings → Reading → Discourage search engines and check it.

Sync changes from staging to production

After testing on the clone:

  1. On the cloned site click Copy Data.
  2. Pick the destination (production) and what to copy:
    • Files only: just files (plugins, themes, uploads).
    • Database only: just the DB.
    • All data: both (careful: overwrites recent production content).
  3. WP Toolkit takes an automatic backup of the destination before copying.

Mass updates (core, plugins, themes)

  1. In the site list check the boxes of those you want to update.
  2. Click Updates.
  3. WP Toolkit shows:
    • Core updates available.
    • Outdated plugins.
    • Outdated themes.
  4. Pick what to update and confirm.

Smart Updates silently clones your site, applies updates on the clone, runs visual tests and only applies to production if everything is OK.

  1. On the site card enable Smart Updates (button at the bottom).
  2. WP Toolkit will make a temporary clone for every update, compare screenshots and roll back if it detects issues.
  3. It’s the safest way to apply updates without downtime.

Backups and restore

Create a manual backup

  1. On the site card open the Backup/Restore tab.
  2. Click Back Up.
  3. WP Toolkit saves a compressed copy (files + DB) on your account.
  4. It keeps the last N backups according to your quota.

Schedule automatic backups

  1. In Backup/Restore click Schedule.
  2. Configure frequency (daily, weekly, monthly) and retention (how many copies to keep).
  3. Enable Email notifications to get alerted on failure.

Restore

  1. In Backup/Restore pick the desired backup.
  2. Click Restore.
  3. WP Toolkit takes a backup of the current state before overwriting (automatic rollback if the restore fails).

Hardening (security lockdown)

Out-of-the-box WordPress has several attackable surfaces. WP Toolkit applies hardening with one click.

  1. On the site card open Security.
  2. Click Check Security.
  3. WP Toolkit lists 15+ measures:
    • Block PHP execution in wp-content/uploads/.
    • Disable file editor in admin.
    • Protect wp-config.php.
    • Hide WordPress version.
    • Block directory listing.
    • Force HTTPS.
    • Block xmlrpc.php if you don’t use Jetpack/mobile apps.
    • Restrict login by IP (optional).
  4. Click Secure to apply all or pick individually.

Important: some measures (like blocking xmlrpc.php) break functionality if your mobile app/Jetpack needs it. Read the description before applying.

Migrate an existing site

Move a WordPress hosted with another provider to NubeHost without downtime.

  1. In WP Toolkit click Migrate.
  2. Pick Transfer an existing website.
  3. Enter:
    • Source URL: the original site URL.
    • SSH/FTP credentials of the source (WP Toolkit handles everything automatically if you provide them; otherwise it walks you through step by step).
  4. Configure the destination: domain/subdomain on NubeHost.
  5. WP Toolkit:
    • Copies files via SSH/FTP.
    • Exports the database.
    • Rewrites internal URLs (from old-domain.com to new-domain.com).
    • Brings the site up on NubeHost ready to point DNS to.
  6. Switch the DNS once everything is verified.

Maintenance mode

To make changes without visitors seeing errors.

  1. On the site card enable Maintenance Mode.
  2. WP Toolkit shows a static page while you work.
  3. Customize the message from Customize.
  4. Disable when you’re done.

Manage files and database

From the site card you have direct shortcuts to:

ActionShortcut
Open File Manager at the site rootFiles
Open phpMyAdmin with the site DBDatabase
Edit wp-config.php from the browserwp-config.php
Auto-login to wp-admin (no capture)Log In
Reset admin password without entering wp-adminSetup → Reset password

Remove a site

  1. On the site card click the three dots → Remove.
  2. Pick:
    • Remove only WordPress: deletes files and DB, keeps the domain/subdomain.
    • Remove WordPress and database: deletes everything.
  3. Confirm.

Note: WP Toolkit takes an automatic prior backup before deleting. You’ll find it in the Backups section for a few days.

Final verification

  • The site appears in WP Toolkit with its current version.
  • There is a scheduled automatic backup (weekly minimum).
  • Hardening applied and verified.
  • Smart Updates active if you trust unattended updates.
  • Functional cloned staging (if you need it).
  • PHP on version 8.2+ and memory 256M.

Common WP Toolkit mistakes

  • Not rescanning after manual install: WP Toolkit doesn’t detect the site until you click Scan.
  • Applying all hardening without reading: blocking xmlrpc.php breaks Jetpack.
  • Forgetting to mark staging as “not indexable”: Google indexes duplicates and penalizes you.
  • Trusting manual backups: schedule automatic ones. If you didn’t schedule it, it doesn’t exist.
  • Deleting the site without downloading the backup: automatic backups live inside your account; if you delete it too, you lose everything.
  • Using Smart Updates without testing first: it works, but verify your visual tests are representative before relying on it.

Still need help?

If this guide didn’t solve your issue, our team can help you via ticket.

Open ticket Go to my account