SSL Archives

Plesk WordPress Toolkit 5.4 Release: Action Log, wp-cron Management Workflow, SSL Support, and More

WordPress Toolkit v5.4 has been in development for over two months, during which the team has produced four minor product updates. Now, it’s time to present the second major release of WordPress Toolkit in 2021 to the public. Read on to find out more.

WordPress Toolkit Action Log

A lot of things can go wrong with your WordPress installation for a variety of reasons. Having a detailed log of events that happened to your site could be very helpful if things ever go south.

WordPress Toolkit now saves a log of essential actions it performs on all managed websites to address this need. Logs are written in plain text for each individual WordPress installation. They have a particular naming pattern that uses internal site UID and are stored in a separate folder:

$HOME/logs/wpt_action_logs/action_log_#SITE_UUID#.log (where $HOME is the home directory of your domain).

For example, in Plesk, you can find the log here:

/var/www/vhosts/mywebsite.net/logs/wpt_action_logs/action_log__4d4a10e8-84b2-423e-8539-b43c97b692ae.log

On cPanel, the same log would be stored here:

/home/admin/logs/wpt_action_logs/action_log__4d4a10e8-84b2-423e-8539-b43c97b692ae.log

Log files are accessible via File Manager of your control panel or via ‘Logs‘ link on the site card that opens the corresponding log file in the Log Browser (on Plesk) or File Manager (on cPanel). For convenience, the ‘Logs‘ link is also available as an icon in the site title, so you can quickly open the log for any site in a collapsed site list:

Note that Log Browser in Plesk cannot properly parse the WordPress Toolkit log right now. We will rectify it in the next WordPress Toolkit release.

Not all events are logged at the moment, just the most important ones, but we will expand the list in the next WordPress Toolkit release to ensure that everything WordPress Toolkit does could be found in the log files. We will also introduce the interface for viewing correctly parsed logs in the same Toolkit release. We hope that this feature will help site admins troubleshoot their sites and reduce the number of support tickets we (and our partners) receive.

New wp-cron Management Workflow

The ability to turn off default wp-cron behavior was introduced one year ago in WordPress Toolkit v4.7. Since then, we’ve collected a lot of feedback on this feature, and it was time to put this feedback into action.

First, the option was renamed to ‘Take over wp-cron.php‘. This was done to avoid the classic “enable to disable” confusion, where you are prompted to enable something that says “disable,” and you’re like “ehhh??”

Second, you now can explicitly choose if a replacement cronjob should be created or not via the ‘Create a replacement task when a takeover is initiated‘ switch:

If you toggle this switch after ‘Take over wp-cron.php‘ is already enabled, it will create or remove the replacement cronjob correspondingly. If the switch is toggled before the takeover is initiated, then the replacement cronjob will be (or won’t be) created when the user enables the takeover.

Speaking of replacement cronjobs, they are now way less strict when it comes to user modifications like task execution frequency. Basically, you can modify every aspect of the cronjob without being afraid that WordPress Toolkit will overwrite the changes. If WordPress Toolkit cannot find its own cronjob, it will not try to recreate the cronjob, concluding that it was knowingly modified or removed by the user. If the user has butchered or removed the replacement cronjob by mistake, it can be recreated by switching off and on the corresponding ‘Create a replacement task…‘ switch.

SSL/TLS Support Status

WordPress Toolkit has been showing the SSL/TLS status on the site card for quite some time, but this status was not particularly helpful, as it merely showed which protocol was used in the WordPress site URL. We’ve redesigned this behavior to be more beneficial to site administrators. Now, the site card features the actual status of what’s going on with SSL/TLS certificates on your site. In particular, WordPress Toolkit now detects and helps address the following situations:

If SSL/TLS support is turned off on your hosting
If there’s no SSL/TLS certificate installed for the domain name used by your WordPress site
If SSL/TLS certificate you’re using is self-signed
If SSL/TLS certificate you’re using is expired
If SSL/TLS certificate you’re using was not issued for the domain name used by your WordPress site
If permanent SEO-safe 301 redirect from HTTP to HTTPS is turned off on your hosting
If SSL It! extension is not installed in Plesk
If SSL/TLS feature is turned off for your account in cPanel
If there’s a protocol mismatch (HTTP to HTTPS redirect is enabled, but WordPress still uses HTTP)

Example of situation #5 from the list above:

… and, obviously, we’ll also let you know if everything’s OK with your site in terms of SSL/TLS, displaying your certificate name:

If you don’t have a certificate, the Toolkit will gently nudge you towards issuing a Let’s Encrypt cert or buying a cert.

New Cloning Backend

When it comes to cloning, many WordPress-related tools and services claim that they clone WordPress sites. However, the question today isn’t “which tool can do it,” the question is “which tool does it best” – after all, both BMW Isetta and BMW i8 are German cars that can drive on your average road, but there’s a world of difference between them in terms of performance. Our cloning mechanism has been quite complicated (to put it mildly) since its inception. This complexity made things difficult to maintain and improve, so we decided to update it. Specifically, our goals were:

Easier maintainability (a single backend for all supported platforms instead of multiple different algorithms)
Better security
Improved performance
Enhanced reliability

It took us quite some time, but we got it done, and WordPress Toolkit now boasts a new backend that meets all our expectations. We have even managed to test it in battle conditions: a cPanel customer was experiencing weird slowdowns during cloning, so we’ve decided to replace the cloning backend on the affected server to see what happens. The experiment was a resounding success, speeding up the procedure dramatically. Even so, such change could be quite risky when applied on all WordPress Toolkit servers at once, so we’re planning to introduce it gradually – more about that in the next paragraph.

Other Improvements & Bugfixes

WordPress Toolkit v5.4 includes a lot of other minor improvements and multiple bugfixes. Some of the highlights include:

AlmaLinux support on both cPanel and Plesk
Integration with WHM / cPanel was redesigned and simplified for improved reliability
WordPress Toolkit now ships with its own version of UI library on Plesk to make sure that all the latest changes and bugfixes are available to our users as fast as possible
Progress display in windows was standardized and unified for better user experience
Various warnings and notifications related to problematic PHP versions were improved and made more consistent
Minimal WordPress version that can be installed via WordPress Toolkit was increased to WordPress v4.9 (the last major release without Gutenberg for those who refuse to use it)

Finally, the output of ‘–info‘ CLI command now includes the WordPress installation state:

More Updates on cPanel

E-mail notifications on cPanel

E-mail notifications about updates and quarantined sites are now finally available on cPanel. There’s no UI for managing them now, so they are disabled by default to avoid making users unhappy. To enable the notifications, server administrators need to put the corresponding option in their config.ini file and set its value to true:

‘cpanelAdminSuspiciousInstanceNotificationEnabled‘ – sends a notification about new suspicious instances to server administrator.

‘cpanelResellerSuspiciousInstanceNotificationEnabled‘ – sends a notification about new suspicious instances to each reseller.

‘cpanelClientSuspiciousInstanceNotificationEnabled‘ – sends a notification about new suspicious instances to each client.

‘cpanelAdminAutoUpdatesNotificationEnabled‘ – sends a digest of newly available and installed updates (WordPress core, plugins, themes) to the server administrator.

‘cpanelResellerAutoUpdatesNotificationEnabled‘ – sends a digest of new available and installed updates (WordPress core, plugins, themes) to each reseller.

‘cpanelClientAutoUpdatesNotificationEnabled‘ – sends a digest of new available and installed updates (WordPress core, plugins, themes) to each client.

We’re planning to introduce the UI for managing these notifications in the next major WordPress Toolkit release, at which point we’ll enable all these notifications by default. Until that, hosters and server administrators will have to rely on config file modification to receive helpful information from WordPress Toolkit in their mailboxes.

Leika for cPanel

For those who don’t know yet, we have a service called Leika for rolling out gradual changes and conducting various experiments. This service offers tremendous help controlling the spread of potentially dangerous changes and experimenting with ideas that could positively affect user experience.

Until now, Leika only worked for Plesk, But not anymore as we’ve just made it available for WordPress Toolkit on cPanel too. The cloning backend change described earlier is one of many WordPress Toolkit features to undergo gradual rollout for the whole audience – and it’s the first one (but not the last one) on cPanel.

Future Plans

Many of the plans for the next release were already mentioned above:

Add UI for action logs
Add the rest of the actions to logs
Add UI for e-mail notifications on WHM/cPanel

In addition to these things, we are looking into improving how we handle popular caching plugins during cloning. There’s more exciting stuff coming in v5.5, but I’ll have to keep that under wraps for now – after all, we should always keep some pleasant surprises in store for you 😉

With that said, see you soon, and thank you for your time!

All the New Plesk Obsidian Features

Plesk’s evolution is an ongoing process since the dynamic hosting industry continues to change proactively. Cloud technologies keep revolutionizing the industry and IT professionals need help managing multiple environments and services more efficiently. Productivity, security and usability are key here and Plesk Obsidian is the timely solution. To help you better understand the level of improvements of the new Plesk version, here’s an overall view of new and updated Plesk Obsidian features. On Sep 25th 2019, Obsidian became RTM.

Advanced Monitoring & Grafana Extensions

Advanced Monitoring helps you stay in the loop regarding server and site availability. So you can get to the heart of any issues.

Since availability is key in the Obsidian release, usage is important because you want to react quick when resources become overstretched. Hence, you can now enable alerts to tell you if things like CPU, RAM, and Disk IO are becoming overburdened.

The new Grafana extension works hand in hand with Advanced Monitoring to chart info and stats in order to make them more understandable. The new Grafana charts supersede the old HealthMonitoring tool.

Moving Domains Between Subscriptions

For better security, it makes sense to separate your sites – but it’s also helpful to keep your staging and production sites apart. Now, Plesk Obsidian’s UI and CLI give anyone you choose the freedom to move domains between subscriptions. Just make sure that the target subscription has enough headroom to handle the added load, and you’re good to go.

Composer V2.0 – PHP Dependency Manager

Here are all the things you can do, or don’t need to do, with the new PHP dependency manager.

SSH access no longer needed for PHP composer

You can now run the full range of convenient PHP Composer actions, even without SSH access. It’s possible to set up environment variables, modify your composer.json and execute the Install and Update commands.

Dependencies – Just click to install and update

You can perform tests, run dependencies, or create a classmap. But what you won’t need to do is memorize all the commands and options to install them. Plesk Obsidian can handle this heavy load for you now.

Soon you won’t even need to stress about partially-updated dependencies taking down your production site. Test the latest updates until you’re sure dependencies are safe before pushing your site live.

Update dependencies when everything looks safe

Updating dependencies is a double-edged sword. It’s something you need to do to stay on top of security risks. But you also know it’s something that can break your website. Though minor updates pose less of a risk, major ones can bring the whole house of cards tumbling down.

So you’d be happy to know that you can now assess the potential risks right from the Obsidian interface. As they say – Forewarned is forearmed!

Get the correct PHP version automatically

Now your site will use the PHP version that composer.json specifies – automatically. Composer will run using the right PHP handler instead of the system default. Hence, the one the individual website uses. (There are plans to have Plesk be able to choose the appropriate PHP version and handler). Log in using SSH and type in the “php” command.

Improved File Manager UX

Now File Manager makes you even more productive thanks to mass upload and file search. You can upload and extract RAR, TAR, TAR.GZ, and TGZ archives.

Repair Kit: Self-repair Tool

Plesk Obsidian Repair Kit is a powerful self-repair tool, automatically detecting and resolving issues with Plesk or its related services. It lets you view a list of processes currently running on the server and filter them by domains and disable them. You can also see the total RAM, CPU, and Disk usage for all processes running on the server or for individual processes.

Soon it will be possible to use a list of MySQL queries and processes to discover why MySQL consumes excessive resources and which domain is to blame.

Server-side restrictions for Plesk Admins

Restricted Access mode lets you control which administrators get access to which server administration tools and settings. You’ll find it under the “Administration Tools” tab in both Power User and Service Provider views.

Control which tools, services, resources and settings your admins access while in Power User view, with Restricted Mode active. Just look under the “Hosting Tools” tab.

Essentially, you’re allowing your customers to have Plesk administrator access, without worrying about them wreaking havoc on critical and sensitive settings.

SSL It!

Make sure you keep your server protected around the clock via SSL/TLS certificates from leading, trusted certificate authorities, like Let’s Encrypt and DigiCert.

We’ll be adding support for more of these in future. In the meantime, here’s what you can use SSL It! for.

Buying, installing, and renewing certificates from a variety of CAs.
Securing your domain, webmail, the “www” subdomain, and as many aliases as you want. Get a clear view of what’s secured and what isn’t.
Automatically issuing, installing and renewing Let’s Encrypt certificates for domains secured with invalid certificates (self-signed, expired, or issued by a non-trusted CA.)
Managing HSTS, OCSP Stapling, and HTTP to HTTPS redirect.
Seeing the SSL/TLS status of the domain, subdomains, and domain aliases at a glance.
Getting an A+ rating from ssllabs.
Easily viewing SSL/TLS status via a small indicator on the Domain page.
Use the most up to date TLS versions and ciphers.

SNI for Mail Services

Keep your email conversations private, because you never know who may be spying in. You can simply secure SMTP, IMAP, and POP connections to your mail server with an SSL/TLS Certificate.

However, if you offer mail services for more than one domain, your users may have trouble with their mail clients. But you can fix this by using individual SSL/TLS certificates for each domain. Thanks to Plesk Obsidian and the SNI support provided by Postfix and MailEnable.

Personalized HTML Notifications

HTML-based email notifications help improve user experience. But they also keep you in control of your server and sites when you’re not logged into Plesk. You can read these HTML-formatted messages more easily than plain text.

Plus, the shared design makes messages more attractive and sets them apart visually from other correspondence. Use the Plesk default HTML templates or customize the look of your notifications with HTML formatting. There’s bold and italics, headers, numbered and bulleted lists, and more.

Backup Optimizations

We’ve reduced the free server disk space needed to back-up to Google, Amazon S3, FTP, and One Drive cloud storage. Now, restoring a subscription from a full server backup requires only additional free disk space equal to the subscription space. Instead of the full server backup.

Meanwhile, backing up the server to cloud storage only requires additional free disk space equal to that of two subscriptions. Rather than the entire server’s disk space. Hopefully, this has made operations faster on backups that are stored remotely. For example, you can now remove backups stored in the cloud four times quicker than before.

Revised Plesk UI and More Key Improvements

We’ve modernized the overall Plesk UI to address some of the UX shortfalls our users reported. Notice that the Plesk interface now looks more like plesk.com. There’s more to come – but for now we’ve improved the appearance and behavior of individual Plesk elements, colors and font sizes. Then, aligned all elements to a grid.

There have also been some key additions:

Precompiled PageSpeed:
The PageSpeed module is now precompiled with NGINX.
Automatic Restarts:
Plesk services that crash on systemd-based Linux OSes (CentOS7, RHEL 7, Ubuntu 16.04/18.04, Debian 8/9) will now restart automatically. Apache graceful restart is now strong enough to be set as the default to reduce downtime for websites.
Immediate Default Security:
Secured by default: mod_security and fail2ban v0.10 are active straight away.
Easier Plesk Access:
Plesk entry point has been optimized for Clouds like Amazon and Digital Ocean. Access Plesk via https://<host-name-or-IP> without specifying the TCP port 8443.
Default HTTP to HTTPS:
Newly created websites have an SEO-friendly HTTP to HTTPS redirect enabled by default.
PHP-FPM & Apache Tweaks:
Services improvements will give you more reliability with restarts. PHP engines supplied with Plesk contain popular PHP extensions like sodium, exif, and fileinfo.

It is worth mentioning that, starting with Plesk Obsidian, Plesk is announcing a monthly release cycle in order to always deliver value through secure and stable software to our Partners and Customers. Once you upgraded to Plesk Obsidian and allowed automatic updates through Plesk Server settings, you will always and automatically be on the latest version of the software. See below a complete comparison between Onyx and Obsidian – the complete list of arguments about why to upgrade:

Plesk Onyx vs Plesk Obsidian

Check more podcasts

Advanced Monitoring Backup Composer file manager Grafana http to https Obsidian release Plesk Obsidian podcast Repair Kit SNI SSL tech podcast

Moving from HTTP to HTTPS 2: SSL Certificates and their suitability

SSL certificates help secure data in transit against attacks. Regardless of their types or issuing agency, all SSL certificates encrypt submitted data – decrypting it only upon reaching its recipient. While this basic functionality remains the same for all types of SSL certificates, there are some key differences in suitability and limitations. Let us explore these differences in detail as you continue your move from HTTP to HTTPS.

DV (Domain-validated) Certificate

DV or domain validate certificate is the most basic level of certification. It simply helps you demonstrate that you’re the submitted domain owner, while requesting the SSL certificate.

A DV certificate is ideal for internal communications, to maintain test domains and servers, and internal sites. Rarely, it may also be suitable for small businesses with a brochure website.

DV Certificate Limitations

DV doesn’t mention the company name that owns and operates the domain. Hence, it doesn’t verify the domain is owned by a trusted, official, legal entity. This can discourage shoppers or potential partners from sharing their personal info while performing online transactions on your site.
Sharing data over a secured network with an unidentified/unverified recipient isn’t wise. A hacker can purchase a fraudulent similar sounding domain name and its SSL certificate (like Mikrosoft.com or Jumla.com). This just to trick visitors into sharing sensitive data which they will later misuse.

OV Certificate

You get an OV certificate after a detailed verification process. Because it displays more comprehensive domain information, thus verifying that the legal corporate entity that owns it is authentic.

An OV Certificate is suitable if you’re running a commercial website or blog that requires clients to login using an ID/password. Or for educational institutes that require students/teachers to login and check reports/attendance and other non-interactive activities. An OV may also suit local community websites and small business websites that don’t involve sales or sharing of payment details.

OV Certificate Limitations

Real human interaction like the telephonic call is generally involved at multiple levels that enhance the trust level.
Trusted real-world sources are checked to cross-verify the corporate nature of the business requesting it. In most of the cases, it also involves the submission of business documents.

EV (Extended Validation) Certificate

EV certificates almost eliminates any phishing possibilities because of its strict configuration, reinforcing failsafe security at multiple levels. However, an EV requires the most stringent verification process. Your organization can have one issued only after it can successfully pass all verification steps. Namely, physical existence, current legal/operational status, exclusive domain ownership and controlling rights of the commercial entity.

EV Certificate Suitability

The EV certificate is perfect for online stores that need customer personal and payment information. Including contact address and phone number.
EV is also suitable for Healthcare websites that establish communication between doctor and patients. Also, government, educational and other interactive websites that conduct online tests, assessments and such.
If you’re working on mission-critical projects via your website, then an EV SSL certificate is the best option for you.
The EV certificate is also the best choice for online wealth building and management sites and Blockchain websites. Those enabling online payments and are looking to build a long lasting digital empire.

Single Domain SSL certificate

The single domain covers only one main domain to which it belongs, without supporting any of its subdomains. So if you buy a single domain certificate for mycompany.com, it will only provide SSL security (and HTTPS status) to yourcompany.com. The Single Domain SSL certificate is ideal for small businesses and start-ups that just want to secure one domain. Like the homepage.

Wildcard SSL Certificate

Along with securing the main domain, the wildcard certificate also secures all related subdomains. In short, the Wildcard perfectly fills the gaps left by the single domain certificate. For instance, if you purchased a Wildcard SSL Certificate for mysite.com, then it will automatically secure blog.mydoman.com, services.mydomain.com, and shop.mydomain.com.

A Wildcard SSL certificate is best for business websites, institutional sites and other websites with multiple web pages of high importance. Such as government organizations, eCommerce sites, online new media, and social community websites.

Multiple Domain Names Certificate

The Multiple Domain names SSL certificate is fully capable of securing multiple domain names that belong to you. The Multiple Domain Names Certificate is suitable if you’re running a group of companies with different URLs or you’re considering starting up multiple blogs or sites in the future.

HTTP to HTTPS: Get the best benefits from your SSL Certificate

You need to know about various options and their suitability for you to make the best SSL choice. Especially with the move from HTTP to HTTPS. This article should help you evaluate this in the context of your business and its objectives. If you’d like to know more about the suitability of different certificates, read our SSL Certificate guide here or the more detailed SSL info from Digicert.

HTTP HTTPS SSL SSL Certificate