New sites no longer default to admin / admin — the site creation form fills in a random 20-character password with a mix of letters, digits and symbols. Buttons beside the field generate a new one or copy it, and Create Another draws a fresh password, so sites launched back to back never share one.
The VPS installer's All versions option now lists PHP 7.4, which it always built. It also points to Settings → Images for other versions, including 8.4 and 8.5.
Upgrading to v2.5.1
Dashboard-only change: update as usual. There is nothing to migrate and no image to rebuild.
Existing sites keep their current passwords. If any were launched with admin / admin and can be reached from outside your machine, change the password in WordPress.
v2.5.0 — October 7, 2026
Mini CRM & Client Portal
Mini CRM — Projects & Invoices is renamed and grown into a small CRM for running client work from the panel. The feature flag and API prefix stay projects, so existing installs keep their setting. Records are scoped to the staff user who created them.
Payment methods — keep bank details and payment instructions in one install-wide list, and choose which ones each invoice shows. Adding a method later never changes an invoice already sent. Deactivate a method rather than delete it while invoices still use it.
Project board — a Kanban board on every project. Drag cards between and within columns, and drag a column by its header grip to reorder it. Cards carry a description, due date, labels, and staff-only notes and file attachments. Each column has a client-visible toggle, off by default.
Client portal (off by default; enable under Features) — invite a client's people from the client page. They sign in at /portal to see their projects (visible columns only), their invoices (never drafts or cancelled ones) and the payment details attached to each invoice.
Payment proofs — clients upload a receipt (PNG, JPEG, WebP or PDF, up to 5 MB) against an invoice. The invoice moves to Awaiting verification, never straight to Paid. Staff accept the proof, which records the payment, or reject it with a reason the client reads.
Client conversations — one message thread per client, written from both the panel and the portal. A message can reference a project or an invoice.
Notifications — an in-app notification centre (the bell in the panel and portal headers), plus email that each person sets to immediate, daily digest (sent at 08:00) or off.
Shared database servers — MySQL and MariaDB sites now get their own database and user on one shared server per engine, started on demand and stopped when its last site goes. On a four-site host, memory use fell from about 1.2 GB to about 0.45 GB. Sites created before this keep their own database container until relaunched.
Dokploy: self-contained TLS and site isolation — WP Launcher's own Traefik now terminates TLS and issues certificates (per site over TLS-ALPN-01, or a wildcard when ACME_DNS_PROVIDER is set). Sites run on a private network and can no longer reach other apps on the Dokploy instance.
A launch whose WordPress image isn't built now fails immediately with a clear message, and offers a one-click rebuild for base images
Snapshot restores ask for confirmation, and the most recently restored snapshot is badged
A Clear action on the Sites page removes failed and expired rows
Security: site database passwords are now random; Dokploy's Adminer requires a login (ADMINER_AUTH_USERS)
Fixed: "Sign in required" flash on reload, unrestricted production sites labelled "Local Dev", invoice numbers now unique across the install, blueprint deletions survive a redeploy
Upgrading to v2.5.0
SHARED_DB_ROOT_PASSWORD is now required.wpl update, the panel's update button, and bash scripts/update.sh add it to .env automatically. If you update by hand with git pull + docker compose up, add it to .env yourself first (e.g. openssl rand -hex 32), or Compose will refuse to start.
Rebuild the WordPress base image (Settings → Images, or bash scripts/build-wp-image.sh) to pick up the admin-bar badge fix. Existing sites keep their current behaviour until relaunched.
Dokploy installs must set ACME_EMAIL, BASE_DOMAIN_REGEX, ADMINER_AUTH_USERS and SHARED_DB_ROOT_PASSWORD, and must relaunch sites created before this release. See the Dokploy guide.
New database tables are created automatically on first start. No manual migration is needed.
v2.4.0 — August 13, 2026
Blueprint Editing
Every blueprint now has an Edit action. The ID is locked while editing, and the card image and icon survive a save. Changes apply to sites launched afterwards.
Security:GET /api/blueprints/:id?full=true returned the unsanitized blueprint (Docker config, plugin lists, demo admin email) without authentication. It now requires an admin.
v2.3.3 — August 13, 2026
Blueprint Restrictions Fix
Disable File Modifications, Blocked Capabilities and Hidden Admin Menu Items were saved but never applied. The blueprint is now authoritative for what a launched site locks down.
The 7 restriction toggles expand to 12 capabilities in coherent groups, and an absent setting fails closed to the full legacy lockdown
The blueprint editor's defaults now include export and import
Rebuild the WordPress base image to apply
v2.3.2 — August 13, 2026
Dokploy Support
Dokploy deployment support via docker-compose.dokploy.yml
Optional per-site certificate resolver (CERT_RESOLVER) and TRAEFIK_NETWORK
Fixed the setup page's password strength meter contradicting the 12-character submit rule
v2.3.1 — March 29, 2026
Push Sync Fixes
Fixed the Connector plugin being deactivated after a push sync (stale object cache after the raw SQL import)
Fixed the Connector API key being reset after a push sync — the key is now saved before import and restored afterwards
Redesigned WP Launcher Connector settings page: branded header, selectable fields, copy buttons with feedback, and colour-coded server requirement badges
v2.3.0 — March 28, 2026
Security Fixes
Fixed command injection in selective sync — content IDs are validated as positive integers
Fixed path traversal in product/template lookup with strict slug validation
Productivity Monitor access is enforced server-side
Heartbeat ingestion requires a per-install secret, with CORS restricted to known origins and a 60 req/min rate limit
Cloud sync uses the existing SSRF guards for all outbound requests
The cloud API key is no longer kept in localStorage
v2.2.0 — March 25, 2026
Direct File Access
Site plugins/ and themes/ are bind-mounted to a host directory (SITES_HOST_PATH) for direct editing from VS Code or any file manager; the rest of wp-content stays on a fast named volume
Dashboard "Files" button copies a site's host path; wpl code <subdomain> opens it in VS Code and wpl browse <subdomain> in your file manager
PHP config dropdowns include 1 GB, 2 GB, and Unlimited options
Containers renamed from wp-demo-{subdomain} to wp-site-{subdomain}
Deleted, expired, and failed site subdomains are freed for reuse immediately; generated subdomains retry on collision
New guide: Working with WordPress Files
v2.1.1 — April 7, 2026
Extension Auth & Heartbeat Fix
Per-install heartbeat secret for authenticating editor extensions (VS Code, Cursor, Windsurf, Antigravity) with the API
Dashboard now displays the heartbeat secret in Productivity > Cloud Settings for easy copy to editor settings
Fixed editor extensions failing to send heartbeats after the v2.0.0 security hardening update added secret validation
VS Code extension updated to v0.2.5 — includes heartbeatSecret setting, improved error backoff, and retry handling
Other editor extensions (Cursor, Windsurf, Antigravity) updated to v0.1.4 with matching secret support
v2.1.0 — March 24, 2026
Productivity Monitor
WakaTime-like productivity tracking for coding and WordPress site activity
WordPress MU-plugin auto-installed on every launched site — tracks all wp-admin activity (editing, customizer, media, plugins, themes, settings, WooCommerce)
VS Code extension published to marketplace as msrbuilds.wpl-productivity — tracks coding time per language, project, and git branch
Dashboard page with 5 stat cards, daily/hourly/weekday activity charts, and 4 WakaTime-style breakdown panels (projects, categories, editors, WP screens)
Cloud sync — heartbeats stored locally, batched to cloud every 6 hours with manual sync trigger