“If it ain’t broke, don’t fix it.” This is a common mindset among WordPress users who don’t regularly update their themes and plugins. The fear of an update breaking something is often stronger than the desire to gain enhancements and security fixes. Why improve something that already works perfectly well?
Antti Kuosmanen, founder of Seravo.com, a WordPress hosting platform based in Finland, has been performing tested auto-updates for the past three years for thousands of sites. Using the experience he gained as a dedicated hosting provider, Kuosmanen created the WP Safe Updates plugin with the desire to remove the barrier of fear that often prevents users from updating their sites.
WP Safe Updates allows users to test plugin updates in a sandbox before applying them on a live site. After installing the plugin, you’ll see a new “test update” link with available updates on the plugins page.
Clicking this link creates a sandbox where you can test the plugin update without making any actual changes to the live website. The plugin immediately updates in the sandbox and you’ll see a notice at the bottom of the site while you’re testing.
This allows you to check out the frontend, admin, and any area of the site that the plugin affects. Once satisfied with the results of the update, you can exit the sandbox and proceed with confidence in updating the plugin on the live site.
When starting a round of testing, it may take a few seconds for the plugin to build the sandbox. According to the plugin’s description, the sandbox works similarly to how WordPress multisite works:
We tell WordPress to temporarily use a different database prefix and a different plugins directory while in the alternative heap (sandbox). This is done by sending WordPress a special _alt_heap cookie.
WP Safe Updates uses MariaDB/MySQL to duplicate all the tables WordPress is using so that users can do any tests on the site, like create posts, use other plugins with their own tables, and see how everything interacts with the staged updates. If a user deactivates and uninstalls the plugin, it will clean up after itself by destroying all the temporary tables it created.
“The target audience for WP Safe Updates is the vast majority of WordPress sites on shared hosting that don’t provide staging instances to do the testing for you,” Kuosmanen said. One challenge that he’s still working on is the possibility of PHP timing while cloning the database tables on larger sites.
“I’ve done a test with a 3GB database,” Kuosmanen said. “It takes around 9 seconds to do the duplication.” He’s working on a solution that uses a separate loading screen for the duplication process.
Another challenge with the plugin is that it requires the user to manually edit wp-config.php and to copy the db.php file from the plugin to the wp-content directory. This seems like a big hurdle for non-technical WordPress users who would benefit most from the plugin.
Kuosmanen said he is already working on an automated set up configuration process and hopes to offer it in a future update to the plugin. The roadmap also includes adding the ability to safely test theme updates. For now, the focus is on plugins, since they generally are the bigger issue with updates.
“The ultimate goal for this plugin is to empower the average WordPress site with a safe sandbox where updates can be tested safely, either manually or eventually automatically,” Kuosmanen said.
Kuosmanen Wants to Bring a Sandboxing Feature to WordPress Core
“I feel the safety of theme/plugin updates is definitely among the most important issues to solve for the future of WordPress security,” Kuosmanen said. His WordPress hosting company uses Docker snapshots to create the sandboxes. Seravo.com uses a Ruby rspec + phantomjs stack, along with phpunit to do automated acceptance tests with updates.
“I wanted to bring this technology to people who can’t afford premium hosting solutions,” Kuosmanen said. “These issues are rather simple to solve in a modern dedicated hosting environment with APIs for creating staging instances and tests, but that’s only for a tiny portion of WordPress sites that use dedicated hosts.
“I want to enable anyone, running on pretty much any crummy $3 / month hosting to feel secure about updating WordPress themes and plugins,” he said. That’s why he created WP Safe Updates and is now proposing his approach as an example for how WordPress might solve this in core. The ticket is currently in the discussion phase.
“It’s not going to get rid of dedicated hosts obviously, but it’s going make WordPress a heck of a lot better and safer for everyone else,” Kuosmanen said.
“At some point, we hope there will be 3rd party services that offer to do automated update testing via APIs provided by the WP Safe Updates plugin (or just WordPress if we get this into core).”
I tested WP Safe Updates and found that it works as expected. I also confirmed that it removes the temporary tables from the database when it is uninstalled. The process of testing a plugin update is much easier than many of the other sandbox plugins I’ve tried in the past. I’m not sure if WordPress core should support this kind of functionality, but it is an interesting proposal to consider for improving the update experience.
WP Safe Updates is available on WordPress.org and is still in the alpha stage. Kuosmanen said it needs more testers from all kinds of different hosting environments. The plugin is also available on GitHub if you want to contribute to the project.
Thanks for the shout-out, @WPTavern! :)
– Antti Kuosmanen