Title: Kreiswolke Maintenance Agent Toolkit Author: KREISWOLKE Published: 10 Luglio 2026 Last modified: 15 Settembre 2026 --- Ricerca i plugin ![](https://ps.w.org/kreiswolke-maintenance-agent-toolkit/assets/banner-772x250. png?rev=3602685) ![](https://ps.w.org/kreiswolke-maintenance-agent-toolkit/assets/icon-256x256.png? rev=3602685) # Kreiswolke Maintenance Agent Toolkit Di [KREISWOLKE](https://profiles.wordpress.org/basic777/) [Scarica](https://downloads.wordpress.org/plugin/kreiswolke-maintenance-agent-toolkit.1.1.2.zip) * [Dettagli](https://it.wordpress.org/plugins/kreiswolke-maintenance-agent-toolkit/#description) * [Recensioni](https://it.wordpress.org/plugins/kreiswolke-maintenance-agent-toolkit/#reviews) * [Sviluppo](https://it.wordpress.org/plugins/kreiswolke-maintenance-agent-toolkit/#developers) [Supporto](https://wordpress.org/support/plugin/kreiswolke-maintenance-agent-toolkit/) ## Descrizione Maintenance Agent keeps your WordPress sites updated, hardened, and recoverable — so staying current is no longer a risk or a chore. You get a complete maintenance toolkit: careful updates, security hardening, instant rollback, emergency recovery, anti-bot features and Coming Soon page. Drive it with your own AI assistant, manually, or through the free companion app— which adds the dashboards, manual controls and a specialized agent that runs the whole cycle based on dependencies and site history. #### Protect and harden — via wp-admin or remote (FREE) * 21 hardening and anti-bot features: security headers, HSTS, hide usernames, generic login errors, disable the file editor, force SSL on admin, block xmlrpc, block PHP execution in uploads, block sensitive files, honeypot URLs, bad-bot blocklist( with your own allow list), disable the REST batch endpoint, directory listing off — and more. Each with a plain-English helper, all off by default. * Login gate: protect your login with a PIN page that stops login-hammering bots before WordPress even boots (saves server resources). * Every `.htaccess` change backed up automatically first, restorable in one click— plus an FTP kill-switch. * Animated Coming Soon page and maintenance mode, configurable and SEO-aware. #### Careful maintenance toolset — for agents and custom integrations (FREE) * Works with any MCP-capable AI assistant, your scripts, or CI. Registered with the WordPress Abilities API (WP 6.9+), standard Application Password auth. * Full site stack and health reports: versions, every plugin and theme, update availability, recent errors. * A lightweight health signal, readable any time: database reachable, recent fatals, free disk space, stalled cron, auto-disabled plugins, active cache layer. * Point-in-time snapshot of every plugin, theme, core, and the database — taken before anything is touched. * The building blocks for careful, one-at-a-time updates: update a single item, flush caches, run a health check — sequenced by whatever drives it (the app’s agent, your script, or your AI assistant). * Install, activate, deactivate, or remove any plugin or theme. * Per-item restore: roll back only what broke — no full-site backup restore needed. * Optional backup-plugin trigger (UpdraftPlus, BackWPup), cache flush, error-log tail. There is no AI inside the plugin itself — it is a deterministic toolkit. Intelligence lives in whatever you connect to it. #### Dashboards and a specialized agent — via the companion app (FREE TIER) * The free plan is real and permanent (no credit card, no trial clock): one agent audit, 5 agent maintenance runs, 1 archived restore point, maintenance dashboards. * Specialized agent with memory that runs the whole cycle: snapshot reasoned dependency update order verify each step decides rollback if something breaks reports. * Dashboard with stack overview, health, pending updates, status, theme/plugin installer, and more. * Narrated, read-only first scan — see what the agent thinks of your site before anything is ever changed. * Live run view (watch the agent do maintenance work), run history and reports, a Time Machine restore point, per-site notes. #### More sites, scheduling, and monitoring — paid plans (optional) The free plan runs the full agent and dashboards within a small monthly allowance. Paid plans lift the limits and add what matters once you manage more than one site: * From a single site to a whole portfolio — more sites, more runs. * Scheduling: a weekly maintenance rhythm per site, run unattended, reported back. * Uptime, SSL and domain monitoring — external checks enriched with insider context( it knows which run touched the site and what changed). * Cross-site installer: install, update, or harden plugins and themes across the whole fleet in one pass. * Fleet-wide hardening — the security toolkit applied to many sites at once. * Longer restore-point history, client reports under your agency branding, per- client routing. Pricing and the full comparison are on the website. The plugin never requires a paid plan — or any plan. #### Why Maintenance Agent? Updates should be careful, observable, and reversible. Most tools update everything at once and hope; this one is built the other way. * It reasons before it acts: reads your stack, plans a dependency-aware order, updates one item at a time, verifies each step — then decides, per failure, whether to retry, skip, roll back, or stop. * Everything is reversible: a snapshot before anything is touched, per-item rollback, and an emergency companion that recovers a site even when the site itself won’t boot. * Drive it your way: click it in the dashboard, ask the in-app assistant, or run it from your own AI assistant over MCP — the same safe operations, three ways in. * Your data stays in the EU: hosted in Germany, GDPR-aligned with a data-processing agreement, credentials encrypted at rest, and onboarding that never asks for your admin password. Full features, screenshots, and pricing: https://kreiswolke.com/wp-maintenance-agent/ ### External services **1. The Kreiswolke companion app (optional, opt-in only)** The plugin contacts the companion app **only if you explicitly connect your site**( a “Connect” action in the plugin’s settings). Without connecting, the plugin sends nothing anywhere. When you connect: * The connection is established through a consent screen on the app. During pairing, the site URL and cryptographic public keys are exchanged, and a standard WordPress Application Password is created for the app — after you accept the terms on the consent screen. * A connected app can then read the site reports described above and perform the maintenance operations you authorize (updates, rollback, hardening configuration), authenticated by that Application Password plus a per-site request signature. * The plugin itself initiates only one outgoing call: if the plugin is disconnected, deactivated with disconnect, or deleted, it sends a short, best-effort notification to the app — containing the event name, the site URL, and the pairing identifier— so the app stops treating the site as managed. No other data is in that call. * You can disconnect at any time from the plugin’s settings; uninstalling removes the credentials on the site (and revokes the Application Password). Service provider: Kreiswolke Terms of service: https://kreiswolke.com/terms/ Privacy policy: https://kreiswolke.com/privacy-policy/ **2. api.wordpress.org** Site stack reports enrich plugin information (latest version, last-updated date, requirements) through WordPress core’s own `plugins_api()` — the same wordpress. org API your site already uses for the update screen. **3. Requests to your own site** Several features fetch a URL **on your own site** (never a third party): the post- update health check (pinned to your site’s address), the webserver-detection probe, the login-gate self-test, and a one-time compatibility probe before writing an ` ErrorDocument` rule. These are loopback self-checks, listed here so they are not mistaken for external calls. ## Screenshot [⌊Hardening: 20 security and anti-bot protections, each with a plain-English explainer— all off by default, configured from wp-admin.⌉⌊Hardening: 20 security and anti-bot protections, each with a plain-English explainer — all off by default, configured from wp-admin.⌉[ Hardening: 20 security and anti-bot protections, each with a plain-English explainer— all off by default, configured from wp-admin. [⌊Coming Soon and maintenance mode — animated splash with content and SEO controls, toggled instantly.⌉⌊Coming Soon and maintenance mode — animated splash with content and SEO controls, toggled instantly.⌉[ Coming Soon and maintenance mode — animated splash with content and SEO controls, toggled instantly. [⌊Connect: link the site to the free companion app through a secure key — no admin password is ever entered.⌉⌊Connect: link the site to the free companion app through a secure key — no admin password is ever entered.⌉[ Connect: link the site to the free companion app through a secure key — no admin password is ever entered. [⌊Optional free companion app — site overview with the agent's read-only assessment.⌉⌊ Optional free companion app — site overview with the agent's read-only assessment .⌉[ Optional free companion app — site overview with the agent’s read-only assessment. [⌊Optional free companion app — full stack inventory with one-click update and rollback per item.⌉⌊Optional free companion app — full stack inventory with one-click update and rollback per item.⌉[ Optional free companion app — full stack inventory with one-click update and rollback per item. [⌊Optional free companion app — uptime, response-time, and incident monitoring.⌉⌊ Optional free companion app — uptime, response-time, and incident monitoring.⌉[ Optional free companion app — uptime, response-time, and incident monitoring. ## FAQ ### Can I use this with my own AI assistant or scripts? Yes — that’s what it’s designed for. Every capability is a REST endpoint, registered with the WordPress Abilities API (WP 6.9+), so any MCP-capable client you trust — or plain curl — can discover and use them. Authentication is a standard WordPress Application Password; destructive operations are snapshot-first with on-disk verification. The plugin is useful to humans and to whatever tooling you already run. ### Does the plugin work without the companion app? Yes, fully. The app adds orchestration (the maintenance agent, scheduling, multi- site dashboards, reports); the plugin alone gives you the reports, rollback, careful updates, and hardening on a single site. ### Does it send my data anywhere? Not unless you connect it to the companion app, and then only as described under“ External services”. There is no telemetry, no tracking, no phone-home. ### Why does it install an MU-plugin? The emergency companion exists for exactly one scenario: a failed update breaks the main plugin (or the site), and you still need the heartbeat, the maintenance splash, and the restore tools to work. A regular plugin can’t promise that — an MU-plugin can. It is written atomically (no half-written file can white-screen a site), updated only on activation/version change, and removed on uninstall. ### Why does it write to .htaccess? Only when you enable an Apache-level hardening feature, and only inside one clearly marked block. The plugin backs up your `.htaccess` before every change, offers one- click restore, ships a kill-switch (create one file via FTP and all rules turn off), and removes the block fully on deactivation/uninstall. Blocking at the webserver is the point of these features: the request is rejected before PHP starts. ### What is the login gate, and can it lock me out? The gate puts a small PIN page in front of `wp-login.php`. It was built after watching bots hammer login pages on real servers: every attempt boots PHP, WordPress, and the database — a WordPress-layer rate limiter still pays that cost on each hit. The gate stops those requests at the webserver, before WordPress runs; bot/load protection is the primary purpose, the added login secrecy is a bonus. It is opt- in, requires a PIN before it can be enabled, and is built to fail open: if the plugin is removed by any means, the rule disables itself; a kill-switch file disables it instantly; logout/password-reset URLs are never blocked. ### Why does the code contain base64, unserialize, and error handlers? base64 encodes/decodes Ed25519 signature material and HTTP Basic auth — both are binary-to-text transports, not obfuscation; every site is commented. The single ` unserialize()` reads WordPress’s own Application Passwords usermeta and is hardened with `allowed_classes => false`. The error handler and shutdown hooks feed the plugin’s own error log and let a restore endpoint return structured JSON even if a fatal occurs; the handler returns `false` so PHP’s normal error flow is untouched. ### My script gets a 403 after enabling hardening — why? The “Bad User-Agent Blocklist” hardening rule blocks requests whose User-Agent matches known scanner tooling — and that includes the default identity of Python (`python- requests`, `Python-urllib`) and Go (`Go-http-client`) HTTP clients, plus empty User- Agents. If your own script uses those defaults, every request gets a webserver-level 403, including REST API calls with valid credentials. Two fixes, either works: give your script a custom User-Agent header (good practice anyway), or add a distinctive part of its name to the rule’s “Allowed user agents” list on the Hardening tab. ### Does it work on nginx? Everything except the Apache-level rules, which are detected as not applicable; for each, the plugin shows an equivalent nginx snippet to paste into your server config instead of pretending it worked. ### Is there AI in the plugin? No. The plugin is a deterministic toolkit — predictable, inspectable, no model calls. AI-assisted planning happens in the optional companion app, server-side, only for connected sites. ## Recensioni Non ci sono recensioni per questo plugin. ## Contributi e sviluppo “Kreiswolke Maintenance Agent Toolkit” è un software open source. Le persone che hanno contribuito allo sviluppo di questo plugin sono indicate di seguito. Collaboratori * [ KREISWOLKE ](https://profiles.wordpress.org/basic777/) [Traduci “Kreiswolke Maintenance Agent Toolkit” nella tua lingua.](https://translate.wordpress.org/projects/wp-plugins/kreiswolke-maintenance-agent-toolkit) ### Ti interessa lo sviluppo? [Esplora il codice](https://plugins.trac.wordpress.org/browser/kreiswolke-maintenance-agent-toolkit/) segui il [repository SVN](https://plugins.svn.wordpress.org/kreiswolke-maintenance-agent-toolkit/), segui il [log delle modifiche](https://plugins.trac.wordpress.org/log/kreiswolke-maintenance-agent-toolkit/) tramite [RSS](https://plugins.trac.wordpress.org/log/kreiswolke-maintenance-agent-toolkit/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.1.2 * Fixed: connecting works out of the box on hosts that run PHP as CGI/FastCGI with plain permalinks. The plugin now writes the standard “pass the Authorization header to PHP” rule into its own block in .htaccess (the same line WordPress adds with pretty permalinks), so the app’s calls no longer arrive without credentials. Nothing to switch on; not needed on nginx. * Fixed: the Connect tab now verifies with the app whether the site is really connected, instead of remembering it. It says “connected” only when the app agrees, tells you when the app no longer recognises the connection, and warns when the host does not pass login credentials to WordPress. A “Re-check now” link is there when you want it. * Fixed: a connection is no longer half-replaced. The new keys from a (re)connect are kept aside until the handshake completes; an abandoned or failed attempt leaves the existing connection exactly as it was. * Fixed: reconnecting an already connected site issues a fresh credential and the app retires the old one — before, the reconnect could stall and show a false “ mismatch”. * Improved: a live connection reads as “connected” in wp-admin; “Reconnect” is offered only as the repair action. * Improved: Sentinel recognises changes to the plugin’s own .htaccess blocks by content (they must match what the plugin last wrote), so plugin updates do not raise false alarms, while any edit inside those blocks by someone else still does. * Fixed: WordPress’s own translation files (`wp-content/languages/**.l10n.php`) were still reported as unknown PHP on most sites — the 1.1.1 rule missed the way WordPress joins text pieces inside those files. Verified against the real WordPress 7.1 German language pack. * Tested up to WordPress 7.1; abilities carry the new WordPress 7.1 `public` flag. #### 1.1.1 * Fixed: the first Sentinel scan no longer floods the report with harmless files. Two classes learned from the field: WordPress translation caches (`wp-content/ languages/**.l10n.php` — files that only hand back text and can not run anything; the content is checked, the name alone earns nothing) and the working folders of installed backup plugins (UpdraftPlus, BackWPup, Duplicator, All-in-One WP Migration — they hold full copies of the site’s own code). A backup folder on a site WITHOUT that backup plugin is still reported. #### 1.1.0 * Added: Sentinel security monitoring (opt-in, new “Monitoring” tab, off by default). When switched on, the companion app can ask this site for the signs of a break- in: unexpected PHP files where none belong, changes to .htaccess / wp-config. php (structural view only — values, database credentials and salts never leave the site) / must-use plugins / drop-ins / .user.ini / index.php, and new administrator accounts. Nothing runs in the background and no visitor request is slowed down; the app asks, the site answers within a time budget. The tab lists exactly what leaves the site. * Added: on-demand core and plugin checksum verification against WordPress.org ( part of Sentinel). * Harmless PHP files are left alone: WordPress’s empty “Silence is golden” placeholder files and data files that stop on their first line are not reported as unknown PHP (part of Sentinel). * Added: WP-CLI command `wp wpma connect-url` — prints the app connection URL for a chosen administrator, so a site can be (re)connected without a wp-admin login. * Added: the emergency companion now answers `/wpma/v1/auth-echo` (whether an authorization header reached PHP — no values), so the app can tell “credential removed” from“ server strips authentication” instead of guessing. * Improved: sites that switch the REST API off for visitors (Profile Builder “Private Website”, CMP Coming Soon, Solid Security “Restricted Access”, the Disable REST API plugin, membership plugins) can now connect: the plugin lets only its own` wpma/v1` routes through such blockers, only for anonymous requests, and every route still enforces its own authentication. * Improved: Connect now checks that the site’s REST address actually answers before handing it to the app, and falls back to the always-working `?rest_route=` form when rewrites are broken; a notice recommends “Post name” permalinks. * Improved: the Hardening tab now shows an unsaved-changes state and asks before you leave with unsaved switches. * Improved: the heartbeat carries the .htaccess self-heal counters, so the app can spot a stripped hardening block even when the main plugin is inactive. #### 1.0.3 * Added: the hardening rules block in .htaccess is now watched. If something outside the plugin removes it — a mass-compromise rewrite, a host restore, an “optimizer” plugin — it is re-applied from your current hardening settings within the hour, on ordinary site traffic, without touching any other block in the file. Every heal is counted and logged so you can see it happened. Nothing changes if hardening is off, the kill-switch is engaged, or the site does not run on Apache/LiteSpeed. #### 1.0.2 * Added: new hardening switch “Disable REST Batch Endpoint” — removes WordPress’s/ batch/v1 REST route, which lets one web request carry up to 25 actions and is abused by attackers to multiply login-guessing attempts and mass-edit content. Off by default. Note: the block-based Appearance Widgets screen saves through this endpoint — if you edit widgets there, leave the switch off or manage widgets via the Customizer or the Classic Widgets plugin. #### 1.0.1 * Fixed: connecting to the companion app failed on hosts whose PHP lacks the sodium extension (“Could not initialize the site signing key”). The crypto runs fine on WordPress’s bundled fallback; a non-essential memory-wipe call no longer aborts it. * Fixed: the deactivate dialog could be double-submitted during teardown, causing a fatal error — first click now locks the dialog, and the server rejects overlapping teardowns. * Improved: connect failures are now recorded in the plugin’s diagnostic log with the exact failing step. * Improved: the “Bad User-Agent Blocklist” rule now supports a per-site “Allowed user agents” exception list, and its description warns that Python/Go scripts on default settings are blocked. * Improved: the site report now states whether the sodium PHP extension is available. * Improved: connecting to the app opens in a new browser tab, keeping wp-admin in place. * Added: Connect | Harden | Coming Soon quick links on the Plugins page. #### 1.0.0 * Initial public release. * Pre-update snapshot and per-item rollback for plugins, themes, core, and the database, with an archive of recent runs. * Security and anti-bot hardening toolkit — security headers, xmlrpc / sensitive- file / author-enum protection, block PHP execution in uploads, optional PIN login gate — with automatic .htaccess backups and an FTP kill-switch. * Site stack and health reporting; one-at-a-time updates with per-step health checks; cache flush; error-log tail. * Animated Coming Soon page and maintenance mode. * Registered with the WordPress Abilities API (WP 6.9+) so MCP-capable assistants can discover the tools. * Optional, consent-based pairing with the Kreiswolke companion app for orchestrated multi-site maintenance. ## Meta * Versione **1.1.2** * Ultimo aggiornamento **3 settimane fa** * Installazioni attive **50+** * Versione WordPress ** 5.6 o superiore ** * Testato fino alla versione **7.1.3** * Versione PHP ** 7.4 o superiore ** * Lingua * [English (US)](https://wordpress.org/plugins/kreiswolke-maintenance-agent-toolkit/) * Tag * [backup](https://it.wordpress.org/plugins/tags/backup/)[maintenance](https://it.wordpress.org/plugins/tags/maintenance/) [rollback](https://it.wordpress.org/plugins/tags/rollback/)[security](https://it.wordpress.org/plugins/tags/security/) [updates](https://it.wordpress.org/plugins/tags/updates/) * [Visualizzazione avanzata](https://it.wordpress.org/plugins/kreiswolke-maintenance-agent-toolkit/advanced/) ## Valutazioni Non sono state ancora inviate recensioni. [La tua recensione](https://wordpress.org/support/plugin/kreiswolke-maintenance-agent-toolkit/reviews/#new-post) [Vedi tutte le recensioni](https://wordpress.org/support/plugin/kreiswolke-maintenance-agent-toolkit/reviews/) ## Collaboratori * [ KREISWOLKE ](https://profiles.wordpress.org/basic777/) ## Supporto Hai qualcosa da dire? Ti serve aiuto? [Chiedi nel forum di supporto](https://wordpress.org/support/plugin/kreiswolke-maintenance-agent-toolkit/)