Packages

Site software page shows an overview of all the software components your site has been built with.

To see an overview of all your site’s software, navigate to Sites > yourdomain.com > Packages in Patchstack App. This tab used to be called Software.

Updating from here is included in every plan, including Personal (Free).

The following actions are available only for WordPress CMS:

Have an overview of software your site is using and see all your software versions
See if any of the software is found vulnerable or outdated, how many vulnerabilities each one has, and whether Patchstack is already mitigating them
Click the Vulnerabilities cell to read the advisory behind it. Where a package has several, the arrows at the top of the panel move between them
Update, activate, deactivate, or delete the existing plugins/themes
Update all your software with one click
Force resynchronization between Patchstack App and your site if something looks out of sync

To perform any actions with specific plugins or themes on your site, follow the steps below:

Check the checkboxes of your plugins or themes (at the left side of the table row)
Click on the Actions button next to the search bar
You can then pick one of the following actions:
- Update
- Activate
- Deactivate
- Delete

Click a column header — Status, Type, Package, Vulnerabilities or Version — to sort the table by it; click again to reverse the order. Sorting by Vulnerabilities puts the most urgent first: unprotected vulnerabilities by priority, then mitigated ones, then everything else.

Software that is grayed out, is currently either deactivated on the website. If the checkbox is missing for that row, it means this software cannot be updated via third party apps like Patchstack. This goes for some of the premium licensed software, which use non-standard updating mechanisms.

Update all your software with one click

You can update components altogether by clicking the Update all button.
Just keep in mind to back up your files and database before doing that.

To update across all your sites at once, use the Packages overview.

Automatic updates

Patchstack no longer updates plugins, themes or core automatically, and there is no setting to switch it on. Instead, Patchstack protection blocks attacks on known vulnerabilities with virtual patches, without changing your site, so you decide when to update. Protection is included in paid plans and costs $5 / site per month on the Personal plan.

If you want automatic updates, use the ones built into WordPress: on your site’s Plugins screen, click Enable auto-updates next to a plugin.

If you switched on Patchstack’s automatic updates before they were retired, they keep running until you turn them off. The Packages tab of that site shows a note saying auto-updates are enabled, with a Turn off auto-updates link. Click it to switch them off.

Whether you are protected

A list of vulnerabilities reads as a list of things to do, which is wrong when Patchstack is already blocking attacks on them. A summary above the table says which of three states the site is in:

State	What it means
No known vulnerabilities	Nothing installed matches a vulnerability Patchstack knows about.
Mitigated	Every vulnerable component is covered by a vPatch, and protection is on for this site. Attacks are blocked; there is nothing you need to do right now.
Not mitigated	At least one vulnerable component has no virtual patch behind it, or protection is switched off for the site.

Individual rows say the same thing: a component covered by a virtual patch shows Mitigated in place of its patch priority, and its version is no longer shown in red. The priority moves into the tooltip, along with a reminder of what mitigation does and does not do.

Mitigated is not fixed. A virtual patch blocks attempts to exploit the vulnerability. The vulnerable version is still installed, and updating it is still the permanent fix.