Frequently asked questions

Manage GPL is a hosted dashboard that connects to multiple WordPress sites and lets you keep premium plugins and themes (from the GPL Times catalog) up to date with one click. Think of it as ManageWP, focused specifically on premium GPL software.

No. Manage GPL is a management dashboard — we didn't author any of the third-party plugins or themes that appear in the catalog and we're not affiliated with, endorsed by, or sponsored by their developers. Trademarks and plugin names are used only for identification and remain the property of their respective owners. We also don't host the plugin/theme files ourselves — premium items stream from gpltimes.com, free items from WordPress.org. The only software we author and distribute is the Manage GPL Connect connector plugin that pairs your site to the dashboard.

Anyone running more than one WordPress site: developers, agencies, freelancers managing client sites, or hobbyists with a personal portfolio of WP installs.

No. The Free plan is genuinely free — you can connect up to 5 sites, see what's installed on each, run WordPress.org updates, and use SSO login. Upgrade only if you need premium plugin updates, bulk operations, uptime monitoring, whitelabel, or more than 5 sites.

Sign up: 30 seconds. Connecting your first WordPress site takes either under 30 seconds (Automatic — we install the connector for you using your wp-admin login) or about 2 minutes (Manual — you download the plugin, install it, copy the token from its settings, paste it into Manage GPL). After that you can connect each additional site just as fast.

There are two ways to pair a site, both under Add site in your dashboard:

Automatic — the fastest path for sites where you have a wp-admin password handy. You enter the site URL plus wp-admin username and password; we log in over TLS, upload and activate the connector plugin, read back the pairing token, and complete the handshake. Takes under 30 seconds. Credentials are used once for that single install request and never persisted. Not available for sites with 2FA, login CAPTCHA, HTTP basic auth, or HTTP-only (non-HTTPS) sites.

Manual — works on every WordPress install. You download our Manage GPL Connect plugin, install it via Plugins → Add New → Upload, activate it, then open Settings → Manage GPL Connect to see the one-time pairing token it generated. Copy that token and paste it with the site URL into Manage GPL's Manual tab to finish the pairing.

Both flows end in the same place: the plugin exposes a small HMAC-signed REST API so we can read the list of installed plugins and themes on demand and send update commands. There's no admin password sharing — the automatic flow's credentials live only in memory for the one install request, and the manual flow doesn't use them at all.

WordPress 5.6 and newer. PHP 7.4 and newer. Tested up to WordPress 6.7.

No. The plugin is small (~50 KB zip) and only does anything on admin or REST requests — the list of installed plugins and themes is sent only when we ask for it (when you open the site in the Manage GPL dashboard). Nothing runs in the background on front-end page loads, and there's no WordPress cron dependency.

Two ways, both clean:

From Manage GPL (recommended) — open the site's page, click Delete site and type DELETE to confirm. That removes the site from your account (freeing the slot under your plan's site limit) and revokes our server-side HMAC secret, so we can no longer talk to the site. The connector plugin stays installed on WordPress — if you want to clean it up, deactivate and delete it from Plugins in wp-admin afterwards.

From WordPress — open Settings → Manage GPL Connect and click Regenerate token. The plugin pings us to drop our row, then rotates both the token and HMAC secret on the WP side. Same end result: site removed from your account, slot freed.

Yes. Delete the site from the old account first (or click Regenerate token in the connector's WP admin settings — either drops our row). Then sign into the new account and go through the normal Add site flow with the current token from the connector.

Yes — and it works on every plan, including Free, with no extra cost. You pair the whole network with one token (the connector must be Network Activated, not per-blog). After pairing, every sub-blog appears in a picker on the network's page so you can install plugins network-wide, scope an install to one specific blog, or SSO into any sub-blog's admin in one click. A whole network counts as one site against your plan limit, no matter how many sub-blogs it contains. Read the full guide: Manage a WordPress Multisite network.

We use the same WordPress upgrade APIs (Plugin_Upgrader / Theme_Upgrader) that WP itself uses. Each download is HMAC-signed and time-limited. That said, any plugin update can occasionally cause a regression on a specific site — we strongly recommend keeping backups (e.g., via UpdraftPlus or your host's snapshots) before pushing bulk updates.

Yes, on Developer and Agency plans. Open Settings → Schedule Updates, pick the days of the week, the hour, and the timezone. Choose to update all plugins & themes or a specific whitelist. A per-site override at Sites → [site] → Schedule Updates replaces the global schedule for that one site. Minimum cadence is once per day — we don't allow sub-hour granularity because it adds load without adding value. You get a failure email by default; success emails are opt-in.

Yes. On any plugin or theme row in our catalog, click the swap-arrows button to toggle that one slug to use the vendor's own update feed instead of GPL Times. You can do it per-site (from the site's Plugins/Themes page) or globally for every site you own (from the cross-site Plugins page in the main sidebar). When opted out, the item moves to the Other category, the connector downloads directly from the vendor's URL, and the can_update plan paywall doesn't apply — even Free-plan accounts can run those updates because we're a passthrough, not a catalog. Read the guide.

Each download URL is signed with HMAC-SHA256 using a per-site shared secret and a 60-second timestamp window, plus a short-lived per-(site, item, version) token. The connection plugin verifies the signature and window before unzipping, which prevents anyone else from grabbing premium plugin ZIPs through your site.

Never. The connection is purely token-based. The plugin stores a per-site auth token (which we hash on our side) and an HMAC secret (used only for verifying inbound requests from us).

From the GPL Times catalog at www.gpltimes.com. We track 6,500+ items, refreshed hourly. We do not host pirated copies of premium software — we only redistribute software that GPL Times has the right to redistribute under GPL.

Free: connect up to 5 sites, see what's installed on each, see what's outdated. Developer ($99/yr): up to 50 sites + actual updates + bulk operations + SSO login + activity log + health checks. Agency ($199/yr): up to 1,000 sites + everything in Developer.

Yes, anytime from your billing dashboard. Upgrades take effect immediately and are prorated. Downgrades take effect at the end of your current billing period.

Click "Cancel subscription" in your billing dashboard. Your access continues until the end of your current paid period, then your account drops to Free with all your data intact.

Stripe retries the charge automatically for a few weeks and emails you each time. Your features stay active during this retry window. If every retry fails, your subscription ends and your account drops to Free — your sites stay in your account but any over the 5-site Free limit are automatically paused until you re-subscribe.

3-day money-back guarantee on initial purchase. See the full Refund Policy.

On servers in the EU (Germany). Nightly encrypted backups go to cloud object storage.

No. We do not sell, rent, or share your data with anyone except the third-party processors strictly required to operate the service (Stripe for payments, Cloudflare for DDoS + Turnstile, plus our email delivery and cloud hosting providers). See our Privacy Policy.

Email [email protected]. We delete all personal data within 30 days, except where retention is legally required (e.g., paid invoice records).

Most common cause: your hosting blocks outbound HTTPS to managegpl.com. Try the connection button in WP admin again; if it still fails, ask your host to whitelist our domain. Less common: the connection token expired — generate a new one from the Add Site page.

Open the site detail page in your dashboard and check the activity log for the error message. Most failures are due to filesystem permissions on the WP host, a plugin conflict, or PHP timeouts on slow connections. We don't auto-retry failed updates — once we have the error from your server, you retry manually after fixing the underlying cause. See When an update fails for a full playbook.

Use the "Forgot password" link on the login page. If you no longer have access to your account email, contact [email protected] from any address you control and include details that help us identify your account.