PatchOn Agent

PatchOn is an AI service that runs WordPress plugin, theme, and core updates for you. It reproduces your production setup in a staging environment, inspects the updates there — including a screenshot comparison — and lets AI judge whether anything breaks. Only updates that pass every check are applied to production. You can also enable scheduled automatic updates (weekly on paid plans, an opt-in monthly run on Free), and if an update ever fails, one click restores your site. This plugin acts as the connector between your WordPress site and PatchOn. This plugin requires the PatchOn service (patchon.jp) and does not function on its own. No account is required to get started. Immediately after activation it performs no external communication and does not redirect you. Opening PatchOn shows a welcome screen that introduces the service and lists updates detected locally on your site. Outbound communication with PatchOn begins only after the user explicitly clicks "Start PatchOn" and then confirms with "Agree and Start" in the consent dialog, which registers the site anonymously and, if updates are available, starts the first inspect-and-update run. A PatchOn account is needed only to view detailed inspection results in the dashboard, configure automatic updates, or upgrade to a paid plan. Main Features

• Pre-inspection — in a staging environment, AI compares before / after screenshots of your site to catch layout breakage and fatal errors, with results displayed in your dashboard
• Inspect and update — a manual run goes from inspection to production rollout in one action, applying only updates that passed every check
• Automatic updates with inspection (opt-in) — the site is inspected on a schedule and only updates that passed every check are applied
• Backups — taken automatically right before each update and downloadable for a plan-based retention period
• One-click restore — if an applied update fails, one click puts your site back to the pre-update backup

This plugin (the free distribution on WordPress.org) does not write patched code to your site files (wp-content, mu-plugins, theme directories, etc.), even when it detects a problem. AI auto-repair, which writes patched code to mu-plugins or the active child theme, is provided by the separately distributed PatchOn Agent Pro extension plugin (available to PatchOn Standard / Business plan subscribers). Apart from applying the updates themselves through the standard WordPress upgrader, the only case in which this plugin writes to your site files is the one-click restore: run only on your explicit request after a failed update, it writes your own backed-up plugins, themes, MU plugins, and wp-content drop-ins (and your database) back to the site. Data Sent After the user has consented on the consent screen, when they run a "Pre-inspection" or "Apply update" operation, the plugin sends the following data to PatchOn and related external services. See the Privacy Policy for details.

• Site URL / WordPress version / PHP version / DB version
• List and versions of installed plugins, themes, and MU plugins
• List of available updates (names and versions of plugins, themes, and WordPress core). While the site is connected, this is sent automatically once a day (daily check-in).
• Site files prior to update application, used for the pre-update backup: wp-config.php, active and to-be-updated plugins and themes, MU plugins, and wp-content drop-ins (such as object-cache.php)
• Contents of WordPress debug.log (used to detect issues)
• A full copy of your site's database (taken at pre-inspection time and reused as the restore base before updates). It may include personal data stored on your site, such as member accounts or contact-form submissions; see the Privacy Policy.

A manual "inspect and update" run applies updates that passed every check to production after a backup has been created; on your first run, nothing is applied until you review the results and confirm the inspected URLs on the results screen. If you enable automatic updates, the plugin runs the pre-inspection automatically on the configured schedule and sends the same inspection data (site files and database copy) at that time. When the apply mode is set to automatic, updates that passed every check are applied to production after a backup has been created; updates that needed AI repair or require review are never applied automatically. Automatic updates can be turned off at any time.

1.2.0

• New: automatic updates (scheduled inspections). Paid plans run the pre-inspection automatically once a week (day and time slot configurable); the Free plan can opt in to a monthly run. The schedule is coordinated through a once-daily check-in that reports the list of available updates, and results arrive as a per-run inspection report email.
• New: automatic application of safe updates. When the apply mode is set to automatic (the default for automatic updates), updates that passed every check are applied to production after a backup has been created. Updates that needed AI repair, require visual review, failed, or could not be inspected are never applied automatically; a manual-only mode is also available.
• New: one-click restore. If applying an update fails, the update screen now offers a one-click restore that puts your site files (plugins, themes, MU plugins, and wp-content drop-ins) and database back to the pre-update backup, with progress display and a cancel button. The restore self-drives in the background, so it keeps running even if you close the tab.
• New: streamlined manual flow ("inspect and update"). A manual run now inspects the selected updates in staging and, when every check passes, applies them to production in the same run. The separate inspection-only action was removed; servers where updates cannot be written automatically (FTP-based file access) fall back to inspection only.
• New: inspection URL confirmation. The URLs used for the visual regression test are now registered automatically when you start, and your first run stops at the results screen for you to review and confirm them before anything is applied; subsequent runs reuse the confirmed URLs unattended. The auto-extract button on the settings screen was removed accordingly.

1.1.5

• Fixed a bug where applying several plugin or theme updates in one run could silently skip some of them — only the first item would update, while the rest were reported as successful but left unchanged. This happened intermittently when a background WordPress update check (triggered by page views, progress polling, or scheduled tasks) cleared the pending-update information mid-run. The update run now pins that information for its whole duration, so every selected plugin and theme is applied reliably.
• Hardened how AI-repaired customizations are written back to production. The fix files (for site-specific code that would otherwise break on an update) are now applied only after the corresponding plugin or theme update has actually succeeded, and after the update completes rather than before. Previously, if an update did not go through, the new-version fix could still be written, leaving the live customization mismatched with the still-installed older version.
• Fixed a rare bug where applying an update could stall right after the pre-update backup finished, leaving nothing actually updated. This happened when the internal hand-off to the update service was interrupted (for example by a slow first response or a host request limit) during that brief window: the run could get stuck and never retry on its own. The hand-off is now retried automatically, and a stalled run still self-recovers to a retryable state. No partial update could occur — when this happened, no plugin or theme had been changed yet.

1.1.4

• Pre-update backups now capture the database incrementally. Instead of re-uploading the entire database on every update, the backup reuses the unchanged parts of the most recent pre-inspection snapshot and sends only the rows that changed, dramatically reducing the backup phase on large sites. A built-in self-verification step falls back to a full dump whenever anything looks inconsistent, so a backup is never shipped in a partial state.
• Dramatically faster backup archiving before pre-inspections and updates. The previous implementation rewrote the entire archive for every file added, causing quadratic I/O; archives are now built in a single pass, reducing the backup phase from minutes to seconds on sites with thousands of plugin and theme files.
• Clearer guidance during the pre-update backup on the update screen. The screen now indicates whether a fast incremental backup (reusing the latest snapshot) or a full backup is in progress, and asks you to keep the tab open until it finishes. This replaces the previous message that incorrectly implied the resumable backup always continued after closing the tab.
• Fixed a bug where inspection target URLs with non-ASCII slugs (such as Japanese permalinks) were corrupted on save: percent-encoded characters were stripped during input sanitization, leaving only the ASCII portion of the path. URL input is now sanitized with esc_url_raw(), which preserves percent-encoding.
• Canceling a pre-inspection now also stops it on the backend (the staging worker), so you can re-run immediately instead of being blocked by an "a pre-inspection is already running" error. The cancel button is no longer shown during the production update step itself, where the update cannot be safely interrupted.
• Large pre-update backups now continue on the server even if you close the browser tab. Previously the resumable backup of a large database was driven by the open admin tab and paused when you navigated away; it now self-drives via background loopback requests, with a scheduled health-check that restarts a stalled run on sites that receive traffic.
• Fixed a bug where a plugin that was active before an update could be left deactivated after the update finished. Plugins that were active beforehand are now reactivated once their update completes.
• Updates that require a newer PHP or WordPress version than your live site actually runs are now detected on your site and excluded from the update run, instead of being applied and silently breaking the site. The pre-inspection also reports your site's PHP version and key limits so results better match your real environment.
• Updates that could not be inspected (for example, when no inspection result is available) are no longer applied to your production site. Only updates that were actually inspected and verified are included in the update run.
• Corrected the consent screen to accurately describe the data sent during a pre-inspection: it now states that your site's files and database are sent, replacing wording that implied parts containing personal information were excluded.

1.1.3

• Updates on every plan now create a backup (site files and a full database dump) before applying changes, stored in PatchOn cloud storage with a plan-based retention period and downloadable from the update screen for self-service recovery. The consent screen and privacy policy have been updated to cover this storage.
• Fixed multiple bugs where a failed update could be misreported as successful, including copy failures during the upgrade, concurrent update runs leaving maintenance mode stuck, stale update caches, and a locale-dependent misclassification on Japanese sites.
• The Pro extension required for applying AI repairs can now be installed and activated with one click from the update screen, with clearer guidance when a license is missing or expired.

1.1.2

• Removed direct require_once of WordPress core loading files (wp-includes/functions.php, wp-admin/includes/theme.php, wp-admin/includes/misc.php) in response to plugin review feedback.
• Disabled autoload for frequently updated options (patchon_update_state, patchon_update_flash, patchon_site_uuid) to reduce per-request overhead.
• Escaped all remaining dynamic output (a ternary expression and update/log counts) with esc_html() to comply with the late-escaping convention.
• Updated "Tested up to" to WordPress 7.0.

1.1.1

• Replaced direct cURL calls in the backup upload path with the WordPress HTTP API (wp_remote_request()), using the official http_api_curl hook to enable streaming uploads of large backup archives without buffering in memory.

1.1.0

• Removed file write capabilities (no longer writes to wp-content, mu-plugins, or theme directories). Such writes were moved to the separately distributed PatchOn Agent Pro extension plugin.
• Added an explicit consent screen shown on first activation. The plugin now registers your site anonymously after consent, and no account is required to get started.
• Added CSRF nonce verification on the connection flow to prevent site hijack via crafted redirect URLs.
• Updated plan tiers (Free / Standard / Business) and removed the legacy Enterprise tier from the catalog.

1.0.0

• Initial release on the WordPress.org official directory.