Hosting Platform API

We manage about 60 client sites on a variety of hosting platforms. On October 21st we noticed that the majority of hosting providers (Pair Networks, Siteground, Kinsta and others) had updated to the patched PHP on their servers by mid-morning but WP Engine's servers were not updated until after 5:30 PM. We see similar lagging update times when WordPress core security patches are released. All our sites that are set to auto minor WP updates on other hosts self-update much sooner than WP Engine sites, which can take a day or more longer to update. With the growing threat of AI-driven hacks, we are likely to see more frequent critical updates like this. We understand there is a small risk of site malfunction when applying a minor update, but we feel a broken site is better than a hacked site. Will WP Engine consider adopting a more rapid update policy? Or allow us to bypass your control of auto core updates and configure it ourselves in wp-config or via other means? We realize we can log in and 1-click update but WordPress only offers 1-click updating to the latest version, and a site may be running on an older major version (e.g. 7.0.7 vs. 7.1.3) and we may not have the time to do a major version jump and fully review the site for any impacts. Timely auto minor updates ensure sites stay patched with less chance for disruption.

When I go to https://my.wpengine.com/installs/[my_instance]/plugins_and_themes#plugins I can see a list of the plugins installed in my site, and also in the Status column I can see those plugins that need to be updated and even those that present security risks. I think it would be good to have something like an API endpoint we can use to automate alerts when security risks are detected without having to open the WPE dashboard.

Since vanilla Cloudflare allows API access to update its rules, I was disappointed to learn that there's no such API support for the Web Rules in the user portal. This ability would allow greater flexibility in managing these rules across sites, rather than one site at a time. It would also allow us to automate some processes and reduce manual effort when rules need to be updated.

It would be great to have an access logs api endpoint to have the ability to ingest access logs directly into my platform, to help with analysis of access from search engines. Much like what is offered here by a competitor https://kinsta.com/blog/api-server-logs/

Hi, I would like to be able to sync an environment via API from a CD/CI if possible.

It would be incredibly useful for enterprise customers if there were an API endpoint for getting the WP Engine user audit activity. We would like to pull this data into our SIEM so that we can create alerts on anomalous activity.

This will enable us to create automation

Would be great to be able to Read or fetch status for Products (like failed updates SPM), Site Monitoring etc. Or get the performance insights data. Or get the Sites general information. This way we can have an overview for our account instead of visiting each page.

The wp-config.php generated for WP Engine installs replaces the standard WordPress marker comment / That's all, stop editing! / with custom wording (# That's It. pencils down). WP-CLI's wp config set matches the standard comment as a literal string for its default placement anchor, so the substitution causes the command to fail on every install with "Unable to locate placement anchor". Please restore the standard marker — or, if the custom wording is deliberate, emit it in addition to the standard comment. Either restores compatibility with wp config set and the wider tooling ecosystem built on wp-cli/wp-config-transformer, with no functional change to the file. If amending the template isn't possible, please confirm the officially supported method for adding constants to wp-config.php at scale across an account's installs.

A user should be able to create an api key with fine grained permissions, up to their roles permissions(if enabled) vs an owner only being able to create owner api keys.