Plugins, themes & users

The Manage group of a WordPress site — Plugins (/sites/:srv/:dom/plugins), Themes (/sites/:srv/:dom/themes) and Users (/sites/:srv/:dom/users) — is a full replacement for the equivalent wp-admin screens: install, activate, update and delete extensions, and run the complete WordPress user lifecycle, all without a WordPress login. It’s available on all plans wherever the site’s agent is online.

Install a plugin, step by step

Open a site and pick Plugins from the side menu.
Click Install plugin to open the install panel.
Choose how to install:
- Search wp.org — type two or more characters to search the WordPress.org directory live; each result shows its icon, rating, active-install count and version. Click Install on the one you want.
- Slug / URL — paste a directory slug (akismet) or an https://….zip URL, or use the upload button to send a .zip from your computer.
Leave Activate after install ticked to switch it on immediately (default), or untick to install it dormant.

The new plugin appears in the list; the row’s status dot and badges reflect its state.

What else you can do

Plugins — a searchable, selectable list of every installed plugin:

Filter by All / Active / Inactive / Update available / Must-use & drop-ins, and search by name or slug.
Activate / Deactivate a plugin from its row (hover to reveal, or tap the ⋯).
Update a single plugin from its row, or Update all from the toolbar when updates are pending.
Delete an inactive plugin (active plugins must be deactivated first).
Bulk actions — select rows to reveal a floating dock: Activate, Deactivate, Update and Delete the whole selection at once.
Refresh re-reads plugins and available updates live, bypassing the cache.

Themes — a visual grid of preview cards (each shows the theme’s own screenshot):

Filter by All / Active / Inactive / Update available and search by name.
Activate an inactive theme directly from its card, or Update it when an update is available; Update all lives in the toolbar.
Install theme opens a full-width WordPress.org browser plus slug / URL / .zip install.
Click a card (or its Manage & customize button) to open the theme drawer: details, activate/update/delete, and a Customize block. For the active theme you can edit Site identity & homepage (title, tagline, site icon, what the homepage shows) and, for classic themes that support them, Colors & background — all in-panel. Everything else deep-links into the live Customizer (classic themes) or Site Editor (block themes).

Users — the full WordPress user list:

Filter by role (Administrator / Editor / Author / Contributor / Subscriber) and search by name, username or email; each row shows role and published-post count.
New user / Edit open a drawer with the complete WordPress field set — names, nickname, “display name publicly as”, email, website, bio, role, language, and a password field with a strong-password generator.
Reset password and change role in bulk from the selection dock; reset passwords are shown once in a copy-them-now dialog.
Delete a user — you must pick another user to reassign their content to, so posts and pages are never lost.
Application passwords — on an existing user, create and revoke per-app passwords for REST / XML-RPC clients (the secret is shown once, and needs HTTPS).

How it works

Everything on these pages runs through the site’s agent — no WordPress login, no child plugin, no page-builder dependency:

Area	What drives it	Agent runs
Plugin & theme inventory	the `site.stats` job (cached, shared with Overview)	reads installed items + available updates via WP-CLI
Install / activate / deactivate / delete	`wp.item`	`wp <domain> <plugin\|theme> <action> <name>`
Update one/many/all	`wp.update`	`wp <domain> update <plugins\|themes> [--names …]`
Native theme customize (identity/homepage)	`wp.content` → `wp/v2/settings`	WP REST via the bundled mu-plugin
Theme colors & background	`wp.thememod`	reads/sets WordPress theme mods
User list	a fast direct-DB read	one query returns users + their post counts
User create / edit / delete	`wp.content` → `wp/v2/users`	WP REST (admin context) via the mu-plugin

Plugin and theme metadata (icons, descriptions, ratings, wp.org links) is enriched from the WordPress.org directory through the control plane, so premium or custom items simply fall back to a glyph with no description. The inventory is cached on the box for instant loads; Refresh forces a live, cache-bypassing recompute.

CLI & automation

Every action maps to an mz command on the box — the same engine the dashboard drives. SSH in and run them, or let an on-box AI (ClaudeCode) run the same commands:

mz wp <domain> updates --json                          # pending core/plugin/theme updates
mz wp <domain> plugin install akismet --activate --json # install + activate a plugin
mz wp <domain> plugin activate akismet --json          # activate / deactivate / delete
mz wp <domain> update plugins --names akismet,jetpack --json  # update specific plugins
mz wp <domain> theme activate twentytwentyfour --json  # switch the active theme
mz wp <domain> content POST wp/v2/users --data '{"username":"jane","email":"[email protected]","password":"…","roles":["editor"]}' --json

Omit --names to update every plugin (or theme). Always pass --json for machine output. See The mz CLI and the command catalog.

Gotchas & troubleshooting

Must-use plugins and drop-ins can’t be managed here. The MZPanel agent mu-plugin, a Redis object-cache.php drop-in and similar special files are hidden by default and are reachable only via the Must-use & drop-ins filter — they show a lock badge and no controls, because WordPress loads them automatically. Manage them on the filesystem.
You can’t delete an active plugin or the active theme. Deactivate the plugin first; for a theme, switch to another one, which “deactivates” it (WordPress always has exactly one active theme).
Bulk delete skips active plugins. Deactivate them in the same selection first, then delete.
“Activate after install” doesn’t apply to themes yet. The checkbox shows on the theme installer, but a freshly installed theme is not auto-activated — activate it from its card or drawer afterward. (Plugins do honour it.)
Deleting a user needs a reassign target. If a site has only one user, delete is blocked until there’s another account to inherit the content.
Theme colors & background are for classic themes only. Block (FSE) themes don’t expose theme mods — their colors, typography and templates live in the Site Editor, which the drawer links to.
Needs the agent online. These pages read and write live through the agent; when the box is offline the site shell shows an “agent offline” banner and last-known values, and mutations are unavailable.

Site overview — the per-site health cockpit and pending-update count.
The mz CLI — driving a site from the command line.
Command catalog — every mz domain and action.