Plugins, themes & users

The Manage group of a WordPress site — Plugins (/sites/:srv/:dom/plugins), Themes (/sites/:srv/:dom/themes) and Users (/sites/:srv/:dom/users) — is a full replacement for the equivalent wp-admin screens: install, activate, update and delete extensions, and run the complete WordPress user lifecycle, all without a WordPress login. It’s available on all plans wherever the site’s agent is online.

Install a plugin, step by step

1. Open a site and pick Plugins from the side menu.
2. Click Install plugin to open the install panel.
3. Choose how to install:
   • Search wp.org — type two or more characters to search the WordPress.org directory live; each result shows its icon, rating, active-install count and version. Click Install on the one you want.
   • Slug / URL — paste a directory slug (akismet) or an https://….zip URL, or use the upload button to send a .zip from your computer.
4. Leave Activate after install ticked to switch it on immediately (default), or untick to install it dormant.

The new plugin appears in the list; the row’s status dot and badges reflect its state.

What else you can do

Plugins — a searchable, selectable list of every installed plugin:

• Filter by All / Active / Inactive / Update available / Must-use & drop-ins, and search by name or slug.
• Activate / Deactivate a plugin from its row (hover to reveal, or tap the ⋯).
• Update a single plugin from its row, or Update all from the toolbar when updates are pending.
• Delete an inactive plugin (active plugins must be deactivated first).
• Bulk actions — select rows to reveal a floating dock: Activate, Deactivate, Update and Delete the whole selection at once.
• Refresh re-reads plugins and available updates live, bypassing the cache.

Themes — a visual grid of preview cards (each shows the theme’s own screenshot):

• Filter by All / Active / Inactive / Update available and search by name.
• Activate an inactive theme directly from its card, or Update it when an update is available; Update all lives in the toolbar.
• Install theme opens a full-width WordPress.org browser plus slug / URL / .zip install.
• Click a card (or its Manage & customize button) to open the theme drawer: details, activate/update/delete, and a Customize block. For the active theme you can edit Site identity & homepage (title, tagline, site icon, what the homepage shows) and, for classic themes that support them, Colors & background — all in-panel. Everything else deep-links into the live Customizer (classic themes) or Site Editor (block themes).

Users — the full WordPress user list:

• Filter by role (Administrator / Editor / Author / Contributor / Subscriber) and search by name, username or email; each row shows role and published-post count.
• New user / Edit open a drawer with the complete WordPress field set — names, nickname, “display name publicly as”, email, website, bio, role, language, and a password field with a strong-password generator.
• Reset password and change role in bulk from the selection dock; reset passwords are shown once in a copy-them-now dialog.
• Delete a user — you must pick another user to reassign their content to, so posts and pages are never lost.
• Application passwords — on an existing user, create and revoke per-app passwords for REST / XML-RPC clients (the secret is shown once, and needs HTTPS).

How it works

Everything on these pages runs through the site’s agent — no WordPress login, no child plugin, no page-builder dependency:

Area	What drives it	Agent runs
Plugin & theme inventory	the site.stats job (cached, shared with Overview)	reads installed items + available updates via WP-CLI
Install / activate / deactivate / delete	wp.item	wp <domain> <plugin|theme> <action> <name>
Update one/many/all	wp.update	wp <domain> update <plugins|themes> [--names …]
Native theme customize (identity/homepage)	wp.content → wp/v2/settings	WP REST via the bundled mu-plugin
Theme colors & background	wp.thememod	reads/sets WordPress theme mods
User list	a fast direct-DB read	one query returns users + their post counts
User create / edit / delete	wp.content → wp/v2/users	WP REST (admin context) via the mu-plugin

Plugin and theme metadata (icons, descriptions, ratings, wp.org links) is enriched from the WordPress.org directory through the control plane, so premium or custom items simply fall back to a glyph with no description. The inventory is cached on the box for instant loads; Refresh forces a live, cache-bypassing recompute.

CLI & automation

Every action maps to an mz command on the box — the same engine the dashboard drives. SSH in and run them, or let an on-box AI (ClaudeCode) run the same commands:

mz wp <domain> updates --json                          # pending core/plugin/theme updates
mz wp <domain> plugin install akismet --activate --json # install + activate a plugin
mz wp <domain> plugin activate akismet --json          # activate / deactivate / delete
mz wp <domain> update plugins --names akismet,jetpack --json  # update specific plugins
mz wp <domain> theme activate twentytwentyfour --json  # switch the active theme
mz wp <domain> content POST wp/v2/users --data '{"username":"jane","email":"[email protected]","password":"…","roles":["editor"]}' --json

Omit --names to update every plugin (or theme). Always pass --json for machine output. See The mz CLI and the command catalog.

Gotchas & troubleshooting

• Must-use plugins and drop-ins can’t be managed here. The MZPanel agent mu-plugin, a Redis object-cache.php drop-in and similar special files are hidden by default and are reachable only via the Must-use & drop-ins filter — they show a lock badge and no controls, because WordPress loads them automatically. Manage them on the filesystem.
• You can’t delete an active plugin or the active theme. Deactivate the plugin first; for a theme, switch to another one, which “deactivates” it (WordPress always has exactly one active theme).
• Bulk delete skips active plugins. Deactivate them in the same selection first, then delete.
• “Activate after install” doesn’t apply to themes yet. The checkbox shows on the theme installer, but a freshly installed theme is not auto-activated — activate it from its card or drawer afterward. (Plugins do honour it.)
• Deleting a user needs a reassign target. If a site has only one user, delete is blocked until there’s another account to inherit the content.
• Theme colors & background are for classic themes only. Block (FSE) themes don’t expose theme mods — their colors, typography and templates live in the Site Editor, which the drawer links to.
• Needs the agent online. These pages read and write live through the agent; when the box is offline the site shell shows an “agent offline” banner and last-known values, and mutations are unavailable.

Related

• Site overview — the per-site health cockpit and pending-update count.
• The mz CLI — driving a site from the command line.
• Command catalog — every mz domain and action.