Product Update v3.28.0: Affiliate Portal, a Rebuilt Buy Domain, and a Deep Reliability Sweep

v3.28.0 is a release about earning and about trust. You can now run a full affiliate program from inside InstaWP, with a public application form, a promoter dashboard, campaign URLs and visitor-to-conversion tracking. Buying a domain has been rebuilt into a single dedicated page with one unified search, and documentation now lives inside the dashboard instead of behind a tab.

Underneath that, this is one of the deepest reliability sweeps we have shipped. Migrate V4 is now half the price, 2-Way Sync is free, and a long list of billing, domain, hosting and CDN issues have been put to rest; including a Bunny Shield rule that was quietly 403ing every WordPress RSS feed across the fleet.

Here is everything in this release, in order of impact.

Key Takeaways

What’s New

#1: Affiliate Portal

You can now run a complete affiliate program on InstaWP, end to end.

There is a public application form for people who do not have an account yet and an authenticated one for existing users, both feeding an admin approval step. Once approved, promoters get their own dashboard under Sell > Affiliates with campaign URLs they can share and full visitor→lead→conversion tracking, so they can see exactly what their traffic turned into. Programs carry their own authored pitch, and lead emails keep promoters in the loop as activity comes in.

#2: Buy Domain, Rebuilt

Buying a domain is now a dedicated page built around a single unified search.

The old flow spread searching, checking availability and buying across different surfaces. Now you type once, see what is available, and buy from the same place. It is a smaller, more predictable path from “I want this domain” to owning it.

#3: Help Center Inside the Dashboard

A new Help Center with embedded documentation replaces the old Articles tab.

Instead of bouncing out to a separate site to look something up, the documentation is served inside the dashboard where you are already working. Fewer tabs, and the answer is next to the thing you are trying to do.

#4: On-Demand WordPress Version Refresh

You can now refresh a site’s reported WordPress version on demand, from both the site page and the dashboard card.

Previously the version shown could lag behind reality after an update made outside InstaWP. Now you can ask for a fresh read straight from the box, so what the dashboard says matches what is actually installed; useful when you are auditing a fleet of client sites before an update round.

#5: Sortable Sites and Manage Lists

The Sites and Manage lists can now be sorted by name, plan, disk, status or security, and the sort is persisted in the URL.\

Because the sort lives in the URL, the view you set up is a link. You can bookmark “my biggest sites by disk” or send a teammate the exact list you are looking at, and it opens the same way for them.

#6: Migration Emails for Every V4 Move

V4 migrations now email the account holder when a migration starts, completes or fails.

Migrations can take a while, and watching a progress screen is not a good use of anyone’s time. You get told when it is running, when it is done, and, importantly, when it failed, so a stalled move is something you find out about rather than discover later.

#7: One Toggle for SSH and SFTP

SSH and SFTP are now controlled by a single Enable SSH/SFTP toggle, replacing the two separate controls.

They were always the same underlying access, and having two switches for one thing made it easy to end up in a half-enabled state. One toggle, one state, and the setting now belongs to the site rather than to a particular user.

Improved

Migrations Cost Less and Sync Costs Nothing

Migrate V4 now costs $2 per migration, down from $4, and 2-Way Sync is no longer charged at all. If you move sites regularly, or keep a staging copy in sync with production, this is a direct cut to what you pay for the same workflow.

Reworked Rewards Page

The Rewards page has been reorganized, with clearer subtext on each reward and a static rules section, so what you earn and what qualifies is stated up front rather than inferred.

Automated Translations

Translations are now pulled automatically through a GitHub workflow instead of by hand, and 20 missing keys were backfilled across all 12 locales. If you use InstaWP in a language other than English, fewer strings fall back to English and new copy reaches your locale faster.

Fixed

Billing

This release corrects a cluster of billing display and calculation problems.

• Pay-per-use payment history: arrears invoices were dated a month early (1,710 affected rows, now corrected), the domain was hidden on domain purchases, and voided invoices were mislabelled as refunds.
• Usage and credit: invoices already covered by credit still showed as due, “Total Usage” did not match Estimated Due, and grace credit could be granted for an unpaid billing period.
• Plan pages: no longer 500 for past-due, invoice-billed subscriptions.
• WaaS orders: a successful order could be refunded when a later site creation failed. It no longer is.

Domains and DNS

Mapping a custom domain used to fail quietly. Now it fails loudly: the flow gates on the DNS zone actually being ready, drops conflicting records, and rejects duplicate A and AAAA records rather than leaving you with a half-mapped domain and no error.

A separate fix handles capitalisation — a mapped domain stored with capital letters failed every comparison and broke re-mapping. Domains are now lowercased before they are stored or forwarded on.

Sites and Hosting

• Disk usage reporting: site disk usage was being written to a place nothing read, so pool sites reported 0 MB for up to two hours after creation.
• REST user endpoint: the users_endpoint=off hardening option was also blocking /wp/v2/users/me, which broke import, InstaMigrate and InstaMCP on around 50 sites. The authenticated self endpoint is now exempt.
• Pool sites: lost their expired_at value when handed out, showing as “expired” with no Restore option.
• Site deletion: deleting a site left its domain records behind, permanently reserving the domain so it could not be reused.
• Web terminal: now opens in public_html rather than at the chroot root, so you land where your site actually is.

Edge and CDN

The most widely felt fix in this release: Bunny Shield was returning 403 on every WordPress RSS feed, fleet-wide. Feed readers, podcast clients and any integration polling /feed/ were being turned away. The same class of rule was also blocking /.well-known/ and REST calls made through ?rest_route=. All three now pass.

• ManageWP: was being bypassed via an IP list that went stale. The bypass is now keyed on ManageWP’s own worker header, so it keeps working as their infrastructure changes.
• CrowdSec: was banning our own Bunny origin-pull edges, which caused box-wide 504s. Those edges are now exempt.
• FlyingPress: cache preloads were being blocked by Shield, leaving the cache permanently empty; so a plugin you installed for speed was doing nothing.
• Backup fleet: the nightly reconciler was re-imaging the entire backup worker fleet every night. It no longer does.

Security

Site actions taken while impersonating an account are now recorded in the audit feed instead of being dropped. Anything done on your site, including by our team while helping you, leaves a trail you can read.

Final Thoughts

v3.28.0 opens up a way to earn from InstaWP and makes two everyday jobs, buying a domain and finding an answer, noticeably shorter. But the part we are most pleased with is the unglamorous half: feeds that were silently 403ing, caches that were never filling, disk numbers that read zero, and invoices dated a month wrong are all fixed.

Cheaper migrations, free 2-Way Sync, and a test suite that finally runs on every release round it out. For developers, agencies and resellers, that is a platform that costs less to move sites on and tells you the truth about what it is doing.

? Try the latest InstaWP updates now and build, host, manage and sell WordPress sites with less friction.