v3.23.0 is focused on reliability across the workflows developers and agencies depend on every day: migrations, SSL renewals, backups, Object Cache, CDN, and site restores. This release fixes fragile edge cases, adds better fallback paths, and improves how InstaWP handles database imports, custom-domain HTTPS, backup cleanup, 2FA login flows, and server-side operations.
Here is what you’ll find with this release.
Key Takeaways
v3.23.0 focuses on stronger migrations, safer restores, better SSL handling, and more reliable server-side workflows.
What’s New
#1: Backup Storage Audit
InstaWP now includes a daily backup storage audit command that compares backup records in the database with backup objects stored in S3.
This gives the team better visibility into backup consistency and helps identify mismatches early. For operators managing many hosted WordPress sites, this is the kind of behind-the-scenes reliability work that reduces surprises during restore or recovery workflows.
The audit also posts a daily Slack report, making backup health easier to monitor without manually checking records and storage objects.
#2: CrowdSec Self-IP Protection
Servers now include a parser-level whitelist for their own public IP address. This prevents servers from accidentally blocking their own loopback or proxy traffic through CrowdSec. In practical terms, this reduces the risk of self-inflicted 504 errors caused by the server banning itself.
It is a small infrastructure-level change with a large reliability impact, especially for production environments where internal requests, proxies, and monitoring flows need to keep working without interruption.
#3: Smarter PHP Version Detection for WP-CLI
WP-CLI commands now auto-detect the correct PHP binary per domain from web.conf. This matters for sites running non-default PHP versions. Previously, WP-CLI could silently use the wrong PHP interpreter, which could lead to failed commands, inconsistent behavior, or confusing debugging sessions.
With this update, WP-CLI operations are better aligned with the PHP version actually assigned to the domain.
#4: SSL Nameserver Verification
SSL renewal now checks NS records before attempting certificate renewal.
This helps avoid unnecessary Let’s Encrypt renewal attempts when a domain’s nameservers do not point to the expected configuration. It also reduces the chance of renewal noise or rate-limit issues caused by domains that are not ready for SSL issuance.
If suffix domains are soft-deleted because of NS mismatch, the system now sends a Slack notification so the issue is visible to the ops team.
#5: Restore and Migration Target Server Options
v3.23.0 adds new restore and migration options for moving sites to specific target servers.
The release includes support for restoring sites to legacy servers and passing target server options during restore or migration commands. This makes server-level site movement more predictable, especially when migrations need to land on a specific server group.
#6: Weekly S3 Backup Cleanup
Backup cleanup is now more systematic. A weekly S3 bulk backup cleanup has been added, and previous cleanup bugs were fixed. This helps reduce stale or orphaned backup objects in storage while keeping cleanup behavior safer through input validation.
For teams operating at scale, fewer stale backup artifacts means cleaner storage and less manual intervention.
Improved
Migration Pulls Are More Reliable
Migration pull now uses mysql --binary-mode for SQL imports instead of relying on wp db import.
This improves handling for serialized data containing backslashes, which can appear in plugins and builders such as Fusion Builder and NextGen Gallery. Previously, this type of content could break or get mangled during import. With binary-safe imports, migrations are better protected against serialized-data and encoding edge cases.
Migration pull also neutralizes the source site’s wp-cli.yml file on the destination. This prevents source-server aliases or configuration from bleeding into the new environment.
MariaDB 10.6+ SQL Imports Are Safer
SQL dumps from newer MariaDB versions can include sandbox-mode comments that cause import failures in some environments.
v3.23.0 now strips those comments before import, preventing parse errors during migration or restore workflows. This improves compatibility for sites coming from newer MariaDB setups.
Object Cache Toggle Is Safer
Object Cache enable and disable flows are now more reliable.
The cache toggle process no longer corrupts the wp-config.php anchor block, which previously could break future cache toggles. Errors are also surfaced back to the API instead of failing silently.
For users, this means Redis/Object Cache management should feel more predictable. For support teams, it means failures are easier to diagnose because the API response now contains the actual error.
2FA Login Flows Are Less Likely to Hit Rate Limits
The wp-login.php burst limit has been raised from 3 to 8 requests.
This helps users with 2FA plugins that trigger multiple rapid login requests during authentication. Sustained rate limits remain unchanged, but legitimate login flows from plugins like Two-Factor should be less likely to get blocked.
WordPress Restore Admin Logic Is Safer
Admin user handling during WordPress restore has been rewritten.
The restore script now creates, updates, or rejects admin user changes based on more precise role checks. Existing admins are never demoted during restore. If an admin user cannot be created, the likely cause is now easier to identify through username collision details in the restore logs.
This improves restore safety for production and staging workflows where preserving administrator access is critical.
Custom Domain HTTPS on Bunny CDN
ForceSSL is now enabled on Bunny CDN for all mapped custom domains.
That means HTTP traffic on mapped custom domains will automatically redirect to HTTPS. This improves the security posture of hosted sites and removes another manual step from custom-domain setup.
SSL Renewal Handles Expired Domains
The SSL renewal pipeline now catches domains that are already expired, not only domains that are approaching expiry within a narrow future window.
This closes a gap where expired certificates could previously be missed by renewal logic. SSL renewal is also more selective now because it checks nameserver configuration before attempting renewal.
Backup Worker Cleanup Is More Automatic
Stale bkp-* worker volumes left behind by crashed backup jobs are now cleaned up automatically.
This reduces infrastructure clutter and helps keep backup workers from leaving unused volumes behind after failed or interrupted jobs.
Redis Jobs No Longer Stay Stuck as “Processing”
RedisJob records are now finalized inside catch blocks when exceptions occur.
Previously, some failed jobs could remain stuck in a “processing” state. With this improvement, tasks that fail because of exceptions should be marked as failed instead of appearing to run forever.
Server Monitoring Heartbeats Are More Accurate
Server monitor heartbeat checks now emit valid JSON and handle file locks more cleanly.
This reduces false heartbeat failures caused by invalid payloads or inherited file descriptors. The result is fewer misleading alerts and cleaner server monitoring.
Fixed
SSL Certificate Installation Now Targets the Correct Site
A follow-up v3.23.1 fix corrects how SSL certificate installation jobs identify sites.
Previously, SSL installation could look up a site by server_group_id and domain combination, which was not unique enough in some cases. Jobs now pass the site ID directly and look up the site by primary key, preventing certificates from being applied to the wrong site.
This is especially important when multiple sites share the same subdomain prefix across different suffix domains in the same server group.
SSL Renewal Jobs No Longer Block Site Creation
SSL renewal jobs no longer flood queue metrics or block site creation.
This fix improves queue behavior so certificate renewal activity does not interfere with core site provisioning workflows.
CDN Hostname Availability Checks Are More Accurate
The CDN hostname availability check was returning false positives for existing hostnames.
That behavior has been corrected, making CDN setup and validation more reliable when working with mapped custom domains.
S3 Backup Cleanup Bugs Were Fixed
Several S3 backup cleanup issues were corrected.
The --days-ago input is now validated to prevent unintended cleanup behavior, and weekly bulk cleanup now runs on a schedule.
Auto-Heal Alerts Are Less Noisy
Auto-heal error reporting no longer raises misleading alerts when the HestiaCP API is unreachable.
This should reduce false incident noise and make real issues easier to spot.
Migration Domain Gating and wp-config Sanitization Were Fixed
The migration pull flow received fixes for API domain gating logic and function call order.
For pure pull migrations where direct file access is unavailable, sanitize_wp_config is now invoked through wp eval. This keeps wp-config cleanup more reliable across migration paths.
Nginx Duplicate Zone Detection Is More Complete
The duplicate limit_req_zone check now scans all Nginx config files instead of only nginx.conf.
This prevents duplicate rate-limit zone misconfigurations in multi-config setups.
Theme Fatal Errors No Longer Abort Full Restore
Theme fatal errors during site restore no longer stop the entire restore process.
That makes restores more resilient when a restored site includes a theme that fails during execution but should not block the rest of the recovery workflow.
Restore Error Handling Is Cleaner
Error handling in RestoreWordpressJob has been simplified so exception messages are clearer and more accurate.
This should make failed restore debugging easier for support and engineering teams.
Final Thoughts
v3.23.0 is a reliability-first release. It strengthens the workflows that need to work quietly in the background: migrations, SSL renewal, Object Cache, backups, CDN HTTPS, restores, login protection, and server monitoring.
For developers and agencies, the biggest win is fewer fragile edge cases. Migrations handle tricky database content better. SSL renewal is more accurate. Object Cache toggles report errors properly. 2FA login flows are less likely to be blocked. And restore operations are safer around admin users and theme failures.
? Try the latest InstaWP updates now and manage your WordPress sites with more reliable migrations, backups, SSL, and server-side workflows.
