What is Patchman?
Patchman is a security tool that runs on web hosting servers rather than inside your website. It scans every site on a server for known vulnerabilities and malware, and it can fix vulnerable code directly, without waiting for the site owner to log in and run an update.
It was originally developed by a Dutch company of the same name and is now part of CloudLinux, the company behind the CloudLinux operating system and Imunify360, both widely used across the hosting industry. Patchman integrates with the common hosting control panels (cPanel, Plesk, and DirectAdmin) and supports WordPress (including WooCommerce), Joomla, Drupal, Magento, PrestaShop, popular WordPress plugins, and widely used code libraries such as PHPMailer.
The problem it solves
Most website compromises don't come from clever, never-seen-before attacks. They come from known vulnerabilities that already have a fix, sitting on sites that simply haven't been updated. As we covered in our post on WordPress 7.1.4, attackers now start exploiting newly published flaws within hours.
Updates get missed for all sorts of reasons: nobody is responsible for the site, the owner is nervous an update will break something, a plugin is stuck on an old version because of a customisation, or the site was simply forgotten. On a server hosting hundreds of sites, some of them will always be out of date. Patchman exists to close that gap.
How Patchman works
1. Detection. Patchman scans the files on the server and recognises which applications, plugins, and versions each site is running. It compares them against a database of known vulnerabilities, and checks for malware at the same time.
2. Notification. When it finds a problem, the hosting provider can have Patchman tell the site owner, with an explanation of the vulnerability and what to do about it. Most hosts configure a schedule, for example, an initial warning, a reminder after two days, and an automatic fix after three.
3. Patching. This is the part that makes Patchman different. Rather than upgrading a plugin to its latest version (which can introduce breaking changes), Patchman applies only the security fix to the vulnerable file, backported to the version the site is actually running. Everything else stays exactly as it was, so a site that depends on an older version of a plugin keeps working, but the hole is closed.
Patches can be rolled back if needed, and CloudLinux has announced a second approach, virtual patching, which blocks exploit attempts against known WordPress vulnerabilities before they reach the vulnerable code, extending protection to premium plugins and sites with modified files.
4. Malware clean-up. On higher-tier licences, Patchman also detects and removes malware, quarantining infected files on compromised accounts.
What Patchman isn't
It's a valuable layer, but it's worth being clear about its limits:
- It isn't a replacement for updates. A patched file closes a specific security hole; it doesn't bring the bug fixes, compatibility improvements, and features of a proper update. Sites still need maintaining.
- It only knows about known vulnerabilities. Bespoke code, custom plugins, and brand-new flaws that haven't been published yet aren't covered.
- It doesn't protect the server itself. Patchman works on the applications hosted on a server. Flaws in the server software, like the PHP2Shell vulnerabilities in October, or in the control panel, still need the host to patch them directly.
- It isn't a firewall. Unlike a web application firewall, the current source-code patching doesn't block attacks in real time; it fixes the vulnerable code so that the attack no longer works.
Do you need Patchman?
Patchman is licensed per server by hosting providers, so it isn't something you install on your own site. If you're on shared hosting, it's worth asking your host whether they run it or something similar, and if so, how they've configured the notification and auto-patch schedule.
More importantly, it's a reminder that security is about layers. Server-side patching is an excellent safety net, but the most reliable protection is still a site that is properly maintained: core, plugins, and themes kept up to date and tested, unused plugins removed, and someone keeping an eye on it. That's exactly what our Care Plans provide, and if you'd like to know where your site currently stands, a security audit is a good place to start.
Summary
Patchman is a server-side tool, now owned by CloudLinux, that finds known vulnerabilities and malware across every site on a hosting server and fixes vulnerable code directly, applying only the security fix so nothing else changes. It's a strong safety net for sites that fall behind on updates, but it works best alongside proper maintenance, not instead of it.
