Block the exploit. Fix the code.
The new Patchman does both.
Virtual patching is coming to Patchman, alongside the source-code patching it already does, so hosting providers will get both layers in one standalone product.
FREE TRIAL, NO CREDIT CARD REQUIRED
Two patching layers
The new Patchman will pick the right method for each vulnerability, either a rule that blocks the exploit or a fix to the vulnerable code itself.
Virtual patching
ComingRules for known WordPress vulnerabilities will block exploits before they reach the vulnerable code. They'll also cover premium plugins and sites with edited files, which a file patch can't reach.
Source-code patching
Patchman applies the security fix to the vulnerable file itself, backported to the version each site runs, so the site stays protected whether or not its owner updates.
- WordPress (including WooCommerce), Joomla, Drupal, Magento and PrestaShop
- Popular WordPress plugins and common libraries like PHPMailer
Both layers are managed from the server, across every account.
"I was pleasantly surprised how easy it was to start my first scan. It was even easier to start fixing vulnerabilities! It was such a relief for our team when we saw Patchman literally fixing thousands of vulnerabilities in the blink of an eye."
Every fix in one place
The web application shows every vulnerability Patchman has patched, server by server. When virtual patching arrives, rules join the same view. One coverage number for every vulnerability closed across your servers, by rule or by patch.
Outdated software is a top security challenge for hosts
53% of hosts name outdated or vulnerable software, especially WordPress plugins and themes, among their top security challenges (Web Hosting Trends Report 2026, CloudLinux and WebPros). When site owners don't update, the hacked sites that follow end up on your support desk.
What you get from Patchman
No waiting on site owners
Patchman patches known vulnerabilities on customer sites from the server. Nobody has to wait for an owner to update.
Fewer hacked-site tickets
An exploited site means cleanup, a suspended account and an unhappy customer. Patching the vulnerability first means fewer of those tickets.
Sites keep working
Patchman changes only the vulnerable code, never the version a site runs, so the plugins and themes that depend on that version keep working.
Features
Patch vulnerabilities
Patchman scans every account on the server for vulnerable versions of WordPress, Joomla, Drupal and the other applications it covers, and patches them as your policies say.
Virtual patching
When a rule for a known WordPress vulnerability is ready, it will reach all your servers at once and stop the exploit before it hits the vulnerable code.
Notify your customers
Patchman can tell your customers about security incidents and outdated applications automatically, with background on each vulnerability.
Roll back any change
Every change Patchman makes can be rolled back, from the web application or the control panel plugin.
Quick to set up
Patchman installs from RPM or DEB packages and integrates with your control panel. You configure the rest in the web application.
Automate your workflow
Set policies for how Patchman responds, and it runs them for you. For example, warn the customer about a vulnerability, remind them after two days, and patch it automatically after three.
Admin, reseller and user roles
Patchman follows your control panel's account structure, so you decide who hears about which issues.
A view for your customers
You get one overview of your whole platform. Your customers get their own view, inside their control panel, to review open issues and fix them.
Pricing
Core
Patches for WordPress, Drupal and Joomla
€20/mo
Per Virtual Server
Coverage
All Core features
Patches for Magento, WooCommerce and PrestaShop
Patches for popular WordPress plugins
€35/mo
Per Virtual Server
Coverage + Clean
All Coverage features
Advanced malware detection and removal
€45/mo
Per Virtual Server
Frequently asked questions
Patchman runs on x86_64 servers with CentOS or Red Hat Enterprise Linux 7 to 9, CloudLinux 7 to 9, AlmaLinux 8 to 10, Rocky Linux 8 to 10, Ubuntu 16.04 to 26.04, or Debian 10 to 13. It needs a control panel: cPanel, Plesk or DirectAdmin.