# Set up your own update server

> The official server is `https://updater.fluxwp.com`. The same PHP application can distribute your own plugins and themes from GitHub releases, including private repositories. A database is not required.

Source: https://fluxwp.com/wiki/guncelleme-sunucusu-en/  
Section: Setup  
Last updated: 2026-11-08

The official server is `https://updater.fluxwp.com`. The same PHP application can distribute your own plugins and themes from GitHub releases, including private repositories. A database is not required.

## Access model

Public repositories provide packages without a key. Private packages require a site key and are limited to that key's selected packages. The GitHub token stays on the server and is never sent to WordPress sites. No repository is selected by default.

## Shared hosting setup

1. Create a PHP subdomain such as `updater.example.com` and enable SSL. PHP 7.4+ and a writable `data/` directory are required.
2. Download `flx-update-server.zip` from [updater releases](https://github.com/FluxWP/updater/releases/latest). Extract into the subdomain root so `index.php` is directly at the root.
3. Open `/admin` immediately and create the administrator account. The first person to complete setup becomes the administrator.
4. In the GitHub card, select public and private repositories. Add an unlisted repository as `owner/repo`. For private repositories, create a fine-grained GitHub token restricted to those repositories with Contents: Read-only. Save and test.
5. For private packages, add a site, select its packages and stable/beta channel and generate a key. Copy it immediately: only its SHA-256 hash is stored. A lost key must be replaced. Test the key in the panel.
6. On each WordPress site install FluxWP Panel. In Settings, enter the server URL and, when required, the site key. Save and check.

A key can also be assigned to an already connected keyless site from Overview → Connected sites; the site receives it on its next check.

## Releases and verification

The server checks for releases within five minutes. For immediate refresh, generate a webhook secret in the server panel and store it as `UPDATE_WEBHOOK_SECRET` in the package repository's GitHub Actions secrets.

Verify that `/` returns configured status, `/admin` shows the login screen and `/data/settings.json` returns 403. To update the server, extract the new ZIP over the installation. Settings remain in `data/settings.json`.

## Operations

Overview shows downloads, traffic and connected sites over 7/30/90 days. Resources shows disk usage, API quota, caches and PHP limits. Security provides emergency shutdown (503), keyless distribution controls and country restrictions. The latest five ZIP versions are retained per package; older versions are downloaded again when requested.

IP addresses are not stored in statistics. Only the country code resolved locally during the request is retained.

## Troubleshooting

Check DNS for resolution errors, test invalid keys in `/admin`, check the GitHub token for HTTP 502 and verify Actions and refresh packages for missing releases. Logs are in `data/access.log` and the PHP error log.