If you searched for a WP Human Resource Management alternative, a PHP 8 fix, or a replacement because your HR plugin broke after a WordPress or PHP update — you’re in the right place.
Punchwell is the maintained, security-hardened GPL fork of the “WP Human Resource Management” plugin. Same database. Same WordPress-user data model. Your employees, attendance, and leave records carry over. It’s a migration, not a rebuild.
The original plugin (slug hrm) was removed from the WordPress.org directory on July 1, 2025 for a security issue, and last shipped code around 2019 — written for PHP 5.6. Punchwell picks up where it stopped: PHP 8 / WordPress 7 / MySQL 8 clean, the call-home code removed, and the endpoints behind the public security disclosures capability-gated.
Punchwell is an independent, third-party maintained fork. We are not affiliated with, endorsed by, or sponsored by wpspear, weDevs, or the original author. We reference “WP Human Resource Management” descriptively only, to help affected users find a maintained path forward.
Get Punchwell Pro — $99/yr → · Follow the migration guide →
Per site, not per seat. Unlimited employees. Your data stays on your server.
Why you’re probably here
Most people land on this page for one of three reasons. All three have the same answer.
- “My HR plugin white-screened after I updated PHP or WordPress.” The original was built for PHP 5.6. On PHP 8 it throws genuine type and date fatals — white screens after an update, “add employee” hanging on the spinner, punch-out stopping, profile and department saves that never complete. Punchwell fixed those at the source.
- “It disappeared from WordPress.org.” It was closed as of July 1, 2025, with the reason listed as a security issue. The vendor is gone too — wpspear.com is parked, and the old update host (mishubd.com) is defunct, so the plugin can’t even phone home for an update anymore.
- “I read it has unpatched security holes.” It does. There are public, high-severity disclosures — including a privilege-escalation path and an arbitrary-user-deletion flaw — that were never patched in the original. Punchwell addresses them.
You don’t have to abandon the records you’ve already built. You need the same software, maintained. That’s exactly what this is.
See the full security picture →
The original vs. the maintained fork
Same lineage, different state of repair. Here’s the honest side-by-side.
| Original “WP Human Resource Management” | Punchwell (the maintained fork) | |
|---|---|---|
| Status | Removed from WordPress.org July 1, 2025 (security issue) | Actively maintained |
| Last release | ~2.2.17, around 2019 | Base 2.14.1, shipping |
| PHP 8 / WP 7 / MySQL 8 | Breaks — built for PHP 5.6 | Clean on all three |
| Known security flaws | Public privilege-escalation + arbitrary-user-deletion disclosures, unpatched | Endpoints capability-gated; the user-deletion flaw specifically fixed and verified (details →) |
| Call-home / outbound network | Had license + update phone-home (now to a dead host) | All of the original’s outbound network code removed and verified — 0 network primitives; Pro’s only outbound call is license validation, never your data |
| Office-IP clock-in lock | Basic, present in lineage | Per-employee + per-office, CIDR & ranges, block/warn/flag modes (how it works →) |
| GPS geofence / kiosk / mobile punch | Not present | All three shipped |
| Payroll, PTO accrual, reminders, checklists | Limited / absent | Shipped (payroll exports data; it doesn’t move money) |
| Support & updates | None — vendor gone | Maintained by the people who write the code |
| License | GPL | GPL — you genuinely own it |
| Pricing | n/a (abandoned) | Free tier on WordPress.org; Pro $99/yr per site, unlimited employees |
Drop-in compatible — because it’s the same data model
This is the part that matters most if you’ve already got staff, attendance, and leave in the old plugin: nothing gets thrown away.
- Employees are WordPress users in both — same as they always were. There’s no separate identity system to rebuild.
- Same
wp_hrm_*database tables. Punchwell reads the records you already have. - Automatic schema reconcile. On the first wp-admin load, Punchwell runs an idempotent
dbDeltastep that adds any new tables and columns and migrates the legacyhrm_employerrole tohrm_employee. It never deletes your data. - Two shipped SQL scripts finish the job for older databases: a one-time data-migration script (it copies legacy leave and work-experience columns into the current ones, normalizes old
0000-00-00timestamps to NULL, and drops three unused legacy tables) and a read-only verification pack that confirms every row copied with zero orphans. - Reversible. Back up first and the whole thing can be rolled back — keep the original installed (just inactive) until you’ve verified.
A few things you’ll re-enter by hand, because the model genuinely changed: payroll/salary figures (regenerate them in Punchwell → Payroll), leave-type yearly entitlements (the type names survive), and your office IP allowlist (re-confirm it under Structure → Locations). Plan on roughly 30–60 minutes, and do it on staging first.
The migration guide walks every step in order — and order matters here (let the automatic step run before the SQL script, or leave and work-experience will look blank until you do).
Read the full migration guide →
While you’re switching, you get the flagship the original never had
You came for a fix. You’ll stay for the feature that actually stops time theft.
Punchwell’s flagship is a hard-enforced, per-employee office-IP clock-in lock. Flag a worker as office-only and they can clock in or out only from an allowlisted address. It refuses the punch server-side when they’re off your network — it doesn’t merely log a location after the fact. That’s the difference between a record of a bad punch and a blocked one.
The depth here is rare:
- Allowlist by exact IP, CIDR block (e.g.
203.0.113.0/24), or address range — IPv4 and IPv6. - Three scopes, unioned: company-wide, per-office, and per-employee. Adding an address only ever widens access — legacy single-office setups behave exactly as before.
- Block / Warn / Flag enforcement modes, plus an optional clock-in time window and a blocked-attempt email to HR.
And because GPS-only clocks can be faked from a couch, Punchwell pairs the IP lock with an opt-in GPS geofence, a kiosk/wall-tablet screen, and a mobile/PWA punch screen — so you decide how strict to be. GPS is a deterrent; the IP lock is the hard control. We say that plainly.
Flat price. Unlimited employees. No per-seat creep.
The old plugin’s vendor disappeared. Punchwell’s model is built to last and built to be fair.
- Free / Community — $0 on WordPress.org. Base HR: employees, departments, leave, basic attendance, and a basic single-office IP lock.
- Pro — $99/year, per site. Everything bundled: the full per-employee/per-office IP-lock depth, GPS geofence, kiosk, mobile punch, payroll export, PTO accrual, reminders, checklists, recruitment, loans, attendance reports, self-service, and permissions.
Pricing is per site, never per seat. Unlimited employees on every tier. Hire your hundredth person and your bill doesn’t change. Renewal price is locked for as long as you never lapse. And because it’s GPL and self-hosted, even if you cancel, you keep the plugin and every record.
Free on WordPress.org. Unlimited employees. No card required.
FAQ
Is this affiliated with wpspear, weDevs, or the original WP Human Resource Management author? No. Punchwell is an independent, third-party maintained fork of the GPL-licensed original. We are not affiliated with, endorsed by, or sponsored by wpspear, weDevs, the original author, or any prior maintainer. We reference “WP Human Resource Management” descriptively (nominative fair use) only — to identify the software lineage and help people running the abandoned version find a maintained alternative. All third-party names and trademarks belong to their respective owners.
It’s a GPL fork — is that even allowed? And is the code really “mine”? Yes on both. The original is GPL-licensed, which is precisely what makes maintaining a fork legitimate. GPL is a feature here: you genuinely own the code, you’re never locked in, and your data is yours to export anytime. Your license pays for updates, support, and the Pro features bundle — the standard model for professional WordPress plugins. The GPL is also your insurance against exactly what happened to the original: a vendor disappearing and leaving you stranded.
Will migrating from the old plugin lose my data? No. Same plugin lineage, same database schema — your employees, attendance, and leave records carry over. Punchwell runs an automatic, additive schema reconcile on first load (it adds tables and columns, never deletes), and ships a one-time migration script plus a read-only verification pack. Back up first and it’s reversible. A few items you re-enter by hand — payroll figures, leave entitlement amounts, and your office IPs — because those parts of the model changed.
Why did the original break, and is Punchwell really fixed for PHP 8? The original was written for PHP 5.6 and last shipped around 2019. On PHP 8 it throws real type and date fatals — white screens, hanging “add employee” and save spinners, broken punch-out. Punchwell is PHP 8 / WordPress 7 / MySQL 8 clean, with the data layer modernized off the end-of-life libraries the original depended on. The original also can’t update itself anymore — its update host is offline.
What about the security issues it was removed for? Punchwell addresses them. The arbitrary-user-deletion flaw is specifically fixed and verified in source — the delete endpoint now requires the proper capability checks. The privilege-escalation class of issue is handled by the project’s hard rule that privileged AJAX actions are capability-gated, not just nonce-checked. We also removed all the original’s call-home code (verified: zero outbound network primitives — Pro’s only outbound call is license validation to our own billing server, never your data). We describe this at the class level and cite only already-public information — we don’t claim “unhackable.” The full picture is on the security page.
Do I need to run my own server to self-host this? No. If you already run a WordPress site, you already have everything you need — Punchwell installs like any other plugin and updates through your dashboard. “Self-hosted” just means your employee data lives in your own WordPress database instead of a vendor’s cloud. There’s no separate server and no cloud account to set up.
Pick up where the old plugin left off
You don’t need to start over, and you don’t need to keep limping along on an abandoned plugin with open security holes. The records you’ve built migrate in place — and you land on a maintained, PHP 8–ready successor with the office-IP clock-in lock the original never shipped.
Get Punchwell Pro — $99/yr → · Follow the migration guide →
Per site, not per seat. GPL. Self-hosted. Your data stays on your server.
Disclaimer: Punchwell is an independent, third-party maintained fork of the GPL-licensed “WP Human Resource Management” plugin. Sturdyhaus is not affiliated with, endorsed by, or sponsored by wpspear, weDevs, the original author, or any other prior maintainer. “WP Human Resource Management” and any other product names are referenced descriptively (nominative fair use) solely to identify the software lineage and help affected users find a maintained alternative. All third-party names and trademarks belong to their respective owners. Punchwell, by Sturdyhaus.