Punchwell is a self-hosted WordPress time clock and HR suite for on-site teams. The thing it does that almost nothing else in the WordPress world does: it refuses an off-site punch server-side instead of just logging where it came from. That one decision — block, don’t merely record — is the spine of the whole product.
Below is the full feature set, grouped by what you’ll actually use it for. The flagship comes first, because it’s why most people choose Punchwell. Everything else — attendance, leave, PTO, payroll export, self-service, the secondary modules — is solid, shipped, and bundled. No à-la-carte modules, no per-seat creep.
Two facts hold across every feature on this page:
- Per site, never per seat. Unlimited employees on every tier.
- No cloud, no data call-home. Your roster and timesheets live in your own WordPress database. All of the original’s outbound network code was removed and verified — the free version makes no outbound calls at all, and Pro’s only outbound call is license validation, never your data.
Get Punchwell Pro — $99/yr → · Start free on WordPress.org → · Compare the plans →
Independent GPL fork. Not affiliated with wpspear, weDevs, or the original author. “WP Human Resource Management” is referenced descriptively only.
The flagship: a per-employee, office-IP clock-in lock
Most time clocks let an employee punch from anywhere and then show you a map dot afterward. By the time you see the dot, payroll already counted the hours. Punchwell works the other way around: flag an employee as office-only, and the server checks the request’s IP address before it writes the punch. Off the office network? The punch is refused. Nothing to dispute, nothing to clean up later.
This is the buddy-punching control that cheaper clocks structurally can’t do — and the reason this page exists. Here’s the depth behind it.
How it actually works
- Per employee, not all-or-nothing. Set “requires office IP” on the people who should be on-site (cashiers, floor staff, clinic front desk) and leave remote staff free to punch from anywhere. It’s a flag on each WordPress user, enforced in the punch-validation code path.
- It uses your public office IP, not a
192.168.xLAN address — so it identifies your building’s connection to the internet, which is what an off-site phone can’t borrow. A one-click “Use this IP” helper fills it in on every IP-entry screen. - Three allowlist scopes, unioned (widen-only). A company-wide allowlist, a per-office allowlist (each location can carry its own IPs), and a per-employee “additional allowed IPs” field. Punchwell checks the union of all three, so adding an address only ever widens access — you can never accidentally lock someone out by adding an IP somewhere else.
- Exact IPs, CIDR blocks, and address ranges — IPv4 and IPv6. Allow a whole office subnet at once with a CIDR block like
203.0.113.0/24instead of typing every address. (CIDR is just shorthand for a range of IPs; you name it once.)
Choose how strict to be
- Block / Warn / Flag enforcement modes. Block hard-refuses an off-site punch. Warn and Flag let it through but record the off-site attempt — for when you want visibility first and a hard wall later. (Honest note: Warn and Flag behave identically by design — neither blocks; Flag records via a hook rather than tagging the attendance row.)
- Clock-in time window. Optionally only accept punches during a window around the shift start. It’s direction-aware — it never blocks a clock-out, so a late finish is never stuck.
- Blocked-attempt email to HR when an off-site punch is refused, so a pattern surfaces fast.
- Lock by role and default-lock new employees at the moment they’re created, so the policy applies itself going forward.
Why it matters: GPS can be spoofed from a couch with an app. An office-IP lock can’t be faked from a phone at home — the device simply isn’t on your network. That’s why the IP lock is the hard control here, and the geofence below is a deterrent layered on top.
See how the IP lock works, step by step → · Compare vs. Buddy Punch & GPS-only clocks →
GPS geofence — the softer layer, paired with the IP lock
When you want location checks for staff who legitimately move between sites, turn on the GPS geofence. A punch from the mobile screen is checked against the work site — either a company-wide fence or a per-office fence with its own latitude, longitude, and radius.
- Set the radius in metres or feet — your regional unit. (Stored canonically in metres; the unit is just how you enter and read it.)
- Honors the same Block / Warn / Flag modes as the IP lock, so the two controls feel consistent.
- Designed not to lock out real workers: a missing or weak GPS fix is allowed (and recorded in Warn/Flag mode), and clock-out is never blocked by distance — nobody gets trapped on the clock because their signal dropped.
Honest framing: treat the geofence as a deterrent, not proof of presence — GPS can be spoofed. Use it alongside the IP lock, where IP is the wall and GPS is the extra nudge. Softer or stricter, your call.
Attendance & time clock
The everyday engine underneath the location controls — clean timesheets without manual cleanup.
- Punch in / punch out with shift policies set per department.
- Configurable rounding (e.g. to the nearest 15 minutes), grace periods, and debounce so a double-tap doesn’t create a double punch.
- Auto clock-out for forgotten punches, with max-shift caps so a left-running clock doesn’t bill an impossible 20-hour day.
- Overnight / cross-midnight shifts — work duration is derived automatically from the begin/end span.
A quick note on setup, by design: to clock in, an employee needs the employee role → an assigned department → a shift policy on that department. Once those three are in place, punching just works.
Where staff actually punch
Punchwell gives you four surfaces, so you can be as soft or as strict as the role calls for:
- Office-IP-locked web punch — the default, on the employee’s own dashboard.
- Kiosk / wall-tablet clock —
[hrm_kiosk]. A shared device where employees clock in with a short code plus a 6-digit PIN, no individual logins on the tablet. The device must be enrolled and the venue IP must match your allowlist. - Mobile / PWA punch screen —
[hrm_gps_punch]. The phone captures GPS and sends the punch to the server; installable to the home screen as a PWA (it’s a responsive web app over HTTPS, not an App Store / Play Store app). - Manual punch edits for genuine misses, via the Attendance Reports add-on below.
See the full attendance tour →
Leave, holidays & PTO accrual
Time off that keeps its own balances.
- Multiple leave types, work-week setup, and a proper approval workflow (managers see an office-scoped inbox).
- One-click holiday import. Country presets (US, UK, Canada, Australia and more), an iCal (.ics) upload, or paste a list — all computed locally, with no internet call. You get a preview before saving, with each row marked New, Duplicate, or Invalid, and duplicates skipped automatically.
- PTO accrual engine. Per leave type, mark it Paid or Unpaid and accrue monthly, per hour worked, or as an annual lump-sum grant — in hours, with caps, carryover, and a waiting period. Approving paid leave draws the balance automatically, and a ledger records every earn, draw, and adjustment. Employees see their own balances.
Benefit: the holiday calendar is set up in a minute, and PTO balances maintain themselves instead of living in a spreadsheet someone forgets to update.
Payroll export & connectors
Punchwell does the calculation and the export — and stops there, on purpose.
- It exports payroll data; it does not move money. No payment processing, no direct deposit, no tax filing, no tax custody. You take a payroll-ready CSV to your provider. That’s a feature: no payment-processor or tax-custody risk lands on you.
- Per-employee pay setup — pay type (hourly or salary), rate, and frequency (weekly, bi-weekly, semi-monthly, or monthly). Each employee can differ, with a company default.
- Payout report for the current period with weekly and daily overtime, double-time, and holiday pay, plus an employer summary. Dollar figures are admin/manager-only.
- Worker classification (1099 contractor / FT / PT / temp / intern), with 1099 contractors excludable from overtime via a configurable toggle (default follows the FLSA).
- Payment method + handle per worker (ACH, Check, PayPal, Venmo, Cash App, Zelle, etc.) — a data field that helps you reason about 1099-NEC vs 1099-K, not a money mover.
- CSV export with delimiter, BOM, and date-format options, plus a CSV-injection guard. Generic CSV is built in, so basic export works with no connector at all.
- Connectors: SurePayroll and Gusto (Gusto’s Smart Import CSV) as separate add-ons.
- Import from a provider (e.g. a SurePayroll employee CSV) — matches your Punchwell users by email, optionally creates the missing ones, with a dry-run preview first.
See payroll export & connectors →
Self-service & HR reminders
Less back-and-forth for HR, fewer dates that slip.
Employee self-service (front-end widgets)
Each is a shortcode and a Gutenberg block, so you can drop HR onto your own pages:
- My Pay (opt-in) — each employee sees only their own rate, hours, estimated gross, payment method, and key dates.
- My Time Off and My Hours — their own balances and worked time.
- Leave request with self-cancel of a pending request, and an office-scoped approvals inbox for managers.
- Who’s in, team, holidays, notices, and a self-service clock.
- Three ready-made block patterns: a staff self-service portal, a lobby kiosk, and an intranet home.
HR reminder digest
A daily email digest plus an “Upcoming HR dates” dashboard widget that surfaces birthdays, work anniversaries, probation ends, contract expiries, visa expiries, and missed punches on the last working day. Each category toggles on or off.
Onboarding & offboarding checklists
Editable task templates, ticked off per employee on their profile, with X-of-Y % progress — so nothing falls through the cracks when someone joins or leaves.
Benefit: the date you’d have forgotten to chase shows up before it’s late, and routine HR asks (balances, payslip estimates, leave requests) answer themselves.
See self-service & reminders →
Secondary modules (all bundled with Pro)
Free add-ons that snap onto the base. The base plugin must be active; nothing here is a separate purchase.
- Recruitment — job posts, an apply form, applicant review, and one-click hire → employee, so a new starter lands straight in your roster.
- Employee Loans — loans repaid automatically via payroll deduction. HR-managed on the employee’s behalf (there’s no employee self-service loan request).
- Attendance Reports — day-by-day reports plus manual punch edits for the inevitable missed or mistyped punch.
- Permissions — granular custom roles and per-tab access toggles, so a manager sees only what they should.
- Front-end module — the HR app and self-service widgets on your public pages, including the kiosk and the GPS/PWA punch screen.
Settings, structure & ownership — the quiet wins
- Central Settings hub for branding (name, logo, address), timezone, date/time format, fiscal-year start, employee-ID auto-numbering, attendance rules, IP & geofence enforcement, notifications, and data-retention. Every new option defaults to no-op — upgrading an existing site changes nothing until you opt in.
- Structure page — Organization, Departments, Job Titles, multi-office Locations (with their own IPs and GPS fences), and a Notices announcement board.
- Employees are WordPress users, so there’s nothing new for your team to learn — and unlimited employees with no per-seat fee.
- Self-hosted and GPL. Your data stays in your WordPress database. No cloud, no data call-home, no third-party data sharing — verified. The only external content is optional YouTube tutorial embeds and standard Gravatar avatars.
- PHP 8 / WordPress 7 / MySQL 8 clean, security-audited.
FAQ
What’s the difference between the IP lock and the GPS geofence? The IP lock is the hard control: it refuses a punch server-side when the device isn’t on your office network, and a phone at home can’t fake your office’s public IP. The GPS geofence is a softer, opt-in layer — useful for staff who move between sites — but GPS can be spoofed, so treat it as a deterrent, not proof. Most people lock on-site roles by IP and use GPS as an extra nudge. See how the IP lock works →
Is there a separate mobile app to install?
No native iOS or Android app. The mobile punch is a responsive web / PWA screen ([hrm_gps_punch]) you can add to a phone’s home screen — it works over HTTPS, captures GPS, and behaves like an app without an App Store download. There’s also a kiosk screen for a shared wall tablet.
Does it actually run payroll? It does the calculation and the export — pay type and rate, a payout report with weekly and daily overtime, double-time and holiday pay, worker classification, and CSV export (plus SurePayroll and Gusto connectors). It does not move money. You take the payroll-ready CSV to your payroll provider. Keeping money movement out is deliberate — no payment-processor or tax-custody risk for you.
Do features cost extra, à la carte? No. Pro bundles everything on this page into one flat annual price — the full IP-lock depth, GPS geofence, kiosk, mobile punch, payroll export, PTO accrual, reminders, checklists, recruitment, loans, attendance reports, self-service, and permissions. Per site, never per seat, unlimited employees. See pricing →
Will any of this change how my current site behaves after I update? No. Every new setting defaults to no-op — upgrading an existing install changes nothing until an admin opts in. The Settings hub is where you turn things on, one at a time.
Is Punchwell self-hosted, and does my data leave the server? Yes, it’s fully self-hosted, and no. Employees are WordPress users and timesheets are rows in your own database. All of the original’s outbound network and call-home code was removed and verified — the free version makes no outbound calls at all, Pro’s only outbound call is license validation to our own billing server (never your data), and the only external content is optional YouTube tutorial embeds and Gravatar avatars. Read about ownership & privacy →
Ready to lock the clock to your office?
You’ve seen the whole toolkit. The fastest way to feel the difference is to flag one employee as office-only and watch an off-site punch get refused.
Start free on WordPress.org → · Compare the plans → · See how the IP lock works →
Per site, not per seat. Unlimited employees. GPL, self-hosted — your data stays on your server. Renewal price locked if you never lapse.
Punchwell, by Sturdyhaus, is an independently maintained GPL fork of the “WP Human Resource Management” plugin. Not affiliated with, endorsed by, or sponsored by wpspear, weDevs, or the original author. Product names are referenced descriptively (nominative fair use) only.