Sturdyhaus builds and maintains durable, self-hosted WordPress software for small businesses that would rather own their tools than rent them. Our flagship is Punchwell — a WordPress time clock that locks clock-in to your office network, so on-site staff can’t punch in from home or cover for each other.
We’re a small, focused shop with one strong opinion: the software that runs your business shouldn’t hold your data hostage, bill you per head, or phone home to a cloud you don’t control. So we build the opposite.
See how the IP lock works → /features/ip-lock/ · Compare the plans → /pricing/
Self-hosted · No per-seat fee · No data call-home · GPL
The story: we found a good plugin left for dead
Thousands of small businesses ran a WordPress HR and time-clock plugin called “WP Human Resource Management.” Employees were WordPress users, attendance lived in the site’s own database, and it did real work — departments, leave, punch in and out.
Then it stopped being maintained. The last release shipped around 2019, written for PHP 5.6. When hosts moved customers to PHP 8, it broke: white screens after an update, “add employee” hanging on the spinner, punch-out failing, profile and department saves freezing — genuine PHP 8 type and date fatals, with no one left to fix them.
It got worse. On July 1, 2025, the original plugin was removed from the WordPress.org directory for a security issue. The vendor was gone, the old update host was defunct, and the public record listed serious unpatched flaws — including a privilege-escalation issue that could let a logged-in employee become a WordPress administrator (CVE-2025-5953), an arbitrary-user-deletion bug where any logged-in user could delete any account (CVE-2025-5956), and a broken-access-control flaw on leave records (CVE-2019-9574).
The plugin was abandoned. The businesses running it were not.
So we forked it under the GPL — the license that exists precisely so good software can outlive the team that wrote it — and we did the unglamorous work.
What we actually fixed
- Made it PHP 8 / WordPress 7 / MySQL 8 clean. No more white screens, no more hanging spinners. We modernized the data layer off the end-of-life libraries it depended on.
- Hardened it. We capability-gated the endpoints behind the public security disclosures. The arbitrary-user-deletion flaw (CVE-2025-5956) is specifically fixed and verified in source — deleting an account now requires the WordPress
delete_userscapability plus a per-account check. A multi-agent audit of the add-ons surfaced 128 findings; every critical and high issue was resolved and adversarially re-verified. - Removed every call-home. We stripped out the license phone-home and the old update-host calls. There are now zero outbound network primitives in the free plugin’s code. (Pro’s only outbound call is license validation to our own billing server — your data is never sent.) The only external content is optional YouTube tutorial embeds and standard WordPress Gravatar avatars — nothing of yours leaves your server.
- Kept your data where it was. Same database schema, same lineage. Existing employees, attendance, and leave records carry over with a documented migration script. It’s a migration, not a rebuild.
Then we kept going — because rescuing it was only the start. We built the feature most cheap time clocks can’t ship.
Read the full migration guide → /migration/
Why Punchwell exists: lock the clock to your office
The reason we didn’t just patch the plugin and walk away is the feature we cared most about: a per-employee, hard-enforced office-IP clock-in lock.
Flag an employee as office-only, and they can clock in or out only from an address you’ve allowed. It refuses the punch on the server when they’re off the network — it doesn’t merely log a location after the fact. That’s how you actually stop buddy punching: the off-site punch never lands.
It goes deep where almost nobody else does — exact IPs, CIDR blocks like 203.0.113.0/24, address ranges, IPv4 and IPv6 — with allowlists at the company, per-office, and per-employee level (they union, so adding an IP only ever widens access). Choose block, warn, or flag, set a clock-in time window, and get an email when an off-site punch is refused.
And because the office network isn’t the only way to define “here,” we pair it with an optional GPS geofence, a kiosk clock for shared wall tablets, and a mobile/PWA punch screen. IP lock and GPS geofence and kiosk and mobile punch — softer or stricter, your call.
We’re honest about the parts: GPS can be spoofed and should be treated as a deterrent. An office-IP lock can’t be faked from a phone at home. The IP lock is the hard control. That honesty is the point.
See how the IP lock works → /features/ip-lock/
What we believe
These aren’t slogans — they’re the constraints we build under.
Own your data
Your employees are WordPress users. Your timesheets are rows in your own database. Nothing syncs to a vendor cloud, because there is no vendor cloud. If you ever leave, you keep the plugin and every record. Self-hosting just means your team’s data lives on the WordPress site you already run — privacy-sensitive shops like clinics, dental practices, and agencies don’t have to hand staff records to anyone else.
No per-seat fee
We price per site, never per seat. One flat annual price, unlimited employees, on every tier. Hire your hundredth person and your bill doesn’t change. A 25-person shop pays roughly $1,500–2,100 a year to per-head SaaS clocks. Punchwell is $99 a year, flat.
No data call-home
We removed every outbound network call from the original and verified zero remain — the free version makes no outbound calls at all, and the only outbound call Pro makes is validating your license key against our own billing server, never your data. No usage telemetry, no data leaving your server. We think that’s how business software should work — and it’s how we test it.
Maintained, for real
The plugin we forked was abandoned once. We treat “maintained” as a promise: security fixes, PHP and WordPress compatibility, a changelog with every release, and support from the people who actually write the code — not an outsourced tier-1 script.
See everything that’s included → /features/
We are an independent, third-party maintainer
This matters, so we’ll say it plainly.
Punchwell is an independent, third-party maintained fork of the GPL-licensed “WP Human Resource Management” plugin. Sturdyhaus is not affiliated with, endorsed by, or sponsored by wpspear, weDevs, the original author, or any prior maintainer.
We reference the original plugin’s name only descriptively — to identify the software lineage and help people still running the abandoned version find a maintained alternative. “WP Human Resource Management” and any other product names mentioned belong to their respective owners. We don’t use anyone else’s logo or branding, we don’t call ourselves “official,” and we never imply a partnership that doesn’t exist.
What we do claim is straightforward: we forked GPL code, we fixed it, and we stand behind the fork.
How we’re funded: simple, honest, GPL
There’s no venture money, no data resale, no surprise upsell waiting at employee number 26. Here’s the whole model:
- A free Community tier on WordPress.org — base HR (employees, departments, leave, basic attendance, basic single-office IP lock). It’s a real product, not a crippled trial. It’s also our on-ramp.
- Punchwell Pro — a flat annual license that bundles everything: the full IP-lock depth, GPS geofence, kiosk, mobile punch, payroll export, PTO accrual, reminders, checklists, recruitment, loans, attendance reports, self-service, and permissions. $99/year, per site. Never per seat — unlimited employees. Renewal price locked as long as you never lapse.
The code is GPL — that’s a feature, not a loophole. GPL means you genuinely own what you run and can’t be locked in. Your license pays for updates, support, and the Pro bundle — the same way most professional WordPress plugins work. The GPL is also your insurance: even if Sturdyhaus disappeared tomorrow, you’d keep the plugin and every record. That’s exactly the trap we pulled the original out of, and we have no intention of recreating it.
FAQ
Who is Sturdyhaus?
A small software house that builds and maintains durable, self-hosted WordPress software for small businesses — the kind that would rather own their tools than rent them. Punchwell is our flagship: a maintained, security-hardened continuation of HR and time-clock software for the WordPress ecosystem. We favor flat pricing over per-seat billing, self-hosting over cloud lock-in, and plainly stated capabilities over hype.
Are you affiliated with the original WP Human Resource Management plugin?
No. Punchwell is an independent, third-party maintained fork of the GPL-licensed original. We’re not affiliated with, endorsed by, or sponsored by the original author, wpspear, or weDevs. We reference the original plugin’s name only descriptively, to help people running the abandoned version find a maintained alternative. The original was removed from WordPress.org in 2025 and last shipped code around 2019; Punchwell is the hardened, PHP 8–ready continuation.
How do you make money if the code is GPL?
The same way most professional WordPress plugins do. The free Community tier lives on WordPress.org; Punchwell Pro is a flat annual license ($99/year per site) that bundles all the advanced features and includes support and updates. GPL means you own the code and aren’t locked in; your license funds the maintenance. No data resale, no per-seat creep, no telemetry.
Will I lose my data if I migrate from the old plugin?
No. It shares the same data model — employees are WordPress users plus the same wp_hrm_* tables. The fork automatically reconciles your database schema on first load (it adds new tables and columns, never deletes data) and migrates the legacy role. We also ship a one-time migration SQL script and a read-only verification pack. Back up first and it’s reversible. It’s a migration, not a rebuild. Full migration guide → /migration/
Does Punchwell phone home or send my data anywhere?
Your data, never. We removed every outbound network call from the original plugin and its libraries and verified that zero remain — the free version makes no outbound calls at all, and the only outbound call Pro makes is validating your license key against our own billing server. Your employee and attendance data stays in your own WordPress database. The only external content is optional YouTube tutorial embeds and standard Gravatar avatars — both ordinary WordPress behavior.
What’s the one thing that makes Punchwell different?
The hard-enforced, per-employee office-IP clock-in lock. It refuses an off-site punch on the server instead of just logging where someone was — so buddy punching and off-site clock-ins actually stop. Most SMB time clocks rely on GPS only, which needs an app and can be spoofed from home. See how the IP lock works → /features/ip-lock/
Talk to the people who maintain it
If you’re evaluating Punchwell, migrating off the abandoned plugin, or just want to ask a real question, reach out — you’ll talk to the people who write the code, not a sales funnel.
Talk to us → /contact/ · Compare the plans → /pricing/ · Read the migration guide → /migration/
Free on WordPress.org. Unlimited employees. Per site, not per seat.
Independent GPL fork. Punchwell is an independent, third-party maintained fork of the GPL-licensed “WP Human Resource Management” plugin. Sturdyhaus is not affiliated with, endorsed by, or sponsored by wpspear, weDevs, or the original author. Product names are referenced descriptively (nominative fair use) only, to identify the software lineage. All trademarks belong to their respective owners.