If your time clock white-screened after a PHP update, your “add employee” button hangs on the spinner, or you just learned the plugin was pulled from WordPress.org — you’re in the right place. Punchwell is an independent, maintained, security-hardened fork of the original “WP Human Resource Management” plugin. Same data model, same lineage, PHP 8 clean. Your employees, attendance, and leave records carry over. This is a migration, not a rebuild.
Get Punchwell free → /punchwell/pricing/ · Read the migration guide → /punchwell/migrate/guide/
Free on WordPress.org. Unlimited employees. No card required.
What happened to the original plugin
The original “WP Human Resource Management” plugin (slug hrm, by wpspear) was removed from the WordPress.org plugin directory on 2025-07-01, with the reason listed as a security issue. Its last release was 2.2.17, around 2019. The vendor is gone — wpspear.com is parked, and the old update host it phoned home to (mishubd.com) is defunct. There is no one left maintaining it.
Two things tend to bring people here.
1. It broke when your host moved to PHP 8
The original was written for PHP 5.6, which reached end-of-life years ago. On PHP 8 it throws real type and date fatals — the symptoms are specific and recognizable:
- White screen in wp-admin after a PHP or WordPress update
- “Add employee” hangs forever on the saving spinner
- Punch-out stops working
- Profile and department saves hang
2. It has unpatched security flaws
Three public CVEs affect the original abandoned plugin, and because no one maintains it, they remain unpatched there:
| CVE | What it is | Severity |
|---|---|---|
| CVE-2025-5956 | Arbitrary user deletion — any logged-in user could delete any account, including admins | 8.1 (High) |
| CVE-2025-5953 | Privilege escalation — a logged-in employee could promote themselves toward administrator | 8.8 (High) |
| CVE-2019-9574 | Broken access control on leave records | 7.5 (High) |
If you’re running the original on a live site, those are worth understanding before you do anything else. We walk through each one, plainly, on the 5-minute security check → /punchwell/security/ — including exactly how the fork addresses them.
Punchwell is an independent, third-party maintained fork of the GPL-licensed original. We’re not affiliated with, endorsed by, or sponsored by wpspear, weDevs, or the original author. We reference the original plugin’s name only descriptively, to help people running the abandoned version find a maintained alternative.
What you keep
Punchwell shares the original’s data model, so the move is genuinely a migration — not a “start over and re-enter everyone.”
- Your employees stay your employees. In both the original and Punchwell, employees are WordPress users. No separate user system, nothing to recreate.
- Same
wp_hrm_*database tables. Punchwell reads the same schema lineage your data already lives in. - It installs like any other plugin — copy the plugin folders into
wp-content/plugins/and activate. There’s no new server, no cloud account, no export-and-reimport dance for your core records. - Your attendance and leave history come along. A documented one-time script copies the few columns the original named differently into their new homes — your raw data is preserved, not discarded.
What’s fixed, and what you gain
Migrating doesn’t just unbreak the old plugin — it lands you on a suite that’s been hardened and extended for years past where the original stopped.
Fixed
- PHP 8 / WordPress 7 / MySQL 8 clean. The fatals are gone; the data layer was modernized off the end-of-life libraries the original depended on.
- The security holes are addressed. The arbitrary-user-deletion endpoint (CVE-2025-5956) now requires a real capability check before deleting anyone, and the class of missing-authorization flaws behind the other disclosures is capability-gated as a hard project rule. Full detail on /punchwell/security/.
- All call-home code removed. The original’s license and update phone-home was stripped out and verified — the free version makes zero outbound calls, and Pro’s only outbound call is license validation to our own billing server, never your data. Your roster stays on your server.
Gained — the flagship most cheap time clocks can’t match
- A hard-enforced, per-employee office-IP clock-in lock. Flag an employee as office-only and they can clock in or out only from an allowlisted address. It refuses the punch server-side when they’re off-network — it doesn’t just log a location. Buddy punching from home stops.
- Real allowlist depth: single IPs, CIDR blocks like
203.0.113.0/24, and address ranges; IPv4 and IPv6; company-wide, per-office, and per-employee allowlists (they only ever widen access). Plus block / warn / flag enforcement modes and clock-in time windows. - GPS geofence, a kiosk wall-tablet clock, and a mobile/PWA punch screen — softer or stricter, your call.
- Payroll export (per-employee pay type and rate, weekly and daily overtime, double-time, holiday pay, CSV plus SurePayroll and Gusto connectors — it exports the data, it doesn’t move money), PTO accrual, a daily HR reminder digest, onboarding checklists, employee self-service, and granular permissions.
See the full list on the features page → /punchwell/features/.
How the migration works
The whole move is roughly 30–60 minutes, and we recommend doing it on a staging copy first. Here’s the shape of it — the migration guide → /punchwell/migrate/guide/ has the click-by-click steps and the SQL.
- Back up first. Database and files. Don’t delete the original until you’ve verified the new one — that’s your safety net and what makes this reversible.
- Install and activate Punchwell. Copy the plugin folders in and activate. On the first wp-admin load, the schema reconcile runs automatically.
- Let the automatic upgrade run. Punchwell uses WordPress’s own
dbDeltato reconcile the schema — it adds new tables and columns and never deletes data — and migrates the legacyhrm_employerrole to the currenthrm_employeeone. - Run the one-time data migration SQL (
UPGRADE-DATA-MIGRATION.sql). This copies the handful of legacy column names (a few leave and work-experience fields) into their new columns and normalizes old0000-00-00dates to NULL. Order matters: let the automatic dbDelta step finish before this runs, or leave history can appear blank. - Verify. Run the read-only check pack (
UPGRADE-VERIFY.sql) — it confirms every leave and work-experience row was copied and that there are no orphans. - Re-enter the few things that can’t auto-migrate (more on that below), then point your live site at the new plugin.
Your data is safe — and the upgrade only adds
We built the upgrade path to be conservative on purpose:
- The automatic upgrade never deletes your data. The
dbDeltareconcile only adds missing tables and columns to bring your schema current. Nothing is dropped by the upgrade step. - Your raw records are preserved. Where the original named a column differently, the migration script copies the data into the new column — your original values aren’t thrown away.
- It’s reversible. Because you backed up first and kept the original installed until you verified, you can restore and reactivate the old plugin if anything looks off.
- The verification pack proves it worked.
UPGRADE-VERIFY.sqlis read-only and is designed to come back showing zero un-copied leave rows, zero un-copied work-experience rows, matching row counts, and zero orphans before you trust the new install. - A few things you’ll re-enter by hand (these don’t auto-migrate because the underlying model differs): payroll and salary figures, leave-type yearly entitlements (the type names survive — just the allotments are re-entered), and your office IP allowlist (you’ll re-confirm those under Structure → Locations and Settings → IP & Geofence). That last one is also where you set up the buddy-punch lock, so it’s a natural first stop.
A couple of practical notes from the guide: the scripts assume the standard wp_ table prefix (find-and-replace if yours differs), the one-time SQL also drops three unused legacy tables (hrm_education, hrm_skill, hrm_whitelist) after copying, and staging-first is strongly recommended so you can rehearse the order before touching production.
FAQ
Is my data safe to migrate? Yes, when you back up first. The automatic upgrade only adds tables and columns — it never deletes data — and the migration script copies your legacy fields into their new homes rather than overwriting them. A read-only verification pack confirms every leave and work-experience row came across before you go live. Because you keep a backup and leave the original installed until you’ve verified, the move is reversible.
Will I lose my settings? Most of your records — employees, attendance history, leave history — carry over directly. A short list does need to be re-entered by hand because the data model changed: payroll/salary figures, leave-type yearly entitlements (the type names survive), and your office IP allowlist. Budget a few minutes for those after the data migration runs.
Is it free? There’s a free Community tier on WordPress.org that covers the core HR you’re already using — employees, departments, leave, basic attendance, and a basic single-office IP lock. That’s enough to land safely off the abandoned plugin. The full per-employee and per-office IP-lock depth, GPS geofence, kiosk, mobile punch, payroll export, PTO accrual and the rest are in Pro — $99/year per site. Per site, never per seat, unlimited employees. See pricing → /punchwell/pricing/.
Are you affiliated with the original plugin or its authors? No. Punchwell is an independent, third-party maintained fork of the GPL-licensed original. We are not affiliated with, endorsed by, or sponsored by wpspear, weDevs, or the original author. The original was removed from WordPress.org on 2025-07-01 and last shipped code around 2019; we reference its name only descriptively, to help affected users find a maintained alternative. Because it’s GPL and self-hosted, you genuinely own the code and your data — you’re never locked in.
Is this designed for WordPress Multisite? No — Punchwell isn’t designed for WordPress Multisite. It’s built for a standard single WordPress install, which is where the original plugin ran too.
Land somewhere maintained
You’ve already lived through the abandoned-plugin problem. The fix is a plugin install and a documented migration — and on the other side of it, the buddy-punch lock the original never had.
Get Punchwell free → /punchwell/pricing/ · Follow the migration guide → /punchwell/migrate/guide/
Free on WordPress.org. Per site, not per seat. Your data stays on your server.
Want the full risk picture first? Read the plain-English 5-minute security check → /punchwell/security/. Curious what you gain beyond a fix? See the features → /punchwell/features/.
Punchwell, by Sturdyhaus.
Independent GPL fork. Not affiliated with wpspear, weDevs, or the original author. Product names referenced descriptively only.