Sturdyhaus builds durable WordPress software for small businesses that would rather own their tools than rent them. Every plugin we make is self-hosted, GPL, and built to keep your data on your own WordPress site — no cloud holding your records, no per-seat bill that grows when you hire, no license phoning home.
Right now that means one product in active release — Punchwell, our maintained WordPress HR and time-clock suite — with more on the way. This page is the home for all of them.
See Punchwell → · Compare the plans → · Why buy from Sturdyhaus →
What Sturdyhaus builds
We make one specific kind of plugin: self-hosted business software for the WordPress site you already run. That focus shapes everything.
- Self-hosted by design. Your employee records, timesheets, and HR data live in your own WordPress database — not in someone else’s cloud. Cancel a license and you keep the plugin and every record.
- No data call-home. We removed all of the original’s outbound network and license-check code and verified it: the free version makes zero outbound calls, and Pro’s only outbound call is license validation to our own billing server — never your data. (The only external content is optional YouTube tutorial embeds and standard Gravatar avatars.)
- Flat price, never per-seat. You pay per site, not per head. Add your hundredth employee and the price doesn’t move.
- GPL and yours. An open license means no lock-in. If we ever disappeared, you’d still have the code and your data — exactly what happened to the plugin Punchwell replaces, and exactly why we built it this way.
- Maintained and audited. PHP 8 / WordPress 7 / MySQL 8 clean, security-audited, with privileged endpoints capability-gated.
If you run a small business on WordPress and you’d rather own your tools than subscribe to them, you’re who we build for.
In active release
Punchwell — the WordPress time clock that locks clock-in to your office
Punchwell is a self-hosted WordPress HR and time-clock suite for SMBs with hourly, shift, and on-site teams — retail shops, clinics and dental practices, restaurants, warehouses, salons, gyms, and franchises.
Its flagship feature is the one almost nobody else ships: a hard-enforced, per-employee office-IP clock-in lock. Flag an employee as office-only and they can punch in or out only from your office network. It refuses the punch server-side when they’re off-network — it doesn’t merely log a location. That’s the control that stops buddy punching and off-site clock-ins.
What’s in the box:
- Office-IP clock-in lock — exact IPs, CIDR blocks like
203.0.113.0/24, and address ranges; IPv4 and IPv6; company-wide, per-office, and per-employee allowlists unioned together (adding an IP only ever widens access). Choose block, warn, or flag enforcement, restrict clock-in to a time window, and get emailed when an off-site punch is refused. - GPS geofence, kiosk, and mobile punch — pair the IP lock with an opt-in GPS geofence, a wall-tablet kiosk clock (short code + PIN), and a mobile/PWA punch screen. Softer or stricter, your call. GPS can be spoofed, so we treat the fence as a deterrent — the IP lock is the hard control.
- Attendance & shifts — punch in/out, shift policies, configurable rounding (e.g. nearest 15 min), grace periods, auto clock-out for forgotten punches, overnight shifts.
- Leave & PTO accrual — multiple leave types, approval workflow, holiday calendar with one-click import (US, UK, Canada, Australia and more, plus iCal or paste), and PTO accrual (monthly, per-hour-worked, or annual grant, with caps and carryover).
- Payroll export — per-employee pay type, rate, and frequency; a payout report with weekly and daily overtime, double-time, and holiday pay; worker classification; CSV export plus SurePayroll and Gusto connectors. It exports payroll data — it does not move money, so there’s no payment-processor or tax-custody risk.
- HR reminders & checklists — a daily digest and dashboard widget for birthdays, work anniversaries, probation ends, contract and visa expiries, and missed punches; plus onboarding and offboarding checklists with per-employee progress.
- Self-service & add-ons — front-end widgets (My Pay, My Time Off, profile, leave request), granular role/permission control, and bundled add-ons for recruitment, employee loans, attendance reports, and HR on public pages.
Punchwell is also the maintained WP Human Resource Management alternative. It’s an independent, security-hardened GPL fork of the abandoned original plugin — PHP 8–ready, with the missing-authorization clock-in and access-control flaws addressed, and your existing data carried over. If you’re a stranded user of the original, start with the security advisory or follow the migration guide.
From $99/year — per site, unlimited employees, no per-seat fee. A free Community tier on WordPress.org gives you base HR plus a basic single-office IP lock.
See everything Punchwell does → · Get Punchwell Pro — $99/yr →
Free on WordPress.org. Unlimited employees. No card required for the free version.
Browse by category
As the Sturdyhaus shelf grows, you’ll filter products here by the job they do. For now there’s one category with one product in it — so this row is a placeholder for what’s coming.
| Category | What it covers | Available now |
|---|---|---|
| HR & Time Tracking | Employees, attendance, the office-IP clock-in lock, leave, PTO, payroll export | Punchwell |
| Operations | Day-to-day small-business workflow tools | Coming soon |
| Data & Privacy | Self-hosted, own-your-data utilities for WordPress | Coming soon |
When there’s more than one product to sort, this becomes a real filter. The catalog is built to absorb product #2 without a redesign.
On the roadmap
We ship deliberately and maintain what we ship — so we’d rather name a direction than over-promise a date. Everything Sturdyhaus builds will follow the same rules as Punchwell: self-hosted, flat-priced, GPL, no data call-home.
- More Punchwell, deeper. Punchwell is in active development; new capabilities land in the existing license at no extra per-seat cost.
- A second self-hosted plugin for an adjacent small-business job, built on the same own-your-data principles.
Want to know the moment something new lands? Add your email below — we’ll only use it to tell you when a product ships or a major update is out.
Why buy from Sturdyhaus
Plenty of HR and time-clock tools exist. Here’s what’s different about buying one from us.
Maintained, not abandoned
The plugin Punchwell is built on was a popular WordPress HR plugin that got abandoned — it last shipped around 2019, broke on PHP 8, and was removed from WordPress.org in 2025 for a security issue. We took the GPL code, made it PHP 8 / WordPress 7 / MySQL 8 clean, and keep it current. The base is on version 2.14.1.
Security-audited and capability-gated
The base and add-ons went through a multi-agent security audit (128 findings; all critical and high resolved and adversarially verified) plus a pre-launch adversarial review. Privileged AJAX endpoints are gated with WordPress capability checks (current_user_can()) on top of nonces — the control the original was missing.
GPL — you’re never locked in
An open license means the code is genuinely yours. Your license pays for updates, support, and the Pro bundle — the standard professional-plugin model — but you can export your data anytime, and you’re never held hostage by a vendor that disappears.
Per site, never per seat
One flat annual price. A 25-person shop pays roughly $1,520/yr for Buddy Punch, ~$1,950 for Deputy, or ~$2,100 for When I Work — all billed per head (figures approximate, as of 2026). Punchwell is $99/yr flat, unlimited employees, and your renewal price is locked for as long as you never lapse.
Honest about what it does
We say what the software does and what it doesn’t. It exports payroll data — it doesn’t move money. GPS deters; the IP lock enforces. No “unhackable,” no fake urgency, no pre-checked upsells. See the full comparison →
Why we built Punchwell this way → · Compare the plans →
Get notified when we ship
New products and major updates land here first. Drop your email and we’ll send a short note when something new is available — nothing else.
Email [ you@yourbusiness.com ] → Notify me
No spam, no list-selling. Self-hosted to the core — your address stays with us, and you can unsubscribe anytime. We only email when a product ships or a major update is out.
FAQ
How many products does Sturdyhaus sell right now? One in active release: Punchwell, our self-hosted WordPress HR and time-clock suite. More are on the roadmap. This catalog is built so a second product slots in without changing how the page works.
What makes Punchwell different from other WordPress time clocks? The per-employee office-IP clock-in lock. Most SMB time clocks rely on GPS geofencing only — which needs an app and can be spoofed from home. Punchwell refuses an off-site punch server-side when the employee isn’t on your office network, and it pairs that hard control with an optional GPS geofence, a kiosk, and a mobile punch screen. See how the IP lock works →
Is “self-hosted” a burden? Do I have to run a server? No. If you already run a WordPress site, you have everything you need — Punchwell installs like any other plugin and updates through your dashboard. “Self-hosted” just means your data lives in your own WordPress database instead of a vendor’s cloud. There’s no separate server or cloud account to manage.
What does it cost, and is it per employee? It’s per site, never per seat. There’s a free Community tier on WordPress.org, then Pro is $99/year per site — everything bundled, unlimited employees on every tier. See the pricing →
Is Punchwell affiliated with the original WP Human Resource Management plugin? No. Punchwell is an independent, third-party maintained GPL fork. Sturdyhaus is not affiliated with, endorsed by, or sponsored by wpspear, weDevs, or the original author. We reference the original plugin’s name only descriptively, to help people running the abandoned version find a maintained alternative. Read the migration guide →
Does any of my data leave my server? No. All of the original’s call-home and outbound network code was removed and verified — the free version makes zero outbound calls, and the only outbound call Pro makes is validating your license key against our own billing server, never your data. Your employee and attendance data stays in your WordPress database. The only external content is optional YouTube tutorial embeds and standard Gravatar avatars.
Start with Punchwell
The fastest way to see what Sturdyhaus is about: install the free version, flag one employee as office-only, and watch an off-site punch get refused. That’s the whole pitch in about five minutes.
See everything Punchwell does → · Get Punchwell Pro — $99/yr → · Read the security advisory →
Per site, not per seat. GPL. Self-hosted. Your data stays on your server.
Sturdyhaus is an independent maintainer of GPL WordPress software. Punchwell is a third-party maintained fork of the “WP Human Resource Management” plugin and is not affiliated with, endorsed by, or sponsored by wpspear, weDevs, or the original author. Product names are referenced descriptively only.
Internal links used on this page: /products/punchwell/ · /pricing/ · /compare/ · /about/ · /security/ · /migrate/
Note on placeholders: the email-capture field, the “Notify me” target, and the [image: …] notes are build-time slots for the WordPress theme builder. Sibling-route links assume the storefront catalog (/products/punchwell/, /pricing/, /compare/, /about/, /security/, /migrate/); adjust slugs if the final routing differs. All product facts are drawn from the authoritative Fact Kit — no testimonials, user counts, or affiliations were invented, and the nominative-use disclaimer is present per house rules.