Punchwell is actively maintained and regularly updated. This page is the honest, public record of every release — what each version added, fixed, and hardened. We keep it current because the plugin Punchwell continues was abandoned: it last shipped meaningful code around 2019 and was removed from WordPress.org in 2025 with unpatched issues. The list below is the difference. It’s the same plugin lineage you may already know — now PHP 8–ready, security-fixed, and shipping improvements on a steady cadence.
Versions are listed newest first. Where a release changes the database, the upgrade runs automatically the next time an administrator loads wp-admin — there’s nothing to run by hand.
See current features · Compare the plans · Moving from the original plugin?
2026 — the revival and feature sprint
2.14.1 — Jun 17, 2026
Pre-launch tidy-up. A couple of strings were made translatable, the translation template was repaired, and this changelog/readme was refreshed. No functional change.
2.14.0 — Jun 17, 2026
Geofence distance in metres or feet. A company-wide setting lets US-based admins enter and read GPS geofence radii in feet instead of metres. It’s purely a display preference — distances are always stored internally in metres, so flipping the unit never moves an existing fence. Defaults to metres, so nothing changes for existing sites.
2.13.1 — Jun 17, 2026 · Security
Closed an authorization hole in the leave-delete action: previously any logged-in user could delete another employee’s leave request (and revert its PTO balance). Deleting leave now requires the right permission — a regular employee may only cancel their own still-pending request, and managers are limited to their own office where office-scoped approvals are in use. Recommended for all sites.
2.13.0 — Jun 17, 2026
GPS geofence enforcement goes live. When enabled, a worker punching from the mobile/GPS punch screen is checked against the work site — a company-wide fence, or a per-office fence set under Structure → Locations — honouring your Block / Warn / Flag enforcement mode. It pairs with the office-IP lock. Designed never to lock out a real worker: a missing or weak GPS fix is allowed (and recorded in Warn/Flag mode), and clock-out is never blocked by distance. GPS can be spoofed, so we treat the fence as a deterrent, not proof of presence. Opt-in, off by default. Adds per-office latitude/longitude/radius columns (applied automatically).
2.12.0 — Jun 16, 2026
Added a leave-approval decision hook so an add-on can enforce a narrower approval scope than the global leave-manage permission. The front-end add-on uses it so a site manager only approves requests for their own office. Default behaviour is unchanged for existing sites.
2.11.7 — Jun 16, 2026 · Maintenance
Removed dead code carried over from the plugin’s origin (it was forked years ago from a project-manager tool): 30 unused project/task/client/invoice/file-manager AJAX endpoints that pointed at methods which no longer existed, plus three unused legacy table definitions. No HR feature is affected — just a smaller, safer codebase.
2.11.6 — Jun 16, 2026
Company Notices / announcement board is reachable again, now under Structure → Notices. Post titled, dated announcements for staff. The feature shipped originally but lost its menu entry when the Organization menu was folded into Structure; this re-homes it with no new table and no database change. Posts still appear on the dashboard and the front-end notice shortcode.
2.11.5 — Jun 16, 2026
Retired the legacy overtime in the attendance report so there’s one consistent overtime story across the suite. Overtime now comes solely from the payroll engine — actual punches plus your configurable threshold and multiplier. The report still shows worked time, present/absent days, leaves and scheduled hours.
2.11.4 — Jun 16, 2026
Simplified the Shift form: the manual “Work Duration” field is gone, since work duration is now derived automatically from the shift’s begin/end span (correctly handling shifts that cross midnight). Breaks are unchanged. Also hardened the attendance report’s hours math against blank values on PHP 8.
2.11.3 — Jun 16, 2026 · Fix
Error messages were being silently swallowed across the app — a toast helper was referenced by the wrong name in about 35 places, so a failed action threw instead of showing its message and left the loading spinner spinning. Most visibly, editing a Shift that the system rejected would just hang with no explanation. Every error path now shows its real message.
2.11.2 — Jun 16, 2026 · Fix
Editing an employee’s Department or Designation (or any Add/Edit Employee field) could hang forever on the saving spinner — caused by a PHP 8 type error in an internal join-date helper. Fixed, along with the same class of hang in the payroll salary statement / formula validator and in the single-employee attendance report on empty date ranges.
2.11.1 — Jun 16, 2026
Every screen where you enter IPs for clock-in access — Settings → IP & Geofence, Structure → Locations (per-office), and an employee’s profile — now shows “Your current IP” with a one-click Use this IP button. No more hunting for your address on a separate site.
2.11.0 — Jun 16, 2026
A deep release for the office-IP lock:
- Office locations are managed server-side under Structure → Locations (add/edit/delete offices), restoring the office screen lost in an earlier menu consolidation.
- Per-office and per-employee clock-in IP allowlists. Each location can carry its own allowed IPs (single IP, CIDR block, or range; IPv4 + IPv6), and an employee’s profile gained an “Additional allowed IPs” box. The lock now checks the union of the company-wide allowlist, the assigned office’s IPs and the employee’s own IPs — adding an IP only ever widens access, never narrows it. (Adds one office column, applied automatically.)
- Settings consolidation: the onboarding/offboarding checklist editor moved into Settings → Checklists, and a duplicate “Settings” menu entry was removed.
2.10.1 — Jun 16, 2026 · Fix
Holiday Import could fail to save longer holiday names on installs carried over from the original plugin (a too-short database column). The upgrade now widens it automatically on the next admin page load.
2.10.0 — Jun 15, 2026
Paid-time-off accrual (Punchwell → Time Off). Per leave type, mark it Paid or Unpaid and choose how it accrues — over time (monthly or per hour worked) or as a lump-sum annual grant — all in hours, with a max-balance cap, year-end carryover cap and a waiting period. A daily job accrues automatically (and back-fills any months a missed cron skipped); approving paid leave draws the balance down, cancelling restores it. Admins get a balances view with manual adjustments; employees see their own balances and history. Security: non-managers can no longer self-approve or reassign a leave request.
2.9.1 — Jun 15, 2026
The Structure page gained an Employees tab — an Active / Terminated / All roster you can filter, showing each person’s status, employee ID, department and join date with a quick Edit link.
2.9.0 — Jun 15, 2026
A single Structure page that merges the former Organization, Departments and Job Titles screens into one tabbed page, so the org structure isn’t spread across three menu items. Reuses the existing, hardened data logic — no rebuild and no database change. Adds a server-side active/terminated employee filter and a performance fix for the reminder digest.
2.8.4 — Jun 15, 2026
No leave accrual after termination: a leave request can no longer be filed for any date after an employee’s termination date. Pairs with the terminated-employee punch block.
2.8.3 — Jun 12, 2026 · Performance
The daily HR reminder digest and “Upcoming HR dates” widget now prime the employee data cache in one query instead of one per employee per field — avoiding slowdowns on larger rosters. No behaviour change.
2.8.2 — Jun 12, 2026
Terminated employees (with a termination date on or before today) can no longer clock in or out — the punch is refused with a clear message.
2.8.1 — Jun 12, 2026 · Security / Fix
Pre-launch hardening pass from an adversarial audit of the recent settings work:
- Compensation fields on the user profile now require an HR capability (an employee could otherwise set their own pay rate).
- “Maximum shift length” now defaults to no cap, restoring the no-op-by-default guarantee — previously every punch-out was silently capped at 16 hours.
- A configured clock-in time window no longer blocks clock-out, so a shift running past the window can always be closed.
- Email header and CSV-export hardening; the daily cron is now cleaned up on deactivation and uninstall.
2.8.0 — Jun 12, 2026
Onboarding & offboarding checklists (Punchwell → Checklists): editable task templates you tick off per employee, with an “X of Y (NN%)” progress indicator. Completion is stored by task name, so reordering the template never loses a tick. Helps small teams onboard consistently and offboard cleanly — accounts, equipment, final pay, exit interview.
2.7.1 — Jun 12, 2026
The Date format setting now actually applies across Punchwell date displays, and the default fiscal-year start is now Jan 1 / calendar year (configurable, and only affecting fresh installs).
2.7.0 — Jun 12, 2026
An HR reminder engine. A once-a-day digest emails the admin (CC HR) covering the next N days: birthdays, work anniversaries, probation ends, contract/visa-permit expiries, and employees who missed a punch on the last working day — each section gated by its own toggle, so quiet sites stay quiet. Adds an “Upcoming HR dates” dashboard widget and three key-date profile fields. The date math is unit-tested for leap years and year boundaries.
2.6.0 — Jun 12, 2026
A central Settings hub (Punchwell → Settings) that makes the whole suite far more configurable, organized into tabs:
- General & Branding — company name, logo, address, HR timezone, date/time format, fiscal-year start, and employee-ID auto-numbering.
- Attendance — punch rounding, late grace, auto clock-out and maximum-shift caps (so a forgotten punch-out no longer runs overnight), overnight-shift toggle, and an optional “require a reason on manual edits” rule.
- IP & Geofence — enforcement mode (hard Block, Warn-and-log, or Flag), CIDR/range allowlists, lock-by-role, a clock-in time window, an email alert on a blocked off-site punch, and stored GPS geofence settings.
- Notifications — From-name, Reply-to, CC HR, and per-event on/off toggles.
- Data & Privacy — a daily attendance-retention purge and an opt-in anonymise-terminated-employees hook.
Every new option defaults to no change until you opt in. No database change.
2.5.1 — Jun 12, 2026
On Attendance → Configuration, your current public IP is now shown right under the “Allow IP” box with a one-click Use this IP button. If the detected address is a private/LAN IP, it warns you to use your office’s public IP instead. No network calls.
2.5.0 — Jun 12, 2026
A Holiday Import tool (Punchwell → Holiday Import) so you no longer add a year of holidays one date at a time:
- Country presets — one click adds a full year of public holidays for the US, UK (England & Wales), Canada or Australia, computed on your own server (including weekend-shift rules and Easter-based dates). No internet connection or third-party service is used.
- iCal (.ics) upload — drop in a calendar export and its all-day events become holidays, read locally.
- Paste a list — type lines like
2026-07-04, Independence Day.
A dry-run preview marks each entry New, Duplicate (skipped) or Invalid before anything is saved.
Security: this release also carried a broad hardening pass — capability gates on the attendance, leave and holiday handlers (so an ordinary employee can no longer create holidays or read a co-worker’s leave), an IDOR fix on cross-employee leave records, and several PHP 8 / MySQL 8 correctness fixes.
2.4.9 — Jun 12, 2026 · Fix
The new Get Started page returned an access error because it registered before its parent menu existed. It now registers after the parent menu and loads correctly.
2.4.8 — Jun 11, 2026 · Security / Fix
Scoped the remaining cross-employee read endpoints: a regular employee can now only see their own attendance records and leave balance — viewing other people’s requires an HR capability. This completed the AJAX authorization hardening pass. Also: a failed clock-in is no longer silently reported as success.
2.4.7 — Jun 11, 2026
A real Add-Ons page (the old one relied on the removed vendor call-home and showed nothing) — a self-contained, server-rendered showcase of the suite’s own add-ons with live Active/Installed status. Plus a Get Started setup checklist that detects what’s configured, shows a progress bar, and links straight to each remaining step (clocking in has an invisible department → shift → assignment prerequisite chain that used to be confusing). No outbound network calls.
2.4.6 — Jun 11, 2026 · Security
Added capability checks to the base plugin’s AJAX layer, which previously trusted a nonce alone. Creating/editing employees, managing departments, changing the office-IP / attendance settings, and reading or saving another user’s profile now require administrator or HR-manager rights. Self-service for one’s own punch, profile and leave is unchanged.
2.4.5 — Jun 11, 2026 · Security / Fix
A dense correctness-and-security release:
- Holidays can be created on MySQL 8 — the holiday table had columns that were NOT NULL with no default, which strict mode rejected on every insert; now nullable and reconciled.
- Clock-out works on MySQL 8 — punch-out searched for a legacy zero-date that modern rows store as NULL, so clock-out silently did nothing; it now matches both and reports a clear error if it fails.
- Closed a privilege-escalation hole: the employee forms took the WordPress role straight from the request, so a low-privilege user could assign themselves administrator. Roles assignable through the forms are now restricted to the plugin’s own.
- “Delete employee” now requires the proper capability instead of being open to any logged-in user.
- Punching in on behalf of another employee now requires an administrator — closing a server-side buddy-punching vector that also bypassed the office-IP lock.
2.4.4 — Jun 11, 2026 · Fix
Employees can clock in again on sites with pre-2.0 data. A department’s “active” status was stored differently on legacy installs, so the clock-in “assigned department” check failed for every employee; the lookup now heals legacy data immediately and the upgrade reconciles existing rows. Also fixed opaque department save errors and a latent PHP 8 crash.
2.4.3 — Jun 11, 2026 · Fix
Fixes found during the live pre-launch smoke test: the Attendance screen no longer triggers a server error on load (a double table-prefix bug in the shift lookup), and creating a Leave Type no longer fatals on tables that predate newer columns — the upgrade now reconciles the leave-type table and the save reports a clear error instead of crashing.
2.4.2 — Jun 11, 2026
- Worker classification on the user profile — Full-time / Part-time / 1099 Contractor / Temporary / Intern (drives payroll treatment).
- Termination date + reason fields on the user profile, with a derived active/terminated state.
- Both exposed to the API for reporting and the payroll add-ons.
2.4.1 — Jun 10, 2026 · Fix
- The employee profile “General Information” save no longer hangs — it hit a PHP 8 type error and, separately, never actually persisted the posted fields. Both fixed.
- Fixed the single attendance-record view (used the wrong transformer), a shift-summary read of a non-existent attribute, and a profile file-deletion bug.
- Removed the gender breakdown from the dashboard (it’s sensitive, and remains on the individual profile); dashboard counter cards are now responsive. Plus broad internationalization and many spelling corrections.
2.4.0 — 2026 · The revival release
The release that brought the plugin back to life and is the foundation for everything above:
- PHP 8 / MySQL 8 / WordPress 7 compatibility — migrated the data layer to a maintained ORM, removed end-of-life dependencies, and made the schema strict-mode safe (the old zero-date defaults that fatal on modern MySQL are gone).
- The flagship per-employee office-IP clock-in lock — block off-site and “buddy” punching by refusing the punch server-side.
- A self-healing, version-gated database upgrade/repair that runs on admin load.
- A full security audit and hardening of the base plugin and all add-ons, and removal of all outbound “call-home” network code.
2018–2019 — the original lineage
These are the original plugin’s last releases before it was abandoned. We keep them here for the full, honest history — and as the context for why a maintained fork was needed. Everything from 2.4.0 up is Punchwell’s work.
2.2.17 — Oct 12, 2019
Leave and attendance code refactoring.
2.2.16 — Sep 10, 2019
Fixed a problem with new leave creation.
2.2.15 — Sep 04, 2019
A security fix and a data-filtering fix.
2.2.14 — Sep 01, 2019
New dashboard “absent” section and a leave-management tutorial; fixed organization general-info saving.
2.2.13 — Jul 21, 2019
Leave-apply permission fixes and WP user-profile role updates.
2.2.12 — Jul 09, 2019
Per-user shift details; punch-out disabled without a shift policy; multiple-department shift fix.
2.2.0 – 2.2.11 — 2018–2019
The original attendance management system arrived in 2.2.0 (Aug 2018), followed by a run of fixes to shifts, leave, departments and the dashboard.
2.1.0 – 2.1.3 — 2018
The original payroll module and the first Eloquent data layer.
2.0 – 2.0.1 — Mar 2018
The original front-end was migrated to a Vue single-page app.
Why this page exists
Most time-clock software either bills you per employee forever or runs in someone else’s cloud. Punchwell does neither — it’s self-hosted, flat-priced, and GPL, so your team’s data stays on your own WordPress server. This changelog is part of the deal: a maintained product should be able to show its work. If you’re weighing Punchwell against the abandoned original, this is the proof that it’s looked after.
Download the free version · See how the IP lock works · Already running the old plugin? Read the migration guide.
Punchwell is an independent, third-party maintained fork of the GPL-licensed “WP Human Resource Management” plugin. Sturdyhaus is not affiliated with, endorsed by, or sponsored by wpspear, weDevs, the original author, or any other prior maintainer. “WP Human Resource Management” is referenced descriptively (nominative fair use) only to identify the software lineage and help affected users find a maintained alternative. All trademarks belong to their respective owners.