plugbloom is a small, independent studio making self-hosted-first WordPress tools for the people who run their own servers — developers, agencies, freelancers. We’d rather tend a few specimens well than ship a shelf of half-built plugins.
Your server is yours. Self-hosted-first means your data stays where you put it — never round-tripped through someone else’s cloud.
The free build has to be genuinely useful. We paywall the action, not the view — you can always see what a tool does before you pay for it.
We build to marketplace standards, not one-host hacks. If it only works on our box, it isn’t finished.
Security isn’t a setting — it’s the default. Audited, SSRF-guarded, keys encrypted at rest.
No bloat. No telemetry in the free build. A tool should make your server lighter to run, not heavier.
The home page lists them in brief. Here’s the longer version — the working rules we hold each specimen to before it leaves the studio.
Every plugin is built to ship on wordpress.org and beyond — never tuned to a single box. That means it works on shared hosting, behind CDNs and reverse proxies, and on locked-down hosts where shell_exec and /proc are off the table. Every probe reports its own availability and degrades gracefully, so the UI stays honest instead of throwing a blank screen.
The free build earns its keep on its own — it’s a real tool, not a trial. You pay only when you outgrow it, and the upgrade unlocks more capability, never information you were already shown. Gating is on execution, never visibility: you can see exactly what a Pro action does before you decide it’s worth it.
Each plugin is security-reviewed before release and re-checked as it grows: SSRF-guarded fetches, capability checks on every privileged action, no shell interpolation. Connection keys are 48-character CSPRNG secrets, verified in constant time and encrypted at rest. And the free build phones nobody home — there’s no telemetry, because your server’s data is none of our business.
We keep the catalog small on purpose. A short list of plugins we actually maintain beats a long list we’ve let go to seed. Every specimen in the ground is one we’re prepared to water — patched, supported, and kept current with WordPress — for as long as it’s planted.
Five stages, in order — nothing skips ahead. A specimen doesn’t reach the shelf until it has cleared every one.
We start from an actual frustration in running self-hosted WordPress — something we or the people we build for hit week after week. No solution looking for a problem.
From the first commit it’s written to marketplace grade: works on shared hosting, behind CDNs, with shell functions disabled — and degrades gracefully where it can’t reach the metal.
Before anything ships, it gets reviewed: capability checks, SSRF guards, encrypted secrets, no shell interpolation. If the audit doesn’t pass, the release doesn’t happen.
The plugin lands free on wordpress.org — a complete, useful build, not a teaser. That free version is the front door, and it has to stand on its own.
For the people who outgrow free, we add Pro capability on top — history, alerts, automation, multisite. New power, never a paywall around what you could already see.
Live Server Monitor is planted and available — a live wp-admin dashboard for your server and WordPress stack. The next is budding. We add to the catalog slowly, on purpose.
Visit the collection →We ship a few things a year and write a short note when we do. No drip campaigns, no reselling your address.
One email per release. Unsubscribe in a click.