diff --git a/roles/common/tasks/disable_challenge_sites.yml b/roles/common/tasks/disable_challenge_sites.yml
index 7995565b3a..32c12667e9 100644
--- a/roles/common/tasks/disable_challenge_sites.yml
+++ b/roles/common/tasks/disable_challenge_sites.yml
@@ -3,5 +3,5 @@
   file:
     path: "{{ nginx_path }}/sites-enabled/letsencrypt-{{ item }}.conf"
     state: absent
-  with_items: "{{ wordpress_sites.keys() | list }}"
+  loop: "{{ wordpress_sites.keys() | list }}"
   notify: reload nginx
diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml
index 8b74eb1061..0d24d606e4 100644
--- a/roles/common/tasks/main.yml
+++ b/roles/common/tasks/main.yml
@@ -4,7 +4,7 @@
     include_vars:
       file: group_vars/{{ item }}/wordpress_sites.yml
       name: "{{ item }}_sites"
-    with_items: "{{ envs_with_wp_sites }}"
+    loop: "{{ envs_with_wp_sites }}"
     when: envs_with_wp_sites | count > 1
 
   - name: Fail if there are duplicate site keys within host's wordpress_sites
@@ -15,7 +15,7 @@
         are duplicated between the `{{ item.env_pair | join('` and `') }}` groups:
           {{ item.site_keys | to_nice_yaml | indent(2) }}
     when: item.site_keys | count
-    with_items: "{{ site_keys_by_env_pair }}"
+    loop: "{{ site_keys_by_env_pair }}"
 
   when:
     - env_groups | count > 1
@@ -30,7 +30,9 @@
 - name: Validate format of site_hosts
   fail:
     msg: "{{ lookup('template', 'site_hosts.j2') }}"
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
   when: item.value.site_hosts | rejectattr('canonical', 'defined') | list | count
   tags: [letsencrypt, wordpress]
 
@@ -144,7 +146,9 @@
     name: "{{ item.key }}"
     state: "{{ item.value }}"
     cache_valid_time: "{{ apt_cache_valid_time }}"
-  with_dict: "{{ apt_packages }}"
+  loop: "{{ apt_packages | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
 
 - name: Validate timezone variable
   stat:
diff --git a/roles/deploy/hooks/finalize-after.yml b/roles/deploy/hooks/finalize-after.yml
index 1d20d3b456..7b033d9639 100644
--- a/roles/deploy/hooks/finalize-after.yml
+++ b/roles/deploy/hooks/finalize-after.yml
@@ -8,17 +8,20 @@
     changed_when: site_transient_theme_roots.stdout != ''
     when: project.update_wp_theme_paths | default(update_wp_theme_paths | default(true)) | bool
 
+  - debug:
+      var: wp_template_root.results
+
   - name: Update WP theme paths
     command: >
-      wp option set {{ item[0].option }}
+      wp option set {{ item[0].item }}
       {{ item[1] | regex_replace('.*' + deploy_helper.releases_path + '/[^/]*(.*)', deploy_helper.new_release_path + '\1') }}
       {% if project.multisite.enabled | default(false) %} --url={{ item[1].split(' ')[0] }}{% endif %}
     args:
       chdir: "{{ deploy_helper.current_path }}"
-    when: project.update_wp_theme_paths | default(update_wp_theme_paths | default(true)) | bool
-    with_subelements:
-      - "[{% for result in wp_template_root.results %}{'option': '{{ result.item }}', 'stdout_lines': {{ result.stdout_lines | default ([]) | select('search', deploy_helper.releases_path) | list }}},{% endfor %}]"
-      - stdout_lines
+    loop: "{{ wp_template_root.results | subelements('stdout_lines', skip_missing=true) }}"
+    loop_control:
+      label: "{{ item[0].item }}"
+    when: project.update_wp_theme_paths | default(update_wp_theme_paths | default(true)) | bool and item[1] is match(deploy_helper.releases_path)
 
   - name: Warn about updating network database.
     debug:
diff --git a/roles/deploy/hooks/finalize-before.yml b/roles/deploy/hooks/finalize-before.yml
index b9fb5fd981..b219df86b0 100644
--- a/roles/deploy/hooks/finalize-before.yml
+++ b/roles/deploy/hooks/finalize-before.yml
@@ -56,6 +56,6 @@
   when:
     - wp_installed.rc == 0
     - project.update_wp_theme_paths | default(update_wp_theme_paths | default(true)) | bool
-  with_items:
+  loop:
     - template_root
     - stylesheet_root
diff --git a/roles/deploy/tasks/build.yml b/roles/deploy/tasks/build.yml
index aa0e043e69..499d65eed3 100644
--- a/roles/deploy/tasks/build.yml
+++ b/roles/deploy/tasks/build.yml
@@ -4,12 +4,13 @@
     path: "{{ item }}"
   delegate_to: localhost
   register: deploy_build_before_paths
-  with_items: "{{ deploy_build_before | default([]) }}"
+  loop: "{{ deploy_build_before | default([]) }}"
 
 - include_tasks: "{{ include_path.item }}"
-  with_items: "{{ deploy_build_before_paths.results }}"
+  loop: "{{ deploy_build_before_paths.results }}"
   loop_control:
     loop_var: include_path
+    label: "{{ include_path.item }}"
   when: include_path.stat.exists
   tags: deploy-build-before
 
@@ -18,13 +19,15 @@
     src: "{{ item.src }}"
     dest: "{{ deploy_helper.new_release_path }}/{{ item.dest }}"
     mode: "{{ item.mode | default('0644') }}"
-  with_items: "{{ project.project_templates | default(project_templates) }}"
+  loop: "{{ project.project_templates | default(project_templates) }}"
+  loop_control:
+    label: "{{ item.name }}"
 
 - name: Check if project folders exist
   stat:
     path: "{{ deploy_helper.current_path }}/{{ item }}"
   register: project_folder_paths
-  with_items: "{{ project.project_copy_folders | default(project_copy_folders) }}"
+  loop: "{{ project.project_copy_folders | default(project_copy_folders) }}"
 
 - name: Copy project folders
   copy:
@@ -32,7 +35,9 @@
     dest: "{{ deploy_helper.new_release_path }}/{{ item.item }}"
     remote_src: true
     mode: 'preserve'
-  with_items: "{{ project_folder_paths.results }}"
+  loop: "{{ project_folder_paths.results }}"
+  loop_control:
+    label: "{{ item.item }}"
   when: item.stat.exists
 
 - name: Check if deploy_build_after scripts exist
@@ -40,11 +45,12 @@
     path: "{{ item }}"
   delegate_to: localhost
   register: deploy_build_after_paths
-  with_items: "{{ deploy_build_after | default([]) }}"
+  loop: "{{ deploy_build_after | default([]) }}"
 
 - include_tasks: "{{ include_path.item }}"
-  with_items: "{{ deploy_build_after_paths.results }}"
+  loop: "{{ deploy_build_after_paths.results }}"
   loop_control:
     loop_var: include_path
+    label: "{{ include_path.item }}"
   when: include_path.stat.exists
   tags: deploy-build-after
diff --git a/roles/deploy/tasks/finalize.yml b/roles/deploy/tasks/finalize.yml
index 824c44f3e5..843f46632c 100644
--- a/roles/deploy/tasks/finalize.yml
+++ b/roles/deploy/tasks/finalize.yml
@@ -4,12 +4,13 @@
     path: "{{ item }}"
   delegate_to: localhost
   register: deploy_finalize_before_paths
-  with_items: "{{ deploy_finalize_before | default([]) }}"
+  loop: "{{ deploy_finalize_before | default([]) }}"
 
 - include_tasks: "{{ include_path.item }}"
-  with_items: "{{ deploy_finalize_before_paths.results }}"
+  loop: "{{ deploy_finalize_before_paths.results }}"
   loop_control:
     loop_var: include_path
+    label: "{{ include_path.item }}"
   when: include_path.stat.exists
   tags: deploy-finalize-before
 
@@ -26,12 +27,13 @@
     path: "{{ item }}"
   delegate_to: localhost
   register: deploy_finalize_after_paths
-  with_items: "{{ deploy_finalize_after | default([]) }}"
+  loop: "{{ deploy_finalize_after | default([]) }}"
 
 - include_tasks: "{{ include_path.item }}"
-  with_items: "{{ deploy_finalize_after_paths.results }}"
+  loop: "{{ deploy_finalize_after_paths.results }}"
   loop_control:
     loop_var: include_path
+    label: "{{ include_path.item }}"
   when: include_path.stat.exists
   tags: deploy-finalize-after
 
diff --git a/roles/deploy/tasks/initialize.yml b/roles/deploy/tasks/initialize.yml
index 5b1d48cc16..df75215f5e 100644
--- a/roles/deploy/tasks/initialize.yml
+++ b/roles/deploy/tasks/initialize.yml
@@ -4,10 +4,10 @@
     path: "{{ item }}"
   delegate_to: localhost
   register: deploy_initialize_before_paths
-  with_items: "{{ deploy_initialize_before | default([]) }}"
+  loop: "{{ deploy_initialize_before | default([]) }}"
 
 - include_tasks: "{{ include_path.item }}"
-  with_items: "{{ deploy_initialize_before_paths.results }}"
+  loop: "{{ deploy_initialize_before_paths.results }}"
   loop_control:
     loop_var: include_path
   when: include_path.stat.exists
@@ -24,10 +24,10 @@
     path: "{{ item }}"
   delegate_to: localhost
   register: deploy_initialize_after_paths
-  with_items: "{{ deploy_initialize_after | default([]) }}"
+  loop: "{{ deploy_initialize_after | default([]) }}"
 
 - include_tasks: "{{ include_path.item }}"
-  with_items: "{{ deploy_initialize_after_paths.results }}"
+  loop: "{{ deploy_initialize_after_paths.results }}"
   loop_control:
     loop_var: include_path
   when: include_path.stat.exists
diff --git a/roles/deploy/tasks/main.yml b/roles/deploy/tasks/main.yml
index 5478676a7b..b8c102d4ac 100644
--- a/roles/deploy/tasks/main.yml
+++ b/roles/deploy/tasks/main.yml
@@ -4,10 +4,10 @@
     path: "{{ item }}"
   delegate_to: localhost
   register: deploy_before_paths
-  with_items: "{{ deploy_before | default([]) }}"
+  loop: "{{ deploy_before | default([]) }}"
 
 - include_tasks: "{{ include_path.item }}"
-  with_items: "{{ deploy_before_paths.results }}"
+  loop: "{{ deploy_before_paths.results }}"
   loop_control:
     loop_var: include_path
   when: include_path.stat.exists
@@ -25,10 +25,10 @@
     path: "{{ item }}"
   delegate_to: localhost
   register: deploy_after_paths
-  with_items: "{{ deploy_after | default([]) }}"
+  loop: "{{ deploy_after | default([]) }}"
 
 - include_tasks: "{{ include_path.item }}"
-  with_items: "{{ deploy_after_paths.results }}"
+  loop: "{{ deploy_after_paths.results }}"
   loop_control:
     loop_var: include_path
   when: include_path.stat.exists
diff --git a/roles/deploy/tasks/prepare.yml b/roles/deploy/tasks/prepare.yml
index 2567d7986e..33ae769999 100644
--- a/roles/deploy/tasks/prepare.yml
+++ b/roles/deploy/tasks/prepare.yml
@@ -4,10 +4,10 @@
     path: "{{ item }}"
   delegate_to: localhost
   register: deploy_prepare_before_paths
-  with_items: "{{ deploy_prepare_before | default([]) }}"
+  loop: "{{ deploy_prepare_before | default([]) }}"
 
 - include_tasks: "{{ include_path.item }}"
-  with_items: "{{ deploy_prepare_before_paths.results }}"
+  loop: "{{ deploy_prepare_before_paths.results }}"
   loop_control:
     loop_var: include_path
   when: include_path.stat.exists
@@ -59,10 +59,10 @@
     path: "{{ item }}"
   delegate_to: localhost
   register: deploy_prepare_after_paths
-  with_items: "{{ deploy_prepare_after | default([]) }}"
+  loop: "{{ deploy_prepare_after | default([]) }}"
 
 - include_tasks: "{{ include_path.item }}"
-  with_items: "{{ deploy_prepare_after_paths.results }}"
+  loop: "{{ deploy_prepare_after_paths.results }}"
   loop_control:
     loop_var: include_path
   when: include_path.stat.exists
diff --git a/roles/deploy/tasks/share.yml b/roles/deploy/tasks/share.yml
index 043ab79392..ee3166d549 100644
--- a/roles/deploy/tasks/share.yml
+++ b/roles/deploy/tasks/share.yml
@@ -4,12 +4,13 @@
     path: "{{ item }}"
   delegate_to: localhost
   register: deploy_share_before_paths
-  with_items: "{{ deploy_share_before | default([]) }}"
+  loop: "{{ deploy_share_before | default([]) }}"
 
 - include_tasks: "{{ include_path.item }}"
-  with_items: "{{ deploy_share_before_paths.results }}"
+  loop: "{{ deploy_share_before_paths.results }}"
   loop_control:
     loop_var: include_path
+    label: "{{ include_path.item }}"
   when: include_path.stat.exists
   tags: deploy-share-before
 
@@ -18,7 +19,9 @@
     path: "{{ deploy_helper.shared_path }}/{{ item.src }}"
     state: directory
     mode: "{{ item.mode | default('0755') }}"
-  with_items: "{{ project.project_shared_children | default(project_shared_children) }}"
+  loop: "{{ project.project_shared_children | default(project_shared_children) }}"
+  loop_control:
+    label: "{{ item.path }}"
   when: item.type | default('directory') | lower == 'directory'
 
 - name: Ensure shared sources are present -- files' parent directories
@@ -26,7 +29,9 @@
     path: "{{ deploy_helper.shared_path }}/{{ item.src | dirname }}"
     state: directory
     mode: '0755'
-  with_items: "{{ project.project_shared_children | default(project_shared_children) }}"
+  loop: "{{ project.project_shared_children | default(project_shared_children) }}"
+  loop_control:
+    label: "{{ item.path }}"
   when: item.type | default('directory') | lower == 'file'
 
 - name: Ensure shared sources are present -- files
@@ -34,7 +39,9 @@
     path: "{{ deploy_helper.shared_path }}/{{ item.src }}"
     state: touch
     mode: "{{ item.mode | default('0644') }}"
-  with_items: "{{ project.project_shared_children | default(project_shared_children) }}"
+  loop: "{{ project.project_shared_children | default(project_shared_children) }}"
+  loop_control:
+    label: "{{ item.path }}"
   when: item.type | default('directory') | lower == 'file'
 
 - name: Ensure parent directories for shared paths are present
@@ -42,31 +49,38 @@
     path: "{{ deploy_helper.new_release_path }}/{{ item.path | dirname }}"
     mode: '0755'
     state: directory
-  with_items: "{{ project.project_shared_children | default(project_shared_children) }}"
+  loop: "{{ project.project_shared_children | default(project_shared_children) }}"
+  loop_control:
+    label: "{{ item.path }}"
 
 - name: Ensure shared paths are absent
   file:
     path: "{{ deploy_helper.new_release_path }}/{{ item.path }}"
     state: absent
-  with_items: "{{ project.project_shared_children | default(project_shared_children) }}"
+  loop: "{{ project.project_shared_children | default(project_shared_children) }}"
+  loop_control:
+    label: "{{ item.path }}"
 
 - name: Create shared symlinks
   file:
     path: "{{ deploy_helper.new_release_path }}/{{ item.path }}"
     src: "{{ deploy_helper.shared_path }}/{{ item.src }}"
     state: link
-  with_items: "{{ project.project_shared_children | default(project_shared_children) }}"
+  loop: "{{ project.project_shared_children | default(project_shared_children) }}"
+  loop_control:
+    label: "{{ item.path }}"
 
 - name: Check if deploy_share_after scripts exist
   stat:
     path: "{{ item }}"
   delegate_to: localhost
   register: deploy_share_after_paths
-  with_items: "{{ deploy_share_after | default([]) }}"
+  loop: "{{ deploy_share_after | default([]) }}"
 
 - include_tasks: "{{ include_path.item }}"
-  with_items: "{{ deploy_share_after_paths.results }}"
+  loop: "{{ deploy_share_after_paths.results }}"
   loop_control:
     loop_var: include_path
+    label: "{{ include_path.item }}"
   when: include_path.stat.exists
   tags: deploy-share-after
diff --git a/roles/deploy/tasks/update.yml b/roles/deploy/tasks/update.yml
index 17250a0493..36e97346aa 100644
--- a/roles/deploy/tasks/update.yml
+++ b/roles/deploy/tasks/update.yml
@@ -4,10 +4,10 @@
     path: "{{ item }}"
   delegate_to: localhost
   register: deploy_update_before_paths
-  with_items: "{{ deploy_update_before | default([]) }}"
+  loop: "{{ deploy_update_before | default([]) }}"
 
 - include_tasks: "{{ include_path.item }}"
-  with_items: "{{ deploy_update_before_paths.results }}"
+  loop: "{{ deploy_update_before_paths.results }}"
   loop_control:
     loop_var: include_path
   when: include_path.stat.exists
@@ -19,7 +19,9 @@
     key: "{{ item.key | default(omit) }}"
     path: "{{ item.path | default(omit) }}"
     state: "{{ item.state | default('present') }}"
-  with_items: "{{ known_hosts | default([]) }}"
+  loop: "{{ known_hosts | default([]) }}"
+  loop_control:
+    label: "{{ item.name }}"
 
 - name: Clone project files
   git:
@@ -56,10 +58,10 @@
     path: "{{ item }}"
   delegate_to: localhost
   register: deploy_update_after_paths
-  with_items: "{{ deploy_update_after | default([]) }}"
+  loop: "{{ deploy_update_after | default([]) }}"
 
 - include_tasks: "{{ include_path.item }}"
-  with_items: "{{ deploy_update_after_paths.results }}"
+  loop: "{{ deploy_update_after_paths.results }}"
   loop_control:
     loop_var: include_path
   when: include_path.stat.exists
diff --git a/roles/fail2ban/tasks/main.yml b/roles/fail2ban/tasks/main.yml
index 8e1bf7ecba..e11453c8f4 100644
--- a/roles/fail2ban/tasks/main.yml
+++ b/roles/fail2ban/tasks/main.yml
@@ -12,7 +12,7 @@
     src: "{{ item }}.j2"
     dest: /etc/fail2ban/{{ item }}
     mode: '0644'
-  with_items:
+  loop:
     - jail.local
     - fail2ban.local
   notify:
@@ -47,7 +47,7 @@
     src: "{{ item }}"
     dest: "/etc/fail2ban/filter.d/{{ item | basename | regex_replace('.j2$', '') }}"
     mode: '0644'
-  with_items: "{{ fail2ban_filter_templates.files | map(attribute='path') | list | sort(True) }}"
+  loop: "{{ fail2ban_filter_templates.files | map(attribute='path') | list | sort(True) }}"
   notify: restart fail2ban
 
 - name: ensure fail2ban starts on a fresh reboot
diff --git a/roles/ferm/handlers/main.yml b/roles/ferm/handlers/main.yml
index 2af34d8500..c18fe1719c 100644
--- a/roles/ferm/handlers/main.yml
+++ b/roles/ferm/handlers/main.yml
@@ -1,4 +1,6 @@
 ---
 - name: restart ferm
-  service: name=ferm state=restarted
+  service:
+    name: ferm
+    state: restarted
   when: ferm_enabled | bool
diff --git a/roles/ferm/tasks/main.yml b/roles/ferm/tasks/main.yml
index 2848cb488a..ae147a5554 100644
--- a/roles/ferm/tasks/main.yml
+++ b/roles/ferm/tasks/main.yml
@@ -20,7 +20,7 @@
     path: "{{ item }}"
     state: directory
     mode: '0750'
-  with_items:
+  loop:
     - /etc/ferm/ferm.d
     - /etc/ferm/filter-input.d
 
@@ -29,7 +29,7 @@
     src: "{{ item }}.j2"
     dest: /{{ item }}
     mode: '0644'
-  with_items:
+  loop:
     - etc/default/ferm
     - etc/ferm/ferm.conf
   notify:
@@ -42,10 +42,7 @@
         {% else %}
         path=/etc/ferm/filter-input.d/{{ item.weight | default('50') }}_{{ item.type }}_{{ item.dport[0] }}.conf
         {% endif %}
-  with_flattened:
-    - "{{ ferm_input_list }}"
-    - "{{ ferm_input_group_list }}"
-    - "{{ ferm_input_host_list }}"
+  loop: "{{ ferm_input_list + ferm_input_group_list + ferm_input_host_list | flatten}}"
   when: ((item.type is defined and item.type) and (item.dport is defined and item.dport)) and
         (item.delete is defined and item.delete)
 
@@ -57,10 +54,7 @@
             dest=/etc/ferm/filter-input.d/{{ item.weight | default('50') }}_{{ item.type }}_{{ item.dport[0] }}.conf
             {% endif %}
             mode=0644
-  with_flattened:
-    - "{{ ferm_input_list }}"
-    - "{{ ferm_input_group_list }}"
-    - "{{ ferm_input_host_list }}"
+  loop: "{{ ferm_input_list + ferm_input_group_list + ferm_input_host_list | flatten}}"
   when: (item.type is defined and item.type and item.dport is defined and item.dport) and
         (item.delete is undefined or (item.delete is defined and not item.delete))
 
diff --git a/roles/letsencrypt/tasks/certificates.yml b/roles/letsencrypt/tasks/certificates.yml
index 110af4219e..eb330a3fa3 100644
--- a/roles/letsencrypt/tasks/certificates.yml
+++ b/roles/letsencrypt/tasks/certificates.yml
@@ -4,14 +4,18 @@
   args:
     creates: "{{ letsencrypt_keys_dir }}/{{ item.key }}.key"
   when: site_uses_letsencrypt
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
 
 - name: Ensure correct permissions on private keys
   file:
     path: "{{ letsencrypt_keys_dir }}/{{ item.key }}.key"
     mode: '0600'
   when: site_uses_letsencrypt
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
 
 - name: Generate Lets Encrypt certificate IDs
   shell: |
@@ -24,7 +28,9 @@
   register: generate_cert_ids
   changed_when: false
   when: site_uses_letsencrypt
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
   tags: [wordpress, wordpress-setup, wordpress-setup-nginx, nginx-includes]
 
 - name: Generate CSRs
@@ -33,7 +39,9 @@
     executable: /bin/bash
     creates: "{{ acme_tiny_data_directory }}/csrs/{{ item.key }}-{{ letsencrypt_cert_ids[item.key] }}.csr"
   when: site_uses_letsencrypt
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
 
 - name: Generate certificate renewal script
   template:
diff --git a/roles/letsencrypt/tasks/nginx.yml b/roles/letsencrypt/tasks/nginx.yml
index 877ed09c92..229f6ff4b2 100644
--- a/roles/letsencrypt/tasks/nginx.yml
+++ b/roles/letsencrypt/tasks/nginx.yml
@@ -12,7 +12,9 @@
   register: current_hosts
   changed_when: false
   when: site_uses_letsencrypt
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
 
 - name: Create needed Nginx confs for challenges
   template:
@@ -23,7 +25,9 @@
   when:
     - site_uses_letsencrypt
     - missing_hosts | count
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
 
 - name: Enable Nginx sites
   file:
@@ -34,7 +38,9 @@
   when:
     - site_uses_letsencrypt
     - missing_hosts | count
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
   notify: disable temporary challenge sites
 
 - import_tasks: "{{ playbook_dir }}/roles/common/tasks/reload_nginx.yml"
@@ -52,7 +58,9 @@
   register: letsencrypt_test_challenges
   ignore_errors: true
   when: site_uses_letsencrypt
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
 
 - name: Notify of challenge failures
   fail:
@@ -63,4 +71,4 @@
       If you don't want these domains in your SSL certificate, then remove them from `site_hosts`.
       See https://roots.io/trellis/docs/ssl for more details.
   when: item is not skipped and item is failed
-  with_items: "{{ letsencrypt_test_challenges.results }}"
+  loop: "{{ letsencrypt_test_challenges.results }}"
diff --git a/roles/letsencrypt/tasks/setup.yml b/roles/letsencrypt/tasks/setup.yml
index c23ba5918d..72664d0f42 100644
--- a/roles/letsencrypt/tasks/setup.yml
+++ b/roles/letsencrypt/tasks/setup.yml
@@ -26,7 +26,7 @@
     mode: "{{ item.mode | default(omit) }}"
     path: "{{ item.path }}"
     state: directory
-  with_items:
+  loop:
     - path: "{{ acme_tiny_data_directory }}"
       mode: '0700'
     - path: "{{ acme_tiny_data_directory }}/csrs"
@@ -34,6 +34,8 @@
     - path: "{{ acme_tiny_challenges_directory }}"
     - path: "{{ letsencrypt_certs_dir }}"
       mode: '0700'
+  loop_control:
+    label: "{{ item.path }}"
 
 - name: Clone acme-tiny repository
   git:
diff --git a/roles/mariadb/tasks/main.yml b/roles/mariadb/tasks/main.yml
index 0da81f6f95..08a0d2a611 100644
--- a/roles/mariadb/tasks/main.yml
+++ b/roles/mariadb/tasks/main.yml
@@ -49,7 +49,7 @@
       check_implicit_admin: yes
       state: present
     no_log: true
-    with_items:
+    loop:
       - "{{ inventory_hostname }}"
       - 127.0.0.1
       - ::1
@@ -61,7 +61,7 @@
       host: "{{ item }}"
       state: absent
     no_log: true
-    with_items:
+    loop:
       - localhost
       - "{{ inventory_hostname }}"
       - "{{ ansible_hostname }}"
diff --git a/roles/memcached/tasks/main.yml b/roles/memcached/tasks/main.yml
index 04bec4ffb4..c638f2cb85 100644
--- a/roles/memcached/tasks/main.yml
+++ b/roles/memcached/tasks/main.yml
@@ -4,7 +4,9 @@
     name: "{{ item.key }}"
     state: "{{ item.value }}"
     cache_valid_time: "{{ apt_cache_valid_time }}"
-  with_dict: "{{ memcached_packages }}"
+  loop: "{{ memcached_packages |dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
 
 - name: Copy the client configuration file
   template:
diff --git a/roles/nginx/tasks/main.yml b/roles/nginx/tasks/main.yml
index 676679ce1b..c0748a2117 100644
--- a/roles/nginx/tasks/main.yml
+++ b/roles/nginx/tasks/main.yml
@@ -20,7 +20,7 @@
     path: "{{ nginx_path }}/{{ item }}"
     state: directory
     mode: '0755'
-  with_items:
+  loop:
     - sites-available
     - sites-enabled
 
diff --git a/roles/php/tasks/main.yml b/roles/php/tasks/main.yml
index 3a8c6d9f10..e5fce88125 100644
--- a/roles/php/tasks/main.yml
+++ b/roles/php/tasks/main.yml
@@ -10,13 +10,15 @@
     state: "{{ item.value }}"
     cache_valid_time: "{{ apt_cache_valid_time }}"
     install_recommends: no
-  with_dict: "{{ php_extensions }}"
+  loop: "{{ php_extensions | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
 
 - name: Ensure correct PHP version selected
   community.general.alternatives:
     name: php
     path: /usr/bin/php{{ php_version }}
-    
+
 - name: Find existing php fpm services
   find:
     paths: /etc/init.d
diff --git a/roles/sshd/tasks/main.yml b/roles/sshd/tasks/main.yml
index 152b4f7fd3..4dc76960e5 100644
--- a/roles/sshd/tasks/main.yml
+++ b/roles/sshd/tasks/main.yml
@@ -4,7 +4,9 @@
     name: "{{ item.key }}"
     state: "{{ item.value }}"
     cache_valid_time: "{{ apt_cache_valid_time }}"
-  with_dict: "{{ sshd_packages }}"
+  loop: "{{ sshd_packages | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
   notify: restart ssh
 
 - name: Create a secure sshd_config
diff --git a/roles/users/tasks/main.yml b/roles/users/tasks/main.yml
index 09b84830df..fb65473803 100644
--- a/roles/users/tasks/main.yml
+++ b/roles/users/tasks/main.yml
@@ -3,7 +3,7 @@
   group:
     name: "{{ item }}"
     state: present
-  with_items: "{{ users | sum(attribute='groups', start=[]) | list | unique }}"
+  loop: "{{ users | sum(attribute='groups', start=[]) | list | unique }}"
 
 - name: Ensure sudo group has sudo privileges
   lineinfile:
@@ -37,7 +37,9 @@
     state: present
     shell: /bin/bash
     update_password: "{{ item.update_password | default('always') }}"
-  with_items: "{{ users }}"
+  loop: "{{ users }}"
+  loop_control:
+    label: "{{ item.name }}"
 
 - name: Add web user sudoers items for services
   template:
@@ -53,9 +55,9 @@
   authorized_key:
     user: "{{ item.0.name }}"
     key: "{{ item.1 }}"
-  with_subelements:
-    - "{{ users | default([]) }}"
-    - keys
+  loop: "{{ users | default([]) | subelements('keys') }}"
+  loop_control:
+    label: "{{ item.0.name }}"
 
 - name: Add deploy SSH keys
   authorized_key:
diff --git a/roles/wordpress-install/tasks/directories.yml b/roles/wordpress-install/tasks/directories.yml
index 591255688b..7b3c0c44bd 100644
--- a/roles/wordpress-install/tasks/directories.yml
+++ b/roles/wordpress-install/tasks/directories.yml
@@ -6,7 +6,9 @@
     group: "{{ web_group }}"
     mode: '0755'
     state: directory
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
 
 - name: Create shared folder of sites
   file:
@@ -15,7 +17,9 @@
     group: "{{ web_group }}"
     mode: '0755'
     state: directory
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
 
 - name: Change site owner to user
   file:
@@ -24,4 +28,6 @@
     group: "{{ web_group }}"
     state: directory
     recurse: yes
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
diff --git a/roles/wordpress-install/tasks/dotenv.yml b/roles/wordpress-install/tasks/dotenv.yml
index 5397096992..af744be89d 100644
--- a/roles/wordpress-install/tasks/dotenv.yml
+++ b/roles/wordpress-install/tasks/dotenv.yml
@@ -6,12 +6,16 @@
     mode: '0644'
     owner: "{{ web_user }}"
     group: "{{ web_group }}"
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
 
 - name: Copy .env file into web root
   synchronize:
     src: "/tmp/{{ item.key }}.env"
     dest: "{{ www_root }}/{{ item.key }}/{{ item.value.current_path | default('current') }}/.env"
     checksum: true
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
   delegate_to: "{{ inventory_hostname }}"
diff --git a/roles/wordpress-install/tasks/main.yml b/roles/wordpress-install/tasks/main.yml
index 25bb07f0ce..aa1037d8a0 100644
--- a/roles/wordpress-install/tasks/main.yml
+++ b/roles/wordpress-install/tasks/main.yml
@@ -12,14 +12,18 @@
     path: "{{ item.path | default(omit) }}"
     state: "{{ item.state | default('present') }}"
   become: no
-  with_items: "{{ known_hosts | default([]) }}"
+  loop: "{{ known_hosts | default([]) }}"
+  loop_control:
+    label: "{{ item.name }}"
 
 - include_tasks: tasks/composer-authentications.yml
   vars:
     site: "{{ item.key }}"
     working_dir: "{{ www_root }}/{{ item.key }}/{{ item.value.current_path | default('current') }}/"
   no_log: true
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
 
 - name: Install Dependencies with Composer
   composer:
@@ -27,7 +31,9 @@
     optimize_autoloader: no
     working_dir: "{{ www_root }}/{{ item.key }}/{{ item.value.current_path | default('current') }}/"
   become: no
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
 
 - name: Install WP
   command: wp core {{ item.value.multisite.enabled | default(false) | ternary('multisite-install', 'install') }}
@@ -46,7 +52,9 @@
   args:
     chdir: "{{ www_root }}/{{ item.key }}/{{ item.value.current_path | default('current') }}/"
   register: wp_install
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
   when: item.value.site_install | default(true)
   changed_when: "'WordPress is already installed.' not in wp_install.stdout and 'The network already exists.' not in wp_install.stdout"
 
@@ -54,12 +62,14 @@
   command: wp rewrite structure {{ item.item.value.initial_permalink_structure | default("/%postname%/") }} --allow-root
   args:
     chdir: "{{ www_root }}/{{ item.item.key }}/{{ item.item.value.current_path | default('current') }}/"
-  with_items: "{{ wp_install.results }}"
+  loop: "{{ wp_install.results }}"
   when: item is changed
 
 - name: Update WP Multisite Home URL
   command: wp option update home {{ site_env.wp_home }} --allow-root
   args:
     chdir: "{{ www_root }}/{{ item.key }}/{{ item.value.current_path | default('current') }}/"
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
   when: item.value.site_install | default(true) and item.value.multisite.enabled | default(false)
diff --git a/roles/wordpress-setup/tasks/database.yml b/roles/wordpress-setup/tasks/database.yml
index ad10a40026..4fed3d97c1 100644
--- a/roles/wordpress-setup/tasks/database.yml
+++ b/roles/wordpress-setup/tasks/database.yml
@@ -8,7 +8,9 @@
       login_user: "{{ mysql_root_user }}"
       login_password: "{{ mysql_root_password }}"
     no_log: true
-    with_dict: "{{ wordpress_sites }}"
+    loop: "{{ wordpress_sites | dict2items }}"
+    loop_control:
+      label: "{{ item.key }}"
 
   - name: Create/assign database user to db and grant permissions
     mysql_user:
@@ -22,6 +24,8 @@
       login_user: "{{ mysql_root_user }}"
       login_password: "{{ mysql_root_password }}"
     no_log: true
-    with_dict: "{{ wordpress_sites }}"
+    loop: "{{ wordpress_sites | dict2items }}"
+    loop_control:
+      label: "{{ item.key }}"
 
   when: site_uses_local_db and item.value.db_create | default(true)
diff --git a/roles/wordpress-setup/tasks/main.yml b/roles/wordpress-setup/tasks/main.yml
index ac1fd8a735..685a6b184e 100644
--- a/roles/wordpress-setup/tasks/main.yml
+++ b/roles/wordpress-setup/tasks/main.yml
@@ -21,7 +21,9 @@
     group: "{{ web_group }}"
     mode: '0755'
     state: directory
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
 
 - name: Create WordPress php-fpm configuration file
   template:
@@ -51,7 +53,9 @@
     job: "cd {{ www_root }}/{{ item.key }}/{{ item.value.current_path | default('current') }} && wp cron event run --due-now > /dev/null 2>&1"
     cron_file: "wordpress-{{ item.key | replace('.', '_') }}"
     state: "{{ (cron_enabled and not item.value.multisite.enabled) | ternary('present', 'absent') }}"
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
 
 - name: Setup WP Multisite system cron
   cron:
@@ -61,4 +65,6 @@
     job: "cd {{ www_root }}/{{ item.key }}/{{ item.value.current_path | default('current') }} && wp site list --field=url | xargs -n1 -I \\% wp --url=\\% cron event run --due-now > /dev/null 2>&1"
     cron_file: "wordpress-multisite-{{ item.key | replace('.', '_') }}"
     state: "{{ (cron_enabled and item.value.multisite.enabled) | ternary('present', 'absent') }}"
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
diff --git a/roles/wordpress-setup/tasks/nginx-client-cert.yml b/roles/wordpress-setup/tasks/nginx-client-cert.yml
index 69f7026a22..7e11e90de8 100644
--- a/roles/wordpress-setup/tasks/nginx-client-cert.yml
+++ b/roles/wordpress-setup/tasks/nginx-client-cert.yml
@@ -4,5 +4,7 @@
     url: "{{ item.value.ssl.client_cert_url }}"
     dest: "{{ nginx_ssl_path }}/client-{{ (item.value.ssl.client_cert_url | hash('md5'))[:7] }}.crt"
     mode: '0640'
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
   when: ssl_enabled and item.value.ssl.client_cert_url is defined
diff --git a/roles/wordpress-setup/tasks/nginx-includes.yml b/roles/wordpress-setup/tasks/nginx-includes.yml
index aebc5ae644..265011cea0 100644
--- a/roles/wordpress-setup/tasks/nginx-includes.yml
+++ b/roles/wordpress-setup/tasks/nginx-includes.yml
@@ -21,7 +21,7 @@
       state: directory
       recurse: yes
       mode: '0755'
-    with_items: "{{ nginx_includes_templates.files | map(attribute='path') |
+    loop: "{{ nginx_includes_templates.files | map(attribute='path') |
                     map('regex_replace', nginx_includes_pattern, '\\2') |
                     map('dirname') | unique | list | sort
                  }}"
@@ -32,7 +32,7 @@
       src: "{{ item }}"
       dest: "{{ nginx_path }}/includes.d/{{ item | regex_replace(nginx_includes_pattern, '\\2') }}"
       mode: '0644'
-    with_items: "{{ nginx_includes_templates.files | map(attribute='path') | list | sort(True) }}"
+    loop: "{{ nginx_includes_templates.files | map(attribute='path') | list | sort(True) }}"
     notify: reload nginx
   when: nginx_includes_local_directory.stat.isdir is defined
 
@@ -54,7 +54,7 @@
       file:
         path: "{{ item }}"
         state: absent
-      with_items: "{{ nginx_includes_existing.files | default({}) | map(attribute='path') |
+      loop: "{{ nginx_includes_existing.files | default({}) | map(attribute='path') |
                       difference(nginx_includes_templates.files | default({} )| map(attribute='path') |
                         map('regex_replace', nginx_includes_pattern, nginx_path + '/includes.d/\\2') | unique
                       ) | list
diff --git a/roles/wordpress-setup/tasks/nginx.yml b/roles/wordpress-setup/tasks/nginx.yml
index c16108f02c..9f81d32c23 100644
--- a/roles/wordpress-setup/tasks/nginx.yml
+++ b/roles/wordpress-setup/tasks/nginx.yml
@@ -4,7 +4,9 @@
     src: "{{ item.value.ssl.cert }}"
     dest: "{{ nginx_ssl_path }}/{{ item.value.ssl.cert | basename }}"
     mode: '0640'
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
   when: ssl_enabled and item.value.ssl.cert is defined
   notify: reload nginx
 
@@ -13,7 +15,9 @@
     src: "{{ item.value.ssl.key }}"
     dest: "{{ nginx_ssl_path }}/{{ item.value.ssl.key | basename }}"
     mode: '0600'
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
   when: ssl_enabled and item.value.ssl.key is defined
   notify: reload nginx
 
@@ -24,7 +28,7 @@
     src: "{{ item.src }}"
     dest: "{{ nginx_path }}/sites-available/{{ item.src | basename | regex_replace('.j2$', '') }}"
     mode: '0644'
-  with_items: "{{ nginx_sites_confs }}"
+  loop: "{{ nginx_sites_confs }}"
   when: item.enabled | default(true)
   notify: reload nginx
   tags: nginx-sites
@@ -34,7 +38,7 @@
     path: "{{ nginx_path }}/sites-enabled/{{ item.src | basename | regex_replace('.j2$', '') }}"
     state: absent
   when: not(item.enabled | default(true))
-  with_items: "{{ nginx_sites_confs }}"
+  loop: "{{ nginx_sites_confs }}"
   notify: reload nginx
   tags: nginx-sites
 
@@ -45,7 +49,7 @@
     state: link
     force: yes
   when: item.enabled | default(true)
-  with_items: "{{ nginx_sites_confs }}"
+  loop: "{{ nginx_sites_confs }}"
   notify: reload nginx
   tags: nginx-sites
 
@@ -61,7 +65,9 @@
     src: "{{ item.value.nginx_wordpress_site_conf | default(nginx_wordpress_site_conf) }}"
     dest: "{{ nginx_path }}/sites-available/{{ item.key }}.conf"
     mode: '0644'
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
   notify: reload nginx
   tags: nginx-includes
 
@@ -72,5 +78,7 @@
     owner: root
     group: root
     state: link
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
   notify: reload nginx
diff --git a/roles/wordpress-setup/tasks/self-signed-certificate.yml b/roles/wordpress-setup/tasks/self-signed-certificate.yml
index eef2b29775..7b1fe2dd55 100644
--- a/roles/wordpress-setup/tasks/self-signed-certificate.yml
+++ b/roles/wordpress-setup/tasks/self-signed-certificate.yml
@@ -10,7 +10,9 @@
     src: self-signed-openssl-config.j2
     dest: "{{ nginx_ssl_path }}/self-signed-openssl-configs/{{ item.key }}.cnf"
     mode: '0644'
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
   when:
     - sites_use_ssl | bool
     - ssl_enabled | bool
@@ -24,7 +26,9 @@
   args:
     chdir: "{{ nginx_ssl_path }}"
     creates: "{{ item.key }}.*"
-  with_dict: "{{ wordpress_sites }}"
+  loop: "{{ wordpress_sites | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
   when:
     - sites_use_ssl | bool
     - ssl_enabled | bool
diff --git a/roles/wp-cli/tasks/main.yml b/roles/wp-cli/tasks/main.yml
index dab02c6ea8..e7c064b364 100644
--- a/roles/wp-cli/tasks/main.yml
+++ b/roles/wp-cli/tasks/main.yml
@@ -31,7 +31,7 @@
       file:
         path: "{{ item }}"
         state: absent
-      with_items:
+      loop:
         - "/tmp/wp-cli-{{ wp_cli_version }}.phar"
         - "/tmp/wp-cli-{{ wp_cli_version }}.phar.asc"
     - name: Fail verification
@@ -66,4 +66,4 @@
   changed_when:
     - "'Nothing to install or update' not in wp_cli_packages_installed.stdout"
     - "'Package operations: 0 installs, 0 updates, 0 removals' not in wp_cli_packages_installed.stdout"
-  with_items: "{{ wp_cli_packages }}"
+  loop: "{{ wp_cli_packages }}"