The open-source WordPress fleet manager you can run, read, and contribute to
WPMgr is a self-hostable control plane for managing one WordPress site or a whole portfolio. Back up, restore, update, monitor uptime, optimize images with the Media Optimizer, clean the database, and lock down every site from a single dashboard, all on infrastructure you own, built from code you can read and improve.
Real-time fleet at a glance
Live status, uptime signals, and active incidents for every site in the fleet.
Lighter images, no quality loss, fully reversible
Turn on Media Optimization and WPMgr re-encodes your library to AVIF and WebP in the cloud. Every browser gets the format it supports, your originals stay safely archived on the site, and you can revert any image with one click.
How Media Optimization works, end to end
Four steps, every one of them reversible. Auto-optimize runs on upload without slowing the editor.
Upload or pick
Flip on auto-optimize and every new upload gets queued the moment WordPress finishes generating its sizes. Already have a full library? Select existing images and send them in batches. No reformatting your workflow.
We re-encode safely
A dedicated cloud encoder reads each image by its real bytes, not a guessed file extension, and re-encodes the full image plus every thumbnail to AVIF or WebP. Animated GIFs become animated WebP. Your originals are renamed and archived on the site, never deleted.
Browsers get the modern format
A small .htaccess rule checks what each visitor's browser actually supports and serves the modern format only when it will display, falling back to the original everywhere else. Pages get lighter with no broken images and no front-end plugin bloat.
Revert anytime
Changed your mind, or a single image looks off? Restore puts every archived original back, full image and all thumbnails, and rewrites the URLs in your content. Nothing about optimization is a one-way door.
What you get on day one
Concrete capabilities, not a roadmap.
Everything you need to run a fleet, all in the open release
One dashboard, no add-on sprawl. Five capability areas, every line of code open to read and extend.
Operate
Connect a site in under a minute, then run the whole fleet from one screen.
Fleet connection
Sites enroll with a one-time code and stay verifiably connected.
- Live flip from Awaiting to Connected, no refresh
- One-click wp-admin login, no shared passwords
- Sweeper verifies quiet sites directly, not just heartbeats
- Accurate badge: unreachable vs idle, never a false disconnect
Backups and restore
Scheduled full and incremental backups with point-in-time restore.
- Increments pack only files that changed
- Base plus increments in one expandable chain
- Restore to any snapshot, site stays online
- Fleet backup browser: protected, stale, or unprotected per site
Fleet updates
Preview version changes, then update with an automatic safety net.
- Snapshot first, auto-revert on failed health check
- Bulk runs by group or tag
- Live per-site progress
Monitoring and health
Uptime, response time, and fleet-wide status at a glance.
- Fleet status matrix: up, degraded, or down across all sites
- 7, 30, and 90 day response-time trends per site
- Down and recovery alerts by email or webhook
- TLS expiry warnings and PHP fatal tracking
Sites grid and screenshots
A list or grid view of the fleet, each card led by a live screenshot of the site.
- Screenshot captured server-side, refreshed weekly and on demand
- Capability icons: cache, object cache, HTTPS, backups, multisite
- Uptime, latency, SSL expiry, and backup health on the card
- Status and tags filters compose and persist in the URL
Accelerate
Make every page faster, then prove it with real-visitor data.
Performance and caching
Full-page caching and asset optimization, per site or fleet-wide.
- Pre-gzipped pages served straight from disk
- Unused CSS removal, minify, defer, lazy-load
- WOFF2 font transcoding and subsetting
- WooCommerce cart-session caching
Real User Monitoring
Core Web Vitals from real visitors at the p75 Google uses.
- LCP, INP, CLS, FCP, TTFB distributions
- 28-day trends with threshold lines drawn on
- Per-URL and per-device breakdowns
- Anonymous, off by default, no cookies
Media Optimizer
Re-encode the media library to AVIF and WebP, fully reversible.
- Originals archived on the site
- Right format per browser, automatic fallback
- No image bytes touch the control plane
Redis Object Cache
Per-site persistent object cache that accelerates logged-in users, admin, and every uncacheable database round-trip.
- phpredis connection, TLS, ACL, and per-site key prefix
- Degrades safely to in-memory cache if Redis is unreachable
- Hit ratio, memory, and latency history in the dashboard
- Debug header verifies cache state per request
Clean up
Database and media hygiene that previews first and reverses cleanly.
Database Cleaner
Scan first, then clean revisions, transients, and orphans in batches.
- Per-table inventory with owner labels
- Orphans classified against a signature corpus
- 90-day health trend and a fleet-wide view
Database Snapshots
A quick local snapshot before a risky change, instant revert after.
- Faster and lighter than a full backup
- No remote storage required
Search and Replace
Serialization-safe find and replace across the whole database.
- PHP-serialized data survives intact
- Preview matches before committing
Unused Image Cleaner
Finds media nothing references, with proof of where used images appear.
- Reversible quarantine before any delete
- Ambiguous references count as in-use
- Per-image usage report
Serve clients
Group sites by customer and put your brand on everything they see.
Client management
Group any number of sites under named client records.
- Brand color, logo, contacts, and notes
- Bulk-assign sites from the fleet view
- Filter the fleet or jump to a client page
White-label reports
Branded maintenance reports on a schedule or on demand.
- Uptime, backups, updates, vitals, email health
- HTML email, print page, and vector-chart PDF
- Per-section toggles, custom intro and closing
- Powered-by footer removable on any plan
Client portal
A read-only branded portal where clients see their own sites.
- Email invites on the same login page
- Uptime, backups, vitals, report downloads
- Access revoked instantly on removal
Per-site email and log
Per-site outgoing email with a central, searchable delivery log.
- SES, SendGrid, Mailgun, Postmark, any SMTP
- Named connections with automatic failover
- Webhook bounce and complaint suppression
- Fleet-wide deliverability view and digests
Protect
Hardening, access control, and account flows that cannot lock you out.
Hardening, bans, integrity
Per-site hardening, bans, file integrity, vulnerability scanning, user 2FA, and password policy, all opt-in.
- Disable file editor, restrict XML-RPC, REST API, and login IDs
- File hashes vs WordPress.org and baseline; vuln scan vs CVEs
- Site-user 2FA: authenticator app, email code, backup codes
- Password policy: strength, breach check, reuse, expiry
Team and access
Four roles, per-site sharing, SSO, and a tamper-evident audit log.
- Owner to viewer, least privilege by default
- Share one site without exposing the fleet
- Email sign-in or company OIDC
Email in minutes
Point the control plane at your own SMTP server in Settings.
- Send a test message before saving
- Credentials encrypted at rest
- All transactional mail routes through it
Account recovery
Self-serve password reset and change, no support ticket.
- Works from any device, no admin involved
- A change signs out every other session
Open sign up
Email-verified self-registration with a configurable gate.
- Verification link before any access
- No manual provisioning
- Lock it down when onboarding is done
Dashboard two-factor auth
Protect dashboard access with an authenticator app or a passkey.
- TOTP and WebAuthn passkeys, set up in a guided wizard
- Remember a device for 30 days, revoke any device instantly
- Recovery codes for lost-device access, single-use and hashed
- Secret encrypted at rest, all events in the audit log
From zero to managed in under a minute
No SSH, no FTP, no shared admin passwords. Three steps and the site is live on your dashboard.
Add the site by URL
Paste a site URL into the dashboard. WPMgr generates a one-time enrollment code and marks the site as Awaiting connection.
Push the one-time code
Install the MIT-licensed agent plugin and paste the one-time code. The agent registers its signing key and the site flips from Awaiting to Connected with no page refresh.
Manage everything
Back up, update, monitor uptime, optimize images, and lock the site down, all from the single dashboard. Disconnect cleanly anytime, and reconnecting later keeps the full history.
Questions, answered straight
The things people ask before they self-host or contribute.
Self-host it, contribute to it, or just use it. Your call.
Bring up the full stack with a few commands, enroll your first site with a one-time code, and run your whole fleet from a dashboard that lives on infrastructure you control. Or fork it and build what you need.
Free, open source, no per-site fee. Read every line before you run it.