wpmgr
Hosting integrations

Managed WordPress tooling for hosting providers

Offer your customers a self-service WordPress management layer without building it from scratch. Open-source, AGPL-licensed, and designed to run on the infrastructure you already operate.

Explore the codeSee all features

A managed-WordPress layer without the engineering cost

Hosting providers that want to offer value-added WordPress management typically face a choice: build a proprietary tooling layer from scratch, or bundle a third-party SaaS product whose pricing and roadmap you do not control. WPMgr is a third option: a fully open-source, self-hostable control plane you can fork, embed, and brand. The agent is MIT-licensed and Ed25519-signed so your customers can audit every message it sends. Security hardening, uptime monitoring, and team access control are ready to ship on day one. You bring the infrastructure; WPMgr brings the tooling.

The features that prove it

Everything listed below ships in the free, open-source release with no add-on required.

Team and access control

Four permission roles, per-site sharing, OIDC SSO, and a tamper-evident audit log so your support team can operate safely.

See the feature

Security hardening suite

Hardening rules, file integrity monitoring, vulnerability scanning powered by Wordfence Intelligence, and IP ban lists across the fleet.

See the feature

Uptime and health monitoring

Per-site uptime checks, TLS expiry alerts, and a fleet status matrix that gives your support team an instant overview.

See the feature
MITAgent license: permissive, auditable, forkable
Ed25519Every agent message is cryptographically signed
AGPLFull source control plane available to read and fork
FAQ

Common questions

Specific questions about this use case.

Can I white-label the dashboard for my customers?

WPMgr is fully open-source under the AGPL, so you can fork and rebrand the control plane. White-label maintenance reports with your logo are available in the current release for agency and client-facing deployments.

How does the agent communicate with the control plane?

The MIT-licensed WordPress agent communicates over HTTPS using Ed25519-signed messages. Every command the control plane sends is signed with a key the site owner can verify, so your customers can confirm that nothing happens to their site you cannot account for.

What does the security suite cover?

The security suite includes hardening rule application, file integrity monitoring with baseline comparison, IP ban lists fed from the Wordfence Intelligence feed, and ongoing vulnerability scanning for installed plugins and themes. All of this runs via the agent on the customer's own server.

Is there an API for provisioning sites programmatically?

Yes. The WPMgr control plane exposes a full REST API documented at manage.wpmgr.app/docs. You can add sites, trigger backups, run update jobs, and retrieve health data programmatically from your own automation layer.

Run your whole fleet from one dashboard.

Free and open source. No per-site fee. The full release is on GitHub.

Get started for free