WordPress security for your whole fleet
Harden every site in your fleet, scan for known vulnerabilities, enforce two-factor authentication for site users, and maintain a tamper-evident audit trail, all from one self-hosted dashboard with no per-site security plugin sprawl.
Security that covers every site, not just the ones you remember
WordPress security problems compound quickly when you manage more than a handful of sites. A single outdated plugin with a known CVE, one site user without two-factor authentication, or a file that changed without an audit trail is enough to cause an incident that takes days to recover from. WPMgr approaches security at the fleet level: hardening rules applied consistently, vulnerability data pulled from Wordfence Intelligence refreshed daily, file integrity checked against a verified baseline, and 2FA enforced per role across all site users. The audit log is hash-chained so any tampering is immediately detectable. You close the gaps before an attacker finds them.
The features that prove it
Everything listed below ships in the free, open-source release with no add-on required.
Common questions
Specific questions about this use case.
Where does the vulnerability data come from?
WPMgr pulls from the Wordfence Intelligence vulnerability feed, a publicly available database of known WordPress plugin and theme CVEs. The feed is refreshed daily and matched against installed plugins and themes on every site in your fleet.
Will enforcing 2FA lock out an administrator?
No. WPMgr's 2FA enforcement is designed with lockout prevention as a hard invariant. The autologin path used by the agent always bypasses the 2FA challenge. Administrators always have access to backup codes, and a wp-config.php escape hatch is documented for recovery if every other method is unavailable.
What does file integrity monitoring check?
WPMgr establishes a cryptographic baseline of your WordPress core files, active theme, and active plugins. Subsequent scans compare the live filesystem against this baseline and report any additions, deletions, or modifications that did not come from a managed update.
Can I see all security events across my fleet in one place?
Yes. The activity log and audit trail in the dashboard aggregates security events from every connected site. The log is hash-chained, meaning each entry cryptographically references the previous one, so any deletion or modification of a past entry is immediately detectable.
What hardening rules does WPMgr apply?
Hardening rules include disabling XML-RPC, blocking directory traversal, setting secure file permissions, removing version leakage from headers, and applying site-specific .htaccess or Nginx directives depending on the detected server stack. Rules are applied without overwriting your existing configuration.
Run your whole fleet from one dashboard.
Free and open source. No per-site fee. The full release is on GitHub.