How Secure is MainWP?

Your MainWP Dashboard runs on your own server and signs every request it sends to your child sites.

Your MainWP Dashboard signs every request to a child site with a private key unique to that site. Each request expires after 60 seconds and is accepted once. Third-party API keys are stored encrypted, REST API keys are stored hashed, and the code for both plugins is open source on GitHub.

MainWP is a self-hosted platform for agencies, freelancers and developers who manage many WordPress sites. Your MainWP Dashboard runs on a WordPress site you control and talks directly to the MainWP Child plugin on each of your sites.

Over 20,000 MainWP Dashboards manage over 700,000 child sites, and MainWP has over 2,200 five-star reviews on WordPress.org.

How does MainWP connect to a child site securely?

When you add a site, your MainWP Dashboard creates a 2048-bit OpenSSL key pair for that site. The child site keeps the public key, and your Dashboard keeps the private key. Each site gets its own key pair.

Administrator sign-in: you connect with an administrator account on the child site. MainWP uses that password once, to make the connection, and relies on the key pair from then on.
One Dashboard per site: once a child site is connected, MainWP Child accepts requests from that one MainWP Dashboard. Moving a site to another Dashboard starts with a fresh activation of MainWP Child.
Unique Security ID: MainWP Child can require a Unique Security ID, a 12-character code you enter when you add the site, as a second check on top of the administrator sign-in.
Connection window: a newly activated MainWP Child plugin waits 20 minutes for your MainWP Dashboard to connect, then switches itself off until you activate it again.

How does MainWP protect each request to a child site?

Your MainWP Dashboard signs every request to a child site with that site’s private key, using SHA-256 by default. MainWP Child checks the signature against the public key it stored when you connected the site, and runs the request after the signature matches.

60-second requests: each signed request carries a random nonce, a unique request ID and an expiry time 60 seconds ahead.
One use per request: MainWP Child records each request ID and accepts each request once.
HTTPS and certificate checks: your MainWP Dashboard connects to child sites over HTTPS by default and checks each site’s SSL certificate.
Signing options: MainWP signs with OpenSSL and offers phpseclib as an alternative library. You can pick a stronger signature algorithm, such as SHA-384 or SHA-512, for all sites or for specific sites.

Does MainWP send my site data to MainWP’s servers?

Your MainWP Dashboard talks to your child sites directly, so your site data stays between your Dashboard and your sites. The free MainWP Dashboard and MainWP Child plugins collect no usage data. License checks for MainWP Pro add-ons send your Dashboard’s domain and IP address, with no child site information.

Because MainWP is self-hosted, you choose the server, the backups and the access rules for your MainWP Dashboard, the same way you do for any WordPress site you run.

How does MainWP store API keys and passwords?

Your MainWP Dashboard encrypts the secrets it keeps:

Third-party API keys: keys for services such as uptime monitors, backup providers and security tools are encrypted with AES-256-GCM. The encryption keys sit in a protected key folder, separate from the database.
Site private keys: each child site’s private key is encrypted at rest in your Dashboard’s database.
HTTP authentication details: when a child site sits behind HTTP Basic Auth, MainWP stores that username and password encrypted.
REST API keys: MainWP stores a hash of each REST API key secret and checks incoming keys against it.

How secure are the MainWP REST API and AI tools?

Developers and AI assistants reach your MainWP Dashboard through keys and permissions you control.

REST API key permissions: you give each MainWP REST API key its own permissions, Read or Write & Delete, and each key is scoped to MainWP’s own API routes.
Abilities API: MainWP’s Abilities run for administrators on your MainWP Dashboard, signed in with a WordPress Application Password, and respect each user’s MainWP Team Control rights.
Confirmation for destructive actions: Abilities that delete data, such as removing a client, need an explicit confirmation or run as a dry run that previews the result first.
MainWP MCP: when an AI assistant works through MainWP MCP, each destructive action needs a one-time confirmation token tied to the exact operation, valid for 5 minutes. Safe mode keeps the assistant to tools that read data or make non-destructive changes.

MainWP Dashboard form for a new REST API key named Client reporting app, with the Read permission selected and Write & Delete switched off.

Can I see what changed on my child sites in MainWP?

MainWP Network Activity logs the actions taken from your MainWP Dashboard, such as plugin updates, new posts and new users, along with changes made directly in a child site’s WP Admin. Each entry shows the date, the user, the site and where the change came from, so changes made outside your Dashboard stand out.

MainWP Network Activity listing plugin updates, new posts, new users and a WP Admin login across child sites, with each change's user, site and source.

How does MainWP find and fix security issues?

The MainWP Dashboard and MainWP Child plugins are open source on GitHub, so anyone can read and audit the code. MainWP also runs a Vulnerability Disclosure Program through Patchstack for both plugins, where security researchers report issues and earn rewards based on severity. Details are on the MainWP code audits page.

Which MainWP add-ons add more security?

MainWP add-ons extend your MainWP Dashboard with security tools for your Dashboard and your child sites:

MainWP Dashboard Lock (free add-on): limits your Dashboard’s WP Admin to the IP addresses you allow, adds HTTP authentication to WP Admin and the login page, and can send front-end visitors to another site.
MainWP Vulnerability Checker (free add-on): checks WordPress core, plugins and themes on your child sites for known vulnerabilities, using the free MainWP NVD API or the WPScan database.
Patchstack, Sucuri and Jetpack Protect integrations (free add-ons): bring vulnerability and malware scan results from each service into your MainWP Dashboard.
Wordfence, Solid Security, Virusdie and Jetpack Scan integrations (MainWP Pro): manage each security plugin or service across your child sites from your Dashboard.

Your MainWP Dashboard is a WordPress site, so any WordPress two-factor plugin, such as WP 2FA, adds two-factor sign-in to it.

Get started with MainWP

Read how each part works in the MainWP documentation:

See what you get for free on MainWP Free Features, compare plans on MainWP Free vs Pro, or install MainWP and connect your first site.