Protect Your Data with MainWP

MainWP keeps your agency’s site and client data on your own server. The MainWP Dashboard is a self-hosted WordPress plugin, so your site list, client details, reports and backups live in your own WordPress database and on hosting you choose.

MainWP is built for agencies, freelancers and developers who manage many WordPress sites and want to own that data. The free MainWP Dashboard and MainWP Child plugins are open source under the GPL, so every line of code that handles your data can be read and audited.

Over 20,000 MainWP Dashboards manage over 700,000 child sites, and MainWP has over 2,200 five-star reviews on WordPress.org.

Where does MainWP store your site and client data?

Your site and client data is stored in your own MainWP Dashboard, on the WordPress site where you installed it. MainWP never receives it. When your Dashboard syncs a child site, the results are saved to your own database.

What does your MainWP Dashboard send to MainWP?

The free MainWP Dashboard and MainWP Child plugins run with no telemetry, so your sites, clients and actions stay private to you. The MainWP Plugin Privacy Policy states that MainWP collects no personal data through either plugin.

When you activate a MainWP add-on, your MainWP Dashboard checks in with mainwp.com using your license key and your Dashboard’s domain and IP address. MainWP uses them to deliver the add-on and its updates. Your child sites, clients and reports stay on your server.

Optional helpers, such as in-app guided tours, the help chat and embedded YouTube videos, are listed under Privacy & Third-Party Services Permissions in your Dashboard. Each one waits for you to switch it on.

Every MainWP add-on also shows its Privacy Info in your Dashboard: a standalone add-on runs entirely inside MainWP, and an integration names the third-party service it connects to, who owns it, and a link to that owner’s privacy policy.

How does MainWP secure the connection to your child sites?

MainWP secures each child site connection with its own 2048-bit RSA key pair. Your MainWP Dashboard creates the key pair when you add a site, keeps the private key encrypted, and gives the MainWP Child plugin the public key. Every request your Dashboard sends is signed, with SHA-256 by default, and the child site checks the signature before it acts.

• Administrator check: connecting a site needs a WordPress administrator username on that site, and the MainWP Child plugin checks the password on the child site itself.
• Unique Security ID: a second check on the child site, which accepts your Dashboard when it presents the matching ID.
• One Dashboard per site: each connected child site answers to your Dashboard alone, the one that holds its key.
• Connection timeout: set how many minutes the MainWP Child plugin waits for your Dashboard to connect, and it deactivates itself after that.
• Fresh keys on reconnect: reconnecting a site creates a new key pair.

MainWP uses OpenSSL for these keys, with phpseclib as a built-in alternative. The MainWP connection security docs cover each setting.

How does MainWP protect API keys and passwords?

MainWP encrypts the sensitive values your MainWP Dashboard stores: third-party API keys, add-on license keys, HTTP authentication details and backup storage credentials use AES-256-GCM encryption. The encryption key lives in its own file in the MainWP folder, apart from the database. The MainWP docs on sensitive data explain the setup.

How do MainWP Built-In Backups keep site data private?

MainWP Built-In Backups keep every backup on your MainWP Dashboard server, and you choose where copies go: S3-compatible storage, Google Cloud Storage, Dropbox, SFTP or a local path. Your Dashboard keeps the storage credentials encrypted on its own server, away from your child sites.

Switch on archive encryption and MainWP encrypts each backup with AES-256-GCM before it goes to your storage, with a recovery passphrase that you keep. Built-In Backups are part of the free MainWP Core.

Who can access your MainWP Dashboard?

You decide who reaches your MainWP Dashboard and what each person or tool can do.

• IP allowlist: the free MainWP Dashboard Lock add-on opens your Dashboard’s wp-admin to the IP addresses you list.
• Two-factor login: your MainWP Dashboard is a WordPress site, so a two-factor plugin such as WP 2FA protects its login.
• Team roles: MainWP Team Control (MainWP Pro) gives each team member a custom role with the sites, add-ons, abilities and MCP tools they need.
• API keys with scopes: MainWP REST API keys carry read, write, or read and write permission, and Abilities API calls need an administrator’s Application Password.

How do AI tools connect to your MainWP Dashboard?

MainWP MCP connects AI assistants such as Claude straight to your MainWP Dashboard. It runs on your own computer, talks to your Dashboard over HTTPS with an Application Password, and stores nothing. Your Dashboard enforces its permissions on every request, and any delete starts as a preview that needs your confirmation. Read the MainWP MCP docs to set it up.

Is MainWP open source?

Yes. The MainWP Dashboard and MainWP Child plugins are released under GPLv3 or later, and their code is public on GitHub at mainwp/mainwp and mainwp/mainwp-child. Anyone on your team, or your clients’ security reviewers, can audit how MainWP handles data. How Secure is MainWP covers MainWP’s security practices.

How does self-hosted MainWP help with GDPR?

A self-hosted MainWP Dashboard lets you choose hosting that fits the privacy laws in your area and control every point of access to your clients’ data. MainWP’s GDPR guide for WordPress managers explains why that matters. MainWP also publishes a Data Processing Agreement.

Get started with MainWP

• Install the free MainWP Dashboard on your own WordPress site.
• See what’s included in the free MainWP Core and compare MainWP Free vs Pro.
• Read the MainWP Plugin Privacy Policy and why self-hosted and open source matter.