Performance

• Zero-DB page cache fast path — An advanced-cache.php drop-in serves anonymous pages as pre-gzipped HTML straight from disk (wp-content/cache/wpmgr) before WordPress, plugins, or the theme load. A cache HIT makes zero DB or plugin calls and streams the .html.gz with a 304 Not-Modified short-circuit. Every cached response carries an x-wpmgr-cache header.
• Variant-aware cache key — Pages cache separately per device (mobile UA), per logged-in role, per operator-included cookie, and per cache-varying query string (marketing params stripped). The drop-in's key algorithm is byte-identical to the PHP writer.
• Safe cacheability gates — Never caches non-200, admin/login/AJAX/feed/sitemap paths, password-protected posts, or any request carrying a bypass cookie (WooCommerce/EDD cart + session, logged-in, comment-author). WooCommerce cart/checkout/account pages are excluded outright.
• WooCommerce cart-session shell caching — Catalog pages (shop, category, home, blog) can be cached for shoppers who already have items in their cart; cart totals update live via WooCommerce's own cart-fragments mechanism. WPMgr auto-probes theme support across real storefront renders before surfacing the toggle, requiring three independent page confirmations before reporting support.
• Automatic server fast-path install — Enabling the cache writes the WPCACHE define, installs the drop-in, and adds an Apache .htaccess block that serves .gz without PHP. nginx gets a copy-paste tryfiles snippet; built-in handling for OpenLiteSpeed and WP Engine Atomic.
• Purge: all, per-URL, and auto on content change — Manual purge of the whole cache or a single URL's variants, plus automatic invalidation on post/comment/product/template change that purges and re-warms the exact affected URL set (permalink, home, archives, every assigned + ancestor term).
• Host / edge-cache purge integrations — Every purge fires wpmgrpurge*:before/:after actions so managed-host and CDN edge caches (Varnish, Kinsta, WP Engine, etc.) clear in lockstep.
• Full-site preload warmer — Warms every cacheable URL (home, all public post types including WooCommerce products, every non-empty term archive, author archives) across desktop and mobile UAs, via a custom self-dispatching MySQL queue with atomic claim/lock, retry/backoff, and same-host SSRF filtering.
• Operator-tunable preload throttle — Concurrency (1-4 workers), inter-request delay (0-10000 ms), batch size (1-500), and a per-core load-average ceiling above which a pass defers — clamped on both control plane and agent.
• Remove Unused CSS — own engine, no headless browser — The agent POSTs page HTML + CSS to the control plane, which computes used-CSS with its own engine (no third-party service), caches it in object storage, and dedups across pages of the same structure hash. The agent inlines the used-CSS and defers the originals. Any failure or cache-miss serves full CSS unchanged — rendering is never blocked.
• RUCSS safelist — Built-in safelist of slider/lightbox/runtime-state classes plus operator-defined selectors are force-kept so JS-driven widgets survive the purge.
• Post-compute cache reheat — When the async RUCSS worker finishes, the control plane purges the URL and re-fetches it so the next render is a HIT with optimized HTML already cached.
• CSS/JS minification — Local same-site stylesheets and scripts are minified, content-addressed into a local asset cache, and tag URLs rewritten. Already-minified and external files are skipped.
• JavaScript delay (defer / interaction / idle) — Defers first-party JS via the defer attribute, or rewrites scripts to data-src and runs them only on first interaction or requestIdleCallback. Structural scripts (ld+json, speculation rules) are never delayed.
• Font optimization — font-display:swap injected into @font-face + Google Fonts links, optional self-hosting of Google Fonts stylesheets + woff2 files, and heuristic rel=preload for the first critical fonts.
• WOFF2 font transcoding — Self-hosted TTF, OTF, and WOFF fonts are transcoded to WOFF2 by the media-encoder service (50–65% smaller for TTF/OTF, 20–30% for WOFF). The original serves until transcoding completes; any failure falls back to the original.
• Glyph subsetting — When subsetting is enabled alongside WOFF2 transcoding, the encoder produces a latin-ext subset (U+0000–024F, U+1E00–1EFF) alongside the full WOFF2. Typical additional savings are 60–90% for body-text Latin fonts. Variable and icon fonts are detected and skipped. Per-font processing states (pending / converting / ready / subsetted / skipped / failed) are shown in a live table on the Optimize tab.
• Third-party asset self-hosting — Downloads cross-origin CSS/JS to the local asset cache and rewrites tags to same-origin. Best-effort: failure leaves the external URL in place.
• Image markup optimization (CLS + lazy-load) — Fills missing width/height from getimagesize() or the filename WxH suffix to prevent layout shift. Adds loading=lazy + decoding=async to below-the-fold images while keeping the first two eager; existing srcset preserved.
• YouTube facade + Gravatar self-host — Replaces YouTube iframes with a click-to-load thumbnail facade (no YouTube JS until clicked) and downloads/self-hosts Gravatars to the local asset cache.
• Speculation Rules prefetch — Injects a <script type=speculationrules> block that prefetches same-origin links (eagerness moderate) while excluding wp-admin/login, cart/checkout/logout, query-string, and nofollow URLs for near-instant navigations.
• CDN URL rewrite with encrypted credentials — Rewrites same-site static-asset URLs to a configured CDN host (all / css-js-font / image groups), runs last so it catches minified + self-hosted URLs, and purges the CDN edge (Cloudflare/Bunny/KeyCDN) on purge using age-encrypted credentials the control plane decrypts only in-process.
• WordPress bloat removal — Per-toggle de-bloat (block-library CSS, dashicons, emojis, jquery-migrate, XML-RPC, RSS feeds, oEmbeds, Heartbeat throttling, post-revision cap).
• Optimize-on-MISS, cache the optimized bytes — The full optimization pipeline runs inside the cache-writer's MISS path before gzip + write. Every transform is config-gated, wrapped so a failure degrades to a no-op, and skipped for logged-in/personalized responses.
• Cache hit-ratio history — The drop-in tallies HIT/MISS to per-hour counter files with zero DB work on a cache hit; the heartbeat drains completed buckets to the control plane, which appends to a Postgres time-series (120-day GC).
• Hit-ratio trend chart (7/30/90-day) — Dashboard renders a cache hit-percentage trend with a 7/30/90-day window toggle and an average-ratio badge.
• Live cache telemetry + verify card — Agent reports cached-page count, cache size, last purge, and live preload progress over SSE, plus the real install state (web server, drop-in present, WP_CACHE define, .htaccess managed) so the verify card reflects on-host truth.
• Page-cache conflict + multi-currency/i18n detection — Detects other active cache/optimization plugins (reported to the dashboard, never deactivated) and auto-derives the cache-varying cookies/queries that multi-language and multi-currency plugins need so language/currency variants cache separately.
• Portfolio bulk actions + presets — Purge the cache across many sites at once, or apply a safe / balanced / aggressive optimization preset to a whole group in one run (each preset spreads a small toggle set without clobbering per-site lists).
• Page-source footprint marker — Every cached response carries an HTML-comment footprint (with timestamp, and an (optimized) suffix when transformed) so operators can confirm via view-source that WPMgr wrote and optimized the page.

Redis object cache

• Per-site persistent object cache — Full WordPress cache API surface (add/get/set/replace/delete, multi-key variants, flushgroup, flushruntime, wpcachesupports, switchtoblog for multisite). Accelerates logged-in users, admin screens, WooCommerce checkout, and every database round-trip the page cache cannot serve.
• Connect test before enable — The agent dials the candidate config without persisting it, probes phpredis capabilities (igbinary serializer, lzf/lz4/zstd compression, TLS), reads the eviction policy, and returns a structured result. Enable is blocked until a test passes. Codec mismatch is caught up front and rejected with a clear message.
• Encrypted credentials — The control plane age-encrypts (X25519) the connection credential and delivers it via the signed command channel to a 0600 file on the site. Plaintext never appears in GET responses, logs, SSE payloads, test results, heartbeats, or backups.
• Two-level graceful degradation — A boot failure swaps in a pure in-memory array cache so the site never goes down. Mid-request Redis errors become cache misses with one reconnect attempt, then degrade for the rest of that request. A persisted reconnect cool-down (15 s, doubling to 5 min) stops a down Redis from being re-dialed on every request.
• Fully self-contained drop-in — One generated file contains the complete engine, connection layer, and config loader — no runtime dependence on the plugin folder name or location. The agent invalidates the drop-in's opcache on every version change; an outdated stub self-heals on the next heartbeat.
• Configuration drift detection — The agent reports the fingerprint of the configuration file it is actually reading; the dashboard flags divergence from saved settings.
• Live status + analytics — Dashboard shows connected / degraded / down with a 10 s SSE-debounced update. Charts track hit ratio, used memory, average command latency, and ops/sec over the last 7 days with a 90-day daily downsample. A per-site-prefixed flush never touches another site's keys on a shared Redis.
• x-wpmgr-object-cache debug header — When the "Debug response header" setting is on, front-end responses carry x-wpmgr-object-cache: state=connected hits=42 misses=3 reads=45 writes=12 ms=1.4. Administrators always receive it while logged in; visitor-side is opt-in. Pages served by the page cache do not carry the header because WordPress does not run on those responses.

Real user monitoring

• Web-vitals collection — A tiny first-party collector script (injected into cached pages at cache-write time) beacons LCP, INP, CLS, FCP, and TTFB directly to the control plane. Versioned collector URL forces edge-cache revalidation on every agent update.
• CrUX-style p75 dashboard — p75 per metric with a PageSpeed Insights-style good/needs-improvement/poor distribution bar, a 28-day trend chart with threshold lines drawn on, and per-URL and per-device breakdowns. Live updates stream over SSE.
• Postgres histogram rollups — Hourly and daily, with ClickHouse available as an opt-in scale backend via the same boot-selection pattern as the uptime store.
• Privacy-first — Off by default. No cookies, no cross-site identifiers. Page paths stored with query string stripped. Visitor IP used only transiently for coarse country lookup, then discarded. On a self-hosted control plane all RUM data stays on the operator's own infrastructure.

Per-site email

• Multi-provider sending — Amazon SES, SendGrid, Mailgun, Postmark, or any generic SMTP server, configured per-site or inherited from an org-wide default. Org default propagates automatically to every inheriting connected site in parallel on save.
• Named connections with failover — Define multiple named connections per site. Map FROM addresses to a specific connection; a fallback connection retries automatically on primary failure. The email log records which connection handled each send.
• Central cross-site email log — Every outgoing email logged with full detail: to, from, subject, headers, status, provider response, retry count, and attachment names/sizes. Paginated with free-text and column-scoped search, status and date filters, per-row detail with previous/next navigation, single and bulk resend, and CSV/JSON export. Email bodies not stored by default; opt-in per tenant. Log entries prune after 14 days.
• HTML preview sandbox — A logged email's body renders inside a locked-down sandboxed iframe (no scripts, no same-origin) with a strict CSP. Remote images and tracking pixels blocked by default with a per-message opt-in.
• Bounce and complaint suppression — Connect a provider webhook (SES SNS, SendGrid, Mailgun, Postmark) and WPMgr automatically suppresses hard-bounced and complained addresses fleet-wide. Manual add/remove supported. Scoped per-site or org-wide.
• Fleet deliverability dashboard — Cross-site sent/failed/bounced/complained counts in one view. Per-site deliverability charts on each site's Email tab. Live SSE updates.
• Failure alerts + digest — Opt-in alerts sent to operator-chosen recipients when sends start failing (throttled; configurable 15 min–24 h). A separate weekly or monthly deliverability digest summarises sent, failed, and bounced counts per site with a top-failures list.
• Credentials encrypted at rest — age (X25519); a secret_set flag is returned in place of the plaintext. A test-send button confirms delivery before saving.

Media

• Dedicated cloud encoder — Separate media-encoder container decodes from magic bytes (never trusted MIME) and re-encodes to AVIF (q50/speed8), WebP (q80), or re-optimized original. Animated GIFs → animated WebP.
• Runs by default, disable if unneeded — Part of the base self-host stack (docker compose up -d starts it, no profile needed); disable on constrained hosts with --scale media-encoder=0. Zero weight or native-library CVE surface on the core API either way, since encoding never runs there.
• Per-image optimize and full reversible restore — Originals archived on-site (.wpmgr-original.* rename); restore reverts every variant. A separate admin-gated delete-originals reclaims disk.
• No image bytes on the control plane — Source and optimized bytes move agent-to-storage and encoder-to-storage via presigned URLs only. CP stores metadata rows only.
• .htaccess Accept-header fallback — Serves the modern format only when the browser's Accept header advertises support; legacy twin is served otherwise. Vary: Accept for CDN correctness. nginx map equivalent emitted for non-Apache hosts.
• Auto-optimize on upload — Per-site opt-in hooks wpgenerateattachment_metadata, debounces (~25 s) batch pushes to the CP, and runs the existing optimize pipeline. Four stacked guards prevent self-optimization loops.
• Library sync + savings metrics — Total assets, optimized/pending/failed/unsupported counts, total bytes saved across all variants including thumbnails.
• Serialization-safe DB URL rewrite — Rewrites old-to-new media URLs across post_content and postmeta in a way safe for PHP-serialized data; recorded for reversible restore.
• Resilient per-variant encoding — Per-variant failures never fail siblings; 50 MB / 100 megapixel source limits; 60 s per-encode timeout; size + magic-byte verification of downloaded outputs before write.
• Unused image library scan — Walks the entire attachment library and classifies every image as in-use or orphaned by building an exhaustive cross-content reference index. No image is flagged unused unless it appears nowhere.
• "Where is this image used" attribution — For every referenced image, surfaces each in-use location: post/page content, excerpts, revisions, featured images, gallery/block IDs, page-builder data (Elementor, Beaver, Bricks, Divi, WPBakery, Oxygen, Breakdance, ACF), SEO/OpenGraph meta (Yoast, Rank Math, SEOPress), theme mods, widgets, nav menus, term meta, and user/avatar meta — with a deep-link to edit the referencing object.
• Conservative "ambiguous = in use" design — Casts the widest net (revisions, builder JSON, serialized arrays, sub-size derivation, protocol-agnostic URL matching) and aborts the whole scan if the uploads directory is unresolvable rather than risk a false orphan.
• Reversible server-backed quarantine — Instead of deleting, isolate moves an image's original plus every generated sub-size (and optimizer-produced variants) into a web-blocked wp-content/wpmgr-quarantine/ store with a JSON manifest. The attachment post stays in the library so the action is fully reversible.
• One-click restore from quarantine — Any isolated set can be moved back to its exact original upload paths from the manifest, with path-containment checks ensuring files only ever land back inside the uploads directory.
• Confirmation-gated permanent delete — Permanent removal of quarantined files plus their attachment posts requires an explicit DELETE confirmation token, enforced independently at both the control plane and the agent (constant-time compare).
• Role-gated, audited cleaner endpoints — Scan and quarantine-list are viewer-level reads; isolate/restore/delete require operator-level write permission. Every action is recorded to the audit log and emitted over the live site-event bus.

Site tools

• File Manager — Browse, edit, upload, download, and manage files on any managed site from the dashboard, no SFTP required. Read access and write access are separate per-site toggles, both off by default, restricted to owner and admin. Write operations block PHP and executable content and refuse protected roots (wp-admin, wp-includes, core). Zip and download any path; extract a zip with zip-slip and zip-bomb protection. Search by name or content. Every edit auto-saves an encrypted prior version with one-click restore from a per-file history panel. Every read, write, delete, upload, extraction, and denial is written to the operator audit log, filterable by the File manager action group.
• Database Cleaner (scan / preview / clean) — Read-only scan estimates then bounded, batched cleanup across 14 categories: post revisions, auto-drafts, trashed posts, spam/trashed comments, expired transients, orphaned post/comment meta, orphaned term relationships, oEmbed cache, duplicate postmeta, Action Scheduler completed/failed, and OPTIMIZE TABLE on non-InnoDB tables. Per-category {rowsdeleted, bytesfreed, state} results stream back over signed progress pushes. Cleanup results are stored server-side and restored on page load and stream reconnect so a running cleanup survives a refresh.
• Database Cleaner safety — Each task deletes only the rows it targets; SELECT→DELETE batching in 2000-row chunks with a hard iteration cap, OPTIMIZE TABLE on a 12 h cooldown, and operator-level permission gate. WP core options/cron/tables and installed-plugin-attributable items are skipped.
• Per-table inventory + maintenance actions — Every table listed with row count, size, storage engine, overhead, and a "Belongs to" label (WordPress core / active plugin or theme / orphan). Per-table actions: optimize, repair, analyze, convert to InnoDB, empty, delete — each gated by a typed confirmation. Orphaned options and cron events classified by corpus confidence level (exact / prefix / heuristic / unknown) against a seed of ~120 high-orphan-risk plugins.
• Database Snapshots — One-click local DB snapshot before a risky change and one-click revert. Dumps to gzipped SQL under wp-content/wpmgr-snapshots/db/ (web-hardened, never uploaded), with create / list / revert / delete actions and a configurable retention cap (default 5, hard max 20, oldest pruned first).
• Snapshot revert safety — Revert is a destructive whole-DB overwrite gated behind an exact REVERT confirmation token (constant-time compare). Before importing, auto-captures a pre-revert safety snapshot, then replays the dump into tmp-prefixed tables and atomically swaps each over the live table so WordPress stays readable throughout. A failed import leaves the live DB untouched.
• Search & Replace — Operator-driven literal find-and-replace across the whole database (or a chosen table allowlist) for URL/domain migrations and string fixes. Mandatory dry-run preview returns tables-scanned / rows-matched counts before any write, then reports rows-changed on apply.
• Search & Replace safety — Serialization-safe walker (PHP-serialized blobs are unserialized, rewritten, and re-serialized so s:NN: length prefixes are recomputed — never a naive str_replace). Minimum 3-char search guard; community migration table denylist; binary/blob columns and posts.guid always skipped; all values mysqli-escaped; an advisory X-Backup-Warning header fires on a live run with no recent backup.

Clients for agencies

• Client grouping — Create, edit, and delete clients (name, company, contact email, phone, notes, brand color, logo URL). Assign one or many sites via bulk "Set client" on the fleet view; filter by client; jump to a per-client detail page. Clients are tenant-isolated with RLS; a database-level composite constraint makes cross-tenant assignment impossible.
• White-label reports — Monthly or weekly schedule per client, with a "Generate now" button for any custom period up to 92 days. Aggregates uptime, backups, updates, Core Web Vitals p75, and email deliverability. Per-section on/off toggles; custom intro and closing text. Delivered as branded HTML email, print-optimized page, and server-side vector-chart PDF. The client's brand color and logo appear throughout; the "powered by" footer is removable on any plan.
• Read-only client portal — Invite client users by email from the Portal access tab. Existing users added immediately; new addresses receive a tokenized invite (7-day expiry) with a copyable fallback link. Clients land at /portal with their logo and brand color applied, a softened-wording sites overview ("Monitoring active", "Needs attention"), per-site uptime and incident history, backup inventory, applied updates, Core Web Vitals field data, and completed report downloads. The client role ranks below viewer with zero permissions; access is revoked instantly on removal, client archive, or client delete.
• Live portal summary dashboard — The portal landing shows a status banner, five animated headline counters (sites monitored, average uptime, backups, updates applied, speed rating), a month-at-a-glance section with fleet uptime trend and Core Web Vitals distribution, site cards with 30-day sparklines, and a day-grouped "Recent work" timeline. All data is strictly scoped to the client's own sites.

Team & access

• Multi-tenant organizations — Each resource scoped to an org. Isolation enforced by Postgres Row-Level Security (app.tenant_id GUC) with the app role NOSUPERUSER NOBYPASSRLS.
• Four-role RBAC — owner > admin > operator > viewer with a discrete permission matrix. Privilege ceiling prevents granting a role higher than your own.
• Per-site collaborator sharing — Outside users (no org membership) scoped to one site, enforced by both Gin middleware and RESTRICTIVE RLS. Blocked from all org-level actions.
• Tokenized invitations — Single-use, 7-day-expiry SHA-256-hashed tokens bound to the invited email. Existing accounts must re-authenticate; a leaked link alone cannot log anyone in.
• Email/password auth with first-run bootstrap — argon2id hashing; the first signup bootstraps the owner account as verified and active. After that, anyone can self-register — new accounts are created pending and gain access only after clicking the emailed verification link. Login responses never reveal whether an email exists.
• Self-serve password reset — Public forgot-password + reset endpoints issue a 30-minute single-use SHA-256-hashed token. Both endpoints are enumeration-safe (always-200, timing-equalized).
• Change-password with session invalidation — Verifies the current password then stamps passwordchangedat, which logs out all other active sessions on their next request while keeping the acting session alive.
• UI-configured per-instance SMTP — Owners configure the instance SMTP relay (host/port/TLS/credentials/From) in Settings. The password is age-encrypted at rest, masked on read. A test-send button confirms delivery before saving.
• OIDC / SSO — OpenID Connect relying party with PKCE, state, and nonce. Account linking only when the IdP asserts the email is verified. Ships with a Dex container so SSO works locally.
• Superadmin console — Instance-level cross-tenant admin area (/api/v1/admin) gated by issuperadmin, granted only via the WPMGRSUPERADMIN_EMAILS env allowlist and boot seeder — never API-settable. Lists/searches users cross-tenant, disables/deletes users with orphaned-org cleanup, resends verification, and shows instance stats. Intended for operators running multi-tenant self-hosted instances.
• Tamper-evident audit log — SHA-256 hash-chained, append-only (DB role denied UPDATE/DELETE). Covers logins, member/role changes, API-key changes, site lifecycle, sharing, autologin, media consent, updates. /audit/verify reports the first broken link.
• API keys — Role-scoped, revocable, audited. Carries the same RBAC permission matrix as a user session.

Architecture

apps/api    — Go 1.26 + Gin control plane (modular monolith)
apps/web    — React 19 + TypeScript + Vite + TanStack dashboard
apps/agent  — PHP 8.1+ WordPress agent plugin (MIT)

Data: Postgres (primary + RLS) · Redis (sessions, cache, dedup) · S3-compatible object storage (backups, media) · on-disk page cache (wp-content/cache/wpmgr, pre-gzipped .html.gz) · ClickHouse (optional, uptime + RUM time-series)

Agent ↔ CP auth: Ed25519 signed requests (canonical METHOD\nPATH\nTIMESTAMP\nNONCE\nsha256(body)) with per-request nonce + timestamp for anti-replay. CP→agent commands are short-lived Ed25519-signed JWTs scoped to one site and one operation.

See docs/architecture.md for a full system diagram.

Quickstart (self-host)

The bundled compose brings up the full stack — control plane, dashboard, Postgres, Redis, object storage, and the media encoder (screenshots + Media Optimizer) — building all three images from source:

cp .env.example .env
Edit .env — at minimum set WPMGRSESSIONSECRET, WPMGRDBPASSWORD, WPMGRS3SECRET_KEY
docker compose -f infra/docker-compose.yml up -d
curl localhost:8081/healthz   # {"status":"ok"}   (default WPMGRAPIPORT=8081)

Open http://localhost:8088 in your browser (the default WPMGRWEBPORT) — the first signup creates the owner account. After that, anyone can self-register and gains access only after verifying their email.

The media encoder runs headless Chromium for screenshots, so it adds some RAM/CPU over the api/web images. On a constrained host you can skip it without editing the compose file:

docker compose -f infra/docker-compose.yml up -d --scale media-encoder=0

Site screenshot cards then fall back to favicon/monogram and the Media Optimizer tab is unavailable; everything else works normally.

Prebuilt container images

The control plane, dashboard, and media encoder are published on GitHub Container Registry as multi-arch (linux/amd64 + linux/arm64) images — wire them into your own compose, Kubernetes, or Swarm for production:

docker pull ghcr.io/mosamlife/wpmgr-api:v0.43.3
docker pull ghcr.io/mosamlife/wpmgr-web:v0.43.3
docker pull ghcr.io/mosamlife/wpmgr-media-encoder:v0.43.3

Or bring up the whole stack from the published images (no local build) with the pull-only Compose overlay:

export WPMGR_VERSION=v0.43.3   # omit to track :latest
docker compose -f infra/docker-compose.yml -f infra/docker-compose.prod.yml up -d

Migrations apply automatically on boot. The validate-env command (make validate-env) checks your configuration and prints every problem at once before the stack starts.

Full install guide, env reference, and production hardening: docs/install.md.

Install the Agent

• Download wpmgr-agent.zip from the GitHub Releases page.
• In WordPress: Plugins → Add New → Upload Plugin → choose the zip → Install Now → Activate.
• Open the top-level WPMgr admin menu, set the Control-plane URL field and click Save URL, then paste the dashboard's Pairing code into the Enroll form and click Enroll.

See docs/agent.md for WP-CLI install and configuration options.

Roadmap

The following are accepted architectural decisions with no implementation yet:

• Fleet-wide backup browser — Browse and filter snapshots across all sites from one view (route placeholder present, not built).
• Backup download — No presigned-download endpoint or web UI; restore is the current recovery path.
• Scheduled update runs — scheduled_at is stored and accepted; no deferred dispatcher yet (tasks enqueue immediately on create).
• CAPTCHA challenge on login block — Login protection currently serves a static 403; no challenge/solve flow built.
• Plugin/theme content malware scanning — The scan engine covers WordPress core checksums only; no signature or heuristic detection for wp-content files yet.
• Automatic restore rollback UI — The .wpmgr-old-files-<id>/ rollback directory is preserved; no operator-initiated rollback endpoint exposed.
• Redis Sentinel / Cluster — Object cache v1 supports single instance or unix socket with TLS; the config schema reserves fields for both topologies.
• Helm chart / Terraform provider — Stubs exist under infra/; not implemented.
• AI features — apps/api/internal/ai/ contains only a .gitkeep placeholder.

Repository layout

apps/
  api/      Go control plane
  web/      React dashboard
  agent/    WordPress agent plugin
packages/
  openapi-client/   generated TypeScript API client
infra/
  docker-compose.yml
  Dockerfile.api · Dockerfile.web · Dockerfile.media-encoder
  postgres/ · seaweedfs/ · nginx/ · dex/ · grafana/
docs/
  install.md · agent.md · architecture.md · contributing.md · security.md · api.md · adr/

Development

cp .env.example .env
docker compose -f infra/docker-compose.yml up -d   # data plane
API
cd apps/api && go run ./cmd/wpmgr
Web
cd apps/web && pnpm dev
Regenerate OpenAPI client after schema changes
go generate ./internal/api/gen/...
pnpm -C packages/openapi-client generate

See docs/contributing.md for the full dev setup, PR checklist, and ADR process.

License

| Component | License | |---|---| | Control plane + dashboard (apps/api, apps/web) | AGPL-3.0-only | | WordPress agent plugin (apps/agent) | MIT |

Links

• Install (self-host)
• WordPress agent
• Architecture
• API reference
• Contributing
• Security policy
• Architecture decisions
• GitHub Releases