Fleet Agent Site Manager – Securely Connects Your Sites to a WPMgr Dashboard

Fleet Agent Site Manager securely connects the WordPress sites you look after to a WPMgr dashboard, so backups, updates, caching, security and performance for every one of them run from a single screen.

You need a WPMgr dashboard as well as this plugin. Run one on your own server for free (it is open source: https://github.com/mosamlife/wpmgr), or use the hosted service at https://manage.wpmgr.app.

Until you enter a dashboard address and complete a signed pairing, this plugin has no endpoint, opens no outbound connection and sends nothing anywhere.

Every action the dashboard can ask for is on a closed, named list compiled into the plugin, and each one is verified against an Ed25519 signature tied to that pairing before it runs. There is no eval, no remote include and no remote PHP execution of any kind.

What you can do once a site is connected

Backups and restore. Full and incremental backups of the database and files, scheduled per site or run on demand. Archives are encrypted on the site before upload, and an incremental run uses a content-addressed chunk store so only changed blocks move. Send them to storage the dashboard manages, a folder on your own server, or your own S3-compatible bucket. Restore a whole site or pick components, with a health check afterwards and an automatic rollback if the site does not come back.

Updates you can undo. Core, plugin and theme updates across every connected site, applied by WordPress’s own Upgrader against WordPress.org packages. A snapshot is taken before each one, so a bad release is one click back rather than a restore from last night’s backup. A watchdog recovers a site whose update died mid-write.

Speed. Disk page cache with an nginx and Apache fast path that serves a hit without booting PHP. Optional Redis object cache. Remove Unused CSS, CSS and JavaScript minification, deferred JavaScript, speculation rules, CDN rewriting, lazy iframes, and self-hosted Google Fonts, Gravatars and third-party scripts.

Images and fonts. Convert the media library to WebP and AVIF, keep the originals, and put them back if you do not like the result. An unused-image cleaner finds files nothing references. TTF, OTF and WOFF are transcoded to WOFF2.

Security. Hardening switches that stay off until you turn them on: file editor, XML-RPC, REST, author enumeration, SSL and HSTS, directory browsing, PHP execution in uploads. Login protection with per-site IP, CIDR and user-agent bans enforced at earliest boot. A hidden login address. File-integrity scanning against WordPress.org checksums and a learned per-site baseline.

Two-factor for your site’s own users. Authenticator app, emailed code or single-use backup codes, with guided enrollment once you require it for a role.

Password policy. Minimum strength, reuse blocking, optional expiry, and a breach check that never lets the password or its full hash leave the site. Policies target the roles your site actually has, including roles added by WooCommerce, membership and LMS plugins.

Database tools. Scan for revisions, transients, spam and orphaned metadata, preview exactly what will go before anything is deleted, take a snapshot before any change, and run a serialization-aware search and replace.

File manager. Browse, read, write, rename, delete, chmod, search, upload, archive and extract, with a version history on writes and a restore. Guarded against executable writes and protected roots.

Site email. Route this site’s outgoing mail through Amazon SES, SendGrid, Mailgun, Postmark or SMTP, with per-sender routing, automatic fallback, suppression of known-bad addresses and a full send log.

Real User Monitoring. Off by default. Turn it on and Core Web Vitals come from your actual visitors, page by page, instead of one lab score.

Cache purge reaches the layer in front of WordPress too, detected automatically: Varnish, Kinsta, WP Engine, SiteGround, Cloudways, RunCloud, GridPane, SpinupWP, CloudPanel, Rocket.net and WP Cloud, plus Cloudflare once you add its API credentials to wp-config.php.

The expensive work runs on the dashboard rather than on your server: unused-CSS computation, image and font encoding, vulnerability matching against a managed feed, uptime probing and site screenshots.

This plugin is GPLv2 or later and the dashboard is AGPL-3.0. Source for both: https://github.com/mosamlife/wpmgr

Privacy / What data is sent and where

This plugin does not contact any external service until you connect it to a WPMgr control plane that you choose. There is NO default endpoint; the agent is inert until you supply a control-plane URL and complete a one-time, signed enrollment from that control plane. That control plane is either a WPMgr instance you self-host or the hosted WPMgr service at https://manage.wpmgr.app.

Once connected, the agent communicates only with the control-plane URL you configured. It sends the following, only to that endpoint, and only for the management actions you or your schedules initiate:

• Site and environment metadata: site URL, WordPress, PHP and server versions, active theme and plugins, and Site Health diagnostics. Sent on connect, on a periodic heartbeat, and when you click Re-run checks. Used to display your site’s status in the dashboard.
• Update inventory: the list of available core, plugin and theme updates. Sent when inventory is refreshed. Used to show and apply updates.
• Backup archives (encrypted): when you run or schedule a backup, the agent archives your database and/or files, encrypts the archive, and uploads it to the storage destination your control plane configured. Archive contents may include your site’s content and personal data, and are encrypted before leaving the server.
• Rendered HTML: for CSS optimization (used-CSS generation), the agent submits rendered HTML of selected pages so unused CSS can be computed. Used only to produce optimized stylesheets.
• Diagnostics and activity logs: error logs, performance and cache statistics, and a record of management actions, sent so they can be surfaced in the dashboard.

The agent does not sell or share this data with third parties. It receives signed, allow-listed commands (backup, restore, update, cache operations) from your control plane; it does NOT download or execute arbitrary remote PHP code.

Real User Monitoring (when you enable it)

Real User Monitoring (RUM) is off by default and must be enabled per site. It is the one exception to the agent-as-sole-transmitter model above: the agent adds a small, public measurement script to HTML it already serves, and your visitor’s own browser, not the agent, then sends anonymous performance measurements directly to the control plane.

What the visitor’s browser sends:

• Core Web Vitals (LCP, INP, CLS) plus TTFB and FCP, and page-load timing.
• The page path only. Query strings are stripped before transmission, so tokens, emails, and order IDs in URLs are never sent.
• Coarse, non-identifying context: browser and device type derived from the User-Agent, connection type, and an approximate country code.

What is never collected: cookies, localStorage, cross-site identifiers, or the visitor’s full IP address. The IP is used only transiently for rate-limiting and coarse country lookup, then discarded and never stored.

This data originates from your visitors’ browsers, so you (the site owner) are its data controller and must disclose it in your own site’s privacy policy. If you self-host the control plane, RUM data stays entirely on your own infrastructure and never reaches WPMgr. If you use the hosted service at https://manage.wpmgr.app, that service processes the measurements on your behalf.

Disable RUM at any time in the Performance settings; the script is removed from newly cached pages immediately.

If you connect to the hosted WPMgr service, its Terms of Service (https://manage.wpmgr.app/terms) and Privacy Policy (https://manage.wpmgr.app/privacy) apply. If you self-host the control plane, you operate the receiving service and your own policies apply. You can stop all data transmission at any time by disconnecting the agent (Disconnect in the agent admin screen) or deactivating the plugin.

How it works / security

Commands arrive from the control plane over HTTPS. Each carries an Ed25519 signature produced with the key established at enrollment, and the agent verifies it before executing any action. The allow-list of permitted commands is compiled into the plugin, no mechanism exists to add new command types at runtime, and there is no eval, remote include, or remote PHP execution. Core, plugin, and theme updates are applied using WordPress’s own Upgrader against wordpress.org packages only.

External services

This plugin contacts external hosts only after you connect it to a control plane, and only for the specific features you enable. The plugin is inert until connected. This build contains no self-update client; updates arrive through the WordPress.org directory only.

WPMgr control plane (the URL you supply)

What is sent: site URL and name, WordPress and PHP versions, active plugin and theme inventory, Site Health results, rendered HTML of selected pages (for used-CSS computation), encrypted backup archives, transcoded font bytes, and cache and performance statistics. When: on enrollment, diagnostics, heartbeat, backup progress, cache and performance operations, Remove Unused CSS, autologin token consumption, database clean, font transcoding, and password breach checking. Always triggered by an action or schedule you initiate, never autonomously. Why: this is the dashboard that manages the site. Hosted at https://manage.wpmgr.app, its terms and privacy policy apply. Terms: https://manage.wpmgr.app/terms Privacy: https://manage.wpmgr.app/privacy Self-hosted, you operate the receiving service and your own policies apply.

Have I Been Pwned (https://haveibeenpwned.com), reached via the WPMgr control plane

What is sent: the first 5 characters of the SHA-1 hash of a candidate password, a k-anonymity range query. The site sends that prefix to the WPMgr control plane, which relays it to the Have I Been Pwned range API (https://haveibeenpwned.com/API/v3#searchingPwnedPasswordsByRange) and returns the matching hash suffixes. The password itself, the full hash and the user’s identity never leave the site; the agent compares the remaining 35-character suffix locally. When: only while the optional password-policy breach check is enabled, and only when a site user sets or changes a password. Off by default. Why: to refuse a password already known to be breached. Terms: https://haveibeenpwned.com/TermsOfUse Privacy: https://haveibeenpwned.com/Privacy The control-plane hop is covered by the WPMgr terms above.

Object storage (configured by your control plane)

What is sent: encrypted backup archives, restored backup chunks, optimized media files and transcoded font bytes, over short-lived presigned URLs the control plane supplies. No storage endpoint is hardcoded in this plugin. When: during backup, restore, and media or font optimization operations that you initiate. Why: this is where your backups and optimized assets are stored. The hosted service uses Google Cloud Storage (storage.googleapis.com) by default; a self-hosted operator may configure any S3-compatible destination. For the hosted default, Terms: https://cloud.google.com/terms Privacy: https://policies.google.com/privacy

ipify (https://api.ipify.org), operated by ipify (https://www.ipify.org)

What is sent: nothing. A plain GET request carrying no site data; the response is this server’s public outbound IP address, cached locally for 8 hours. When: during diagnostics collection, which you run or schedule. Why: to infer which host the site runs on. Terms: https://geo.ipify.org/terms-of-service Privacy: https://geo.ipify.org/privacy-policy

Cloudflare API (https://api.cloudflare.com), operated by Cloudflare, Inc.

What is sent: the configured Cloudflare zone ID and the API credentials you placed in wp-config.php. When: on a cache purge, and only while the Cloudflare integration is active. It stays inactive unless you define CLOUDFLARE_EMAIL and CLOUDFLARE_API_KEY, or CLOUDFLARE_API_TOKEN, in wp-config.php. Why: to purge the Cloudflare edge cache so visitors do not keep an old page. Terms: https://www.cloudflare.com/website-terms/ Privacy: https://www.cloudflare.com/privacypolicy/

Google Fonts (https://fonts.googleapis.com, https://fonts.gstatic.com), operated by Google LLC

What is sent: the font-family request derived from the page, the same request a browser would otherwise make. When: on cache build, and only while the self-hosted fonts optimization is enabled and a page uses Google Fonts. Why: to download the CSS and WOFF2 files server-side and serve them from your own domain instead. Terms: https://policies.google.com/terms Privacy: https://developers.google.com/fonts/faq/privacy

Gravatar (https://gravatar.com, https://secure.gravatar.com), operated by Automattic

What is sent: the avatar hash derived from the page. When: on cache build, and only while the self-host Gravatars optimization is enabled. Why: to download avatar images server-side and serve them from your own domain instead. Terms: https://wordpress.com/tos/ Privacy: https://automattic.com/privacy/

Third-party asset hosts referenced by your own pages

What is sent: a plain GET request to a cross-origin script or stylesheet URL that your page already references. When: on cache build, and only while the self-host third-party assets optimization is enabled. Why: to serve those assets from your own domain instead. There is no single provider. The hosts depend entirely on what your own pages embed, and the applicable terms and privacy policies are whichever of those hosts publish.

Email delivery providers (only the one you select, if any)

What is sent, for every provider below: sender address, recipient addresses (To, Cc, Bcc), subject, message body (HTML and/or plain text), and attachments or attachment metadata. When: only when that provider is the active email transport for this site and an outgoing email is sent. No provider is active until you configure one. Why: to deliver this site’s outgoing mail through a provider rather than the server’s own mailer.

• Postmark, operated by Wildbit LLC. Endpoint: https://api.postmarkapp.com/email Terms: https://postmarkapp.com/terms-of-service Privacy: https://postmarkapp.com/privacy-policy
• Amazon SES (https://aws.amazon.com/ses/), operated by Amazon Web Services, Inc. Endpoint: https://email.{region}.amazonaws.com/ where {region} is your configured AWS region, for example us-east-1. The message is sent as raw MIME signed with AWS Signature Version 4. Terms: https://aws.amazon.com/service-terms/ Privacy: https://aws.amazon.com/privacy/
• Mailgun, operated by Sinch Email (formerly Mailgun Technologies, Inc.). Endpoints: https://api.mailgun.net/v3/{domain}/messages (US region) or https://api.eu.mailgun.net/v3/{domain}/messages (EU region). Terms: https://www.mailgun.com/legal/terms/ Privacy: https://www.mailgun.com/legal/privacy-policy/
• SendGrid, operated by Twilio Inc. Endpoint: https://api.sendgrid.com/v3/mail/send Terms: https://www.twilio.com/en-us/legal/tos Privacy: https://www.twilio.com/en-us/legal/privacy
• SMTP: whichever server you configure. Your own provider’s terms and privacy policy apply.

Third-party / Credits

matthiasmullie/minify (MIT)

CSS and JavaScript minification uses matthiasmullie/minify (^1.3, MIT license), a pure-PHP minification library included in the plugin’s Composer dependencies. Source and license: https://github.com/matthiasmullie/minify

Copyright (c) 2012 Matthias Mullie. Licensed under the MIT License.

No other third-party libraries are bundled in the plugin zip. Image encoding and WOFF2 font transcoding run on the control-plane service, not inside this plugin.

Source code

This plugin ships two minified JavaScript files. Their human-readable source and build tooling are in the public repository at https://github.com/mosamlife/wpmgr

• assets/wpmgr-rum.min.js is the Real User Monitoring collector. The readable, non-minified build ships alongside the plugin at assets/wpmgr-rum.js. TypeScript source: apps/tracker/src/index.ts and apps/tracker/src/vitals.ts. Build: cd apps/tracker && npm install && npm run build (esbuild IIFE bundle, which also bundles Google web-vitals under its Apache-2.0 license; the same build produces both the minified and readable outputs).
• assets/wpmgr-delay.min.js is the deferred-script runtime. The readable source ships alongside the plugin at assets/wpmgr-delay.js in the same repository.