MainWP

MainWP is a WordPress site whose job is to control your other WordPress sites. You install a dashboard plugin on a site you own, a child plugin on each managed site, and from then on updates, backups, monitoring and user management happen in one place. Everything worth saying about it follows from that architecture.

What it does

• Runs plugin, theme and core updates across every connected site, individually or in bulk.
• Reports which sites are behind, which have vulnerable versions, and which are down.
• Triggers backups and stores them where you choose.
• Manages users, posts and pages across sites.
• Produces client reports, through a paid extension.

For anyone maintaining more than about five sites, the update problem is the reason to be here. Logging into fifteen dashboards weekly is a task that gets skipped, and skipped updates are how sites get compromised — the sequence described in fixing a hacked site.

Self-hosted, and what that means both ways

The dashboard runs on your hosting. That is the differentiator against hosted management services.

In your favour:

• No per-site monthly fee, and no site limit.
• Client data and credentials stay on infrastructure you control.
• The service cannot be discontinued, repriced or acquired out from under you.

Against you:

• The dashboard's uptime, performance and security are your job.
• A dashboard managing fifty sites is a heavy WordPress install, and it needs hosting chosen accordingly.
• There is no support team watching it for you.

That last set is not theoretical. The dashboard holds authenticated connections that can install code on every site you manage. It is, by a distance, the highest-value target in your estate.

Securing the dashboard, specifically

Treat it as infrastructure, not as a website.

• Its own hosting, not a shared box with client sites — see hosting.
• Two-factor authentication on every account, without exception.
• No public content. A dashboard does not need a front end anyone visits.
• Restricted access by IP where practical, and unique admin accounts per person.
• The full security checklist applied more strictly than anywhere else.

Ask the uncomfortable question before installing: if this site were compromised tonight, what would happen to the fifteen sites it manages? The honest answer is "all of them", and the controls should match.

Updates are still updates

MainWP makes updating fast; it does not make it safe. Bulk-updating thirty sites at once means thirty sites break at once when a plugin release goes wrong.

The discipline that matters is the same as for one site, in updating plugins safely: update a representative site first, look at it, then roll on. For anything significant, a staging site is still the answer, and the fact that a dashboard can push to production in one click is a reason for more care rather than less.

Backups before bulk updates are the other non-negotiable. MainWP can trigger them; whether they restore is a question you answer by testing, per backing up a site and backup plugins.

The extension model

The core is genuinely free with no site cap, which is unusual. Money is in extensions: advanced backups, client reporting, uptime monitoring, staging integrations, and connectors to various services. They are sold individually, as a bundle subscription, or as a lifetime bundle.

Two practical notes. Several extensions duplicate things your host already provides — if hosting does backups and uptime monitoring, do not buy them twice. And the lifetime bundle is only good value if you are still running the same estate in three years, which is a question about your business rather than about the plugin.

Where it does not fit

• One site. The dashboard is overhead with nothing to manage.
• Sites you do not control. The child plugin has to be installed, so client-hosted sites need cooperation.
• A single network of related sites, which may be multisite instead — shared files and users, one update run, and a very different failure profile.
• Teams wanting no infrastructure. A hosted service exists precisely so that nobody has to run this.

Common mistakes

• Hosting the dashboard on the same cheap shared plan as the sites it manages.
• Bulk-updating everything on a Friday with no staged rollout and no tested backups.
• Skipping two-factor on the one site where it matters most.
• Buying extensions that duplicate hosting features.
• Leaving the child plugin installed on sites you no longer manage, which is an open connection to a dashboard nobody is watching.

Deciding

MainWP earns its place from roughly five sites upward, when nobody is going to log into each of them weekly and the alternative is skipped updates. Choose it over a hosted service when data ownership and per-site cost matter more than someone else running the infrastructure. And whichever you choose, decide first who is responsible for the dashboard's own security — because that is now the security of every site it touches.