Skip to content

WPGenie

Operate

Business

Infrastructure

WPGenie

WPGenie

Sign in

Manage your sites, backups and security.

Username Password Code from your authenticator app (or a recovery code)

Every site in its own containerUnprivileged, read-only PHP with automatic HTTPS.
A shield in front of WordPressBot and AI-crawler blocking, WAF, and a CAPTCHA with no third party.
Backups you can trustEncrypted, deduplicated, restored in one click.
Yours, on your serverVisitor data never leaves it.

WPGenie

Welcome to WPGenie

Create the first administrator. To prove you own this server, paste the API token the installer printed (it is in /etc/wpgenie/config.json).

API token Username Password (12+ characters)

Sites

Live sites–

Page views · 24 h–

Visitors · 24 h–

Threats blocked · 24 h–

Create a WordPress site

Domain Site title Admin email Admin username (optional) Server

Point the domain's A/AAAA record at this server first — the TLS certificate is issued automatically.

No sites match the filter.

No sites yet

A site is ready in about a minute: WordPress, HTTPS, the shield and nightly backups included.

Backups

Destinations

Backups are restic snapshots: deduplicated (WordPress, themes and plugins are stored once for all sites) and encrypted with the destination's password. This server protects against a broken site or a bad update; add an off-server destination to survive losing the server, and keep its password somewhere else.

Add a destination

Name Type Endpoint (empty = AWS) Bucket Prefix (optional) Region (optional) Key ID Secret key Host Port User Directory Existing repository password (only to attach backups made elsewhere)

Browse a destination

Every WPGenie backup in the destination, including deleted sites'. Any of them can become a new site on another domain.

Mail

Domains

Mailboxes

Aliases (forwarding)

Outbound relay

Many clouds block outbound port 25. Relay through a provider (Amazon SES, Postmark, Mailgun, …) for delivery and reputation.

SMTP host Port Username Password

Security

IP reputation

Public blocklists of hijacked networks and addresses attacking servers right now, refreshed every 6 hours. Each site chooses whether listed clients are challenged or blocked (Site → Security). Verified search engines are never affected.

Server-wide lists

Apply to every site. Allowed addresses are never challenged, blocked or banned (your office, monitoring); blocked ones get nothing from any site.

Always allow Block everywhere

Banned addresses

Clients that send attacks (SQL injection, scanners, brute force) are banned on every site automatically: 1 hour, doubling for repeat offenders.

Recent blocks

Account

Two-factor authentication

Password

Current password New password (12+ characters)

Changing it signs out your other sessions.

Your sessions

API tokens

For scripts and billing systems (the WHMCS module). A token acts as you, with your role and account, and can be revoked at any time. It is shown once; only a hash is kept.

Accounts

Create an account

Name Kind Plan Reseller (customers only) Email (optional) First user (optional; password generated)

Plans

Limits per account (sites, staging copies included; disk: files and databases; bandwidth per calendar month, UTC) and per site. 0 means unlimited (the server's own limits still apply). Resellers can give their customers resellable plans that fit within their own.

Create or edit a plan

ID (lowercase, e.g. starter) Name Sites Disk (MB) Bandwidth / month (GB) Replicas per site Memory per replica (MB) CPUs per replica Domains per site Past the bandwidth Backup destinations (IDs, comma-separated)

Resellers may assign it

Billing

Stripe

Subscriptions become accounts: Stripe calls (add it as a webhook endpoint in Stripe with the events checkout.session.completed, customer.subscription.created/updated/deleted, invoice.paid and invoice.payment_failed). Secrets are write-only: leave a field empty to keep it.

Webhook signing secret Secret key (optional: plans from checkouts, metered bandwidth) Meter event name (optional: bandwidth in MB) Prices → plans (one per line: price_… = plan)

Webhooks

Events (accounts, plans, usage thresholds, sites) are posted as JSON, signed with X-WPGenie-Signature: t=…,v1=HMAC-SHA256(secret, "t.body"), and retried with backoff for about a day and a half.

Deliveries

Users

Accounts

Viewers see everything and change nothing. Operators run sites: shield, scaling, caches, updates, scans, mailboxes. Administrators also create and delete sites, manage users, server-wide security and mail settings, and update WPGenie.

Require two-factor authentication for everyone (accounts without it can only reach Account until they set it up)

Signed-in sessions

Audit log

Every change made through the panel, the API or the CLI (as api-token), and every sign-in.

Servers

Sites can live on several servers. Each runs its own Caddy, PHP, MariaDB and Valkey for the sites placed on it; this panel places new sites (on the server with the most memory to spare, unless you pick one), moves them, and talks to every server over mutual TLS. Nothing but the panel can manage a server once it's paired.

Add a server

On the new server, install WPGenie as a node (install.sh --agent), then run wpgenie agent pair-code and paste the code here with the server's address. The code works once, and proves to the panel it reached that server (and to the server that the panel is yours). Port 7443 must be open between the servers.

Name Address Public IP (optional: where sites' DNS points) Pairing code

Monitoring

Active alerts

Every minute WPGenie loads each live site through Caddy (down after a few failed checks in a row), checks the certificate every domain serves, the free disk space and the backups. Sites that never worked yet (DNS not pointing here) aren't judged.

History

Thresholds and notifications

Disk warning at (% used) Disk critical at (% used) Certificate warning (days left) Certificate critical (days left) Site down after (failed checks) Repeat firing alerts every (hours, 0 = never)

E-mail

Send alerts by e-mail

SMTP server Port Encryption Username Password From To (comma-separated)

Webhooks

JSON POST with a text field (Slack, Mattermost), content (Discord) and the alerts, signed: X-WPGenie-Signature: sha256=HMAC(secret, X-WPGenie-Timestamp + "." + body). URLs and secrets are never shown again.

Prometheus

Metrics for Prometheus at /metrics: traffic, PHP response times, replicas and load, uptime, certificates, disk, memory, backups, shield and jobs. Scrapes need their own token (read-only; the API token doesn't work there).

System

esc

↑↓ to move · ↵ to open · type a domain then a section, e.g. north back