WordPress connector + hosted dashboard

Manage every WordPress site from one dashboard.

Install one lightweight connector, paste a Site Key, and run updates, backups, snapshots, security hardening, SEO, and user management across all your sites — without logging in to a single wp-admin.

Start free See how it works
  • Connector is free & GPL
  • No dashboard clutter in wp-admin
  • Disconnect any time
atomic-site-manager-web.vercel.app / sites
Your sites 4 connected
  • A atomicelements.io WP 6.9 · PHP 8.3 · heartbeat 12s ago Healthy
  • S studio-caliph.com WP 6.8.1 · PHP 8.2 · heartbeat 41s ago 7 updates
  • O oyorox.com WP 6.9 · PHP 8.3 · heartbeat 8s ago Backup running
  • M shop.mydemo.dev WP 6.9 · PHP 8.1 · heartbeat 19s ago Healthy
23Updates queued
12Snapshots
98Health score
60+Remote commands
60sDefault heartbeat
3Built-in engines
1Settings page in wp-admin
Three steps, about two minutes

Connect a site, then never open its wp-admin again

Atomic Site Manager is a connector. The plugin registers your site, sends a heartbeat, and runs the commands you queue. Every dashboard, report, and history screen lives in the web app.

  1. 01

    Install the connector

    Add Atomic Site Manager from Plugins → Add New and activate it. It ships idle — nothing is sent anywhere yet.

  2. 02

    Paste your Site Key

    Create the site in your dashboard, copy its Site Key, and paste it under Settings → Atomic Site Manager. Click Connect.

  3. 03

    Run everything remotely

    The site starts sending heartbeats and polling for work. Queue a command in the dashboard and it executes on the site within seconds.

# Optional — point a staging install at a different backend (wp-config.php) define( 'ASMS_SERVER_URL', 'https://api-staging.example.com' ); define( 'ASMS_DASHBOARD_URL', 'https://app-staging.example.com' );
One connector, twelve jobs

Everything routine, handled from the outside

The work you repeat on every site — updating, backing up, hardening, auditing — collapses into a single queue you drive from one place.

Updates & inventory

Install, update, activate, deactivate, and delete plugins and themes. Update WordPress core and translations. Every install's full inventory stays current with each heartbeat.

Backups & restore

Create, restore, and delete database and uploads backups. Archives are written to wp-content/asm-backups on your own server — never uploaded to the service.

Configuration snapshots

Take a snapshot before a risky change, compare it against the live state, and restore it if things go sideways. Rename and export snapshots as JSON.

Security hardening

Disable XML-RPC and the file editor, block author enumeration and user REST endpoints, strip version strings, send security headers, and lock down directory listing.

Built-in SEO engine

Titles, descriptions, Open Graph and Twitter cards, schema, breadcrumbs, sitemaps, redirects, and 404 tracking. Off until you switch it on — so it never fights your existing SEO plugin.

Health monitoring

A heartbeat every 60 seconds carries WordPress, PHP, MySQL, and server versions, memory and disk usage, debug and SSL state, and every pending update.

Users & roles

Create, edit, and delete users and roles across sites. Reset roles to WordPress defaults or clear every active session in one command.

Options & database

Read and update options, browse database tables, insert, edit, and delete rows, run table actions, and flush object and page caches — all remotely.

Static plugin checks

Run the built-in plugin checker against anything installed and read the findings in the dashboard — no separate testing plugin to install and maintain.

Performance audits

Run an audit on demand and get back the metrics that actually move: memory headroom, disk pressure, cache state, and the config choices dragging the site down.

One-click admin login

Jump straight into wp-admin from the dashboard for users you authorize there — no shared passwords, no password manager round trip.

Automation toggles

Turn background updates on or off and control traffic-triggered WP-Cron spawning per site, so scheduled work runs the way your hosting expects.

Updates & inventory

Patch forty sites in the time it takes to log in to one

Every heartbeat brings back the complete plugin, theme, core, and translation picture for the site. Pending updates surface in one list — select, queue, done.

  • Full inventory — names, slugs, versions, authors, and active state for every plugin and theme.
  • Core, plugins, themes, translations — all four update channels handled from the same queue.
  • Results reported back — every command returns its outcome and any error message to the dashboard.
  • Collections — apply a saved set of plugins to a fresh install in one action.
studio-caliph.com / updates
Pending updates 7 available
  • W WordPress core6.8.1 → 6.9 Queue
  • E Elementor3.27.4 → 3.28.0 Queue
  • W WooCommerce9.4.2 → 9.5.1 Updating…
  • T Translations4 language packs Queue
Backups & snapshots

An undo button for changes you haven't made yet

Backups capture the database and uploads. Snapshots capture configuration — so you can diff exactly what a plugin update changed and roll just that back.

  • Stored on your server — in wp-content/asm-backups. Archives are never uploaded to the service.
  • Snapshot compare — see what moved between two points in a site's configuration.
  • Recovery restore — bring a site back from a snapshot or backup without touching SFTP.
  • Reset tools — clear options, users, roles, sessions, and media when you need a clean slate.
oyorox.com / snapshots
Snapshot compare 3 differences
— before-woo-9.5.1 + live + active_plugins[] woocommerce/woocommerce.php ~ permalink_structure /%postname%/ → /shop/%postname%/ ~ woocommerce_calc_taxes no → yes
12Snapshots kept
4DB backups
2.1 GBUploads backup
Security & SEO engines

Two engines built in, both switched off until you say so

Hardening and SEO ship inside the connector, so there's no extra plugin to install, license, or keep updated. Neither one touches your site until you enable it.

  • Hardening — XML-RPC off, file editor blocked, author enumeration and user REST blocked, version strings stripped, security headers sent.
  • SEO — titles, meta, Open Graph, Twitter cards, schema, breadcrumbs, sitemaps, robots.txt, redirects, and 404 logging.
  • Import from All in One SEO and bulk-edit titles, so switching over isn't a week of manual work.
  • Optional IndexNow ping — notify Bing, Yandex, Seznam, Naver, and Yep the moment a post is first published.
atomicelements.io / security
Hardening 6 of 8 on
  • ✓Disable XML-RPCxmlrpc_enabled → falseOn
  • ✓Block file editoredit_plugins, edit_themesOn
  • ✓Block author enumeration?author=N redirectsOn
  • ·Disable application passwordswp_is_application_passwords_availableOff
  • ✓Send security headersX-Frame-Options, nosniff, referrerOn
The full command surface

Sixty-plus commands you can run without opening wp-admin

Queue any of these from the dashboard. The connector picks it up on the next poll, runs it, and reports the result back — success or error.

PLUGIN_INSTALLPLUGIN_UPDATEPLUGIN_ACTIVATE PLUGIN_DEACTIVATEPLUGIN_DELETEPLUGIN_LIST PLUGIN_CHECKTHEME_INSTALLTHEME_UPDATE THEME_ACTIVATETHEME_DELETETHEME_LIST CORE_UPDATECORE_VERSIONTRANSLATION_UPDATE TRANSLATION_LISTCOLLECTION_APPLYCOLLECTION_LIST
BACKUP_CREATEBACKUP_RESTOREBACKUP_DELETE SNAPSHOT_CREATESNAPSHOT_COMPARESNAPSHOT_RESTORE SNAPSHOT_EXPORTSNAPSHOT_RENAMESNAPSHOT_DELETE SNAPSHOT_LISTRECOVERY_RESTOREDB_TABLES DB_TABLE_BROWSEDB_TABLE_ACTIONDB_ROW_INSERT DB_ROW_UPDATEDB_ROW_DELETEDB_SECTION_RESET OPTIONS_GETOPTIONS_UPDATEOPTIONS_RESET MEDIA_CLEANUPRESET_TOOLRESET_SITE
USER_CREATEUSER_UPDATEUSER_DELETE USER_LISTUSERS_RESETROLE_CREATE ROLE_DELETEROLE_LISTROLES_RESET SESSIONS_CLEAR
SEO_GETSEO_UPDATESEO_TOOL SEO_ANALYSIS_RUNSEO_REDIRECT_UPSERTSEO_REDIRECT_LIST SEO_REDIRECT_DELETESEO_404_LISTSEO_404_CLEAR
SITE_INFOCACHE_FLUSHPERFORMANCE_AUDIT SECURITY_HARDENING_GETSECURITY_HARDENING_UPDATEAUTOMATION_GET AUTOMATION_UPDATECUSTOM

Remote deactivate and delete of Atomic Site Manager itself is blocked in the command runner — the connector cannot be used to lock you out of your own site.

Data transparency

Exactly what leaves your site — and what never does

Nothing at all is sent until you paste a Site Key and click Connect. After that, here is the complete picture.

What the connector sends

On connect, on each heartbeat, after each command, and on disconnect.

  • Site name, URLs, locale, timezone, and multisite flag
  • WordPress, PHP, MySQL, and web server versions; WP_DEBUG and SSL state
  • Installed plugins and themes with names, slugs, versions, authors, active state
  • Available core, plugin, theme, and translation updates
  • Memory and disk usage, uploads path, and the active theme
  • User accounts and roles — login, email, display name, roles, registration date, up to 200 users
  • Command results and error messages from dashboard actions

What never leaves

Not on connect, not on heartbeat, not ever.

  • Post, page, and custom post type content
  • Comments
  • Media files and uploads
  • Passwords and password hashes
  • Visitor analytics or tracking data
  • Backup archives — those stay on your own server
Disconnect clears everything. Press Disconnect on the settings page — or revoke the site from the dashboard — and the connector wipes its stored credentials automatically. All requests use HTTPS; plain HTTP is accepted only for localhost and private LAN addresses so you can develop against a local backend. Read the full breakdown in our Privacy Policy.

Requirements

WordPress
6.5 or newer
PHP
8.1 or newer
Tested up to
WordPress 7.1
License
GPL-2.0-or-later
Multisite
Supported
Heartbeat
60s via WP-Cron
REST namespace
siteconnector/v1
External calls
HTTPS only
Pricing

The connector is free. You pay for the dashboard.

The WordPress plugin is GPL and costs nothing on every site you own. Plans are priced by how many sites you connect to the dashboard.

Solo

For the handful of sites you actually maintain yourself.

$0/ month

Up to 3 connected sites

Create account
  • Updates for plugins, themes, core, translations
  • 60-second health heartbeat
  • Database & uploads backups
  • Security hardening engine
  • Community support
Most popular

Studio

For freelancers and small agencies running client sites.

$19/ month

Up to 25 connected sites

Start free trial
  • Everything in Solo
  • Configuration snapshots & compare
  • Built-in SEO engine + IndexNow
  • One-click admin login
  • Plugin collections & static checks
  • Email support

Agency

For teams managing large portfolios with shared access.

$49/ month

Unlimited connected sites

Start free trial
  • Everything in Studio
  • Team seats & per-site permissions
  • Bulk actions across every site at once
  • Performance audits & reporting
  • Priority support
Questions

Before you connect your first site

Yes. The plugin is a connector for the Atomic Site Manager service and does nothing on its own. You need a Site Key from the dashboard before anything is sent or received. Without one, the plugin stays completely idle.

No. It adds exactly one settings page for connecting and disconnecting. No charts, no reporting screens, no admin notices. Every dashboard, command queue, report, and history view lives in the web app.

Yes. Atomic Site Manager never deactivates, blocks, or modifies another plugin. The built-in SEO engine is switched off until you enable it from the dashboard, so installing this alongside Yoast, Rank Math, or All in One SEO changes nothing on its own.

If you do enable it while another SEO plugin is running, both will output title, description, and Open Graph tags and search engines will see duplicates — so turn one of them off. Only one should be generating metadata.

No. Remote deactivate and delete of Atomic Site Manager itself is blocked in the command runner. Other plugins and themes can be managed remotely according to the permissions you set in your dashboard account.

Every 60 seconds by default, through WP-Cron, and the service can adjust that interval. You can also send one immediately from the settings page with Send heartbeat now.

In a wp-content/asm-backups folder on your own server. The plugin does not upload backup archives to the service — only the fact that a backup exists, and its size, is reported.

Page visits stop spawning WordPress cron, but direct or server-scheduled calls to wp-cron.php still run. Set up a real server cron job before turning this off, so scheduled posts, emails, and other plugin tasks keep working.

Only for localhost and private LAN addresses, so you can develop against a local backend. Any public backend URL must use HTTPS.

Stop logging in to twenty dashboards

Install the connector, paste one Site Key, and run the whole portfolio from a single screen.

Create your free account Read the setup guide

Free connector · GPL-2.0-or-later · Disconnect any time