Skip to content
Manager for Craft

Roadmap

What is not built yet

A product that publishes its source should publish its gaps. Two things below are missing and could reasonably exist one day. Four more will not be built at all, and those are the more important list, because they are what keeps Manager for Craft safe to point at every client site you look after.

Nothing here carries a date. If you need one of these to make a decision, tell us and it will count towards what gets built next.

Tell us what you need Open an issue

Not built yet

Happy to hear from you

We have a list of things we want to build, and a list of things we will not. We do not have a list of things we might. If you have a capability you would like to see, please reach out and tell us about it.

What you get today

We already have lots of features, and we are not going to build everything. We will not reach into your servers, we will not store your credentials, and we will not install updates or restore backups. If you want a capability that is not on the list above, please reach out and tell us about it.

Recently shipped

Both of these were on the list above. They are here rather than deleted, because how a roadmap empties is worth as much to you as what is on it.

  • TLS certificate monitoring

    Manager reads the certificate your visitors actually see, once a day, by opening a TLS connection to the site's own hostname. It is the one check the platform makes itself rather than waiting to be told, because TLS terminates at the edge and the connector cannot see what a browser validates. Expiry inside 30 days opens a finding, inside 7 days or expired raises it to high.

    How it works

  • Scheduled backups

    Daily or weekly, per site, at an hour you choose in your organisation's own time zone. The scheduler refuses rather than queues when there is no recovery key, no live connector, no granted capability, or a backup already outstanding for that site.

    How it works

Not on the roadmap, and not by accident

These four are design decisions rather than a queue. Each one removes a class of attack from the product, and adding any of them would mean Manager holding something worth stealing on behalf of every site you connect.

  • Installing updates

    An update is a deployment. On any Craft site worth managing, composer update is followed by migrations, a project config sync, a cache clear and somebody looking at the front end. A monitoring tool reaching in would bypass all of it. Installing also requires filesystem write access and command execution on forty servers, and a compromised Manager holding that becomes a supply chain.

  • Restoring a backup into a site

    Manager cannot write to your site. Retrieval is a command you run against storage, on a machine you choose, with a key we do not hold.

  • Running console commands or queries

    Three jobs exist and none of them takes a command, a path, a query or a URL. A build script fails if code capable of any of those appears in the connector.

  • Storing your credentials

    No Craft administrator password, no SSH key, no site database password. There is nowhere in the schema to put one, and a test walks the live database on every run to keep it that way.

All four are enforced rather than promised. The invariant suite has a file per commitment, named after the commitment it protects, and it runs on every change. Read the tests.

How this list changes

Nothing ships silently

Every release is tagged and listed publicly, with a checksum manifest and a software bill of materials attached.

Releases

You can see the work

The control plane and the connector are both public. What is being built is visible in the commits before it reaches this page.

Browse the repository

You can build it yourself

The control plane is AGPL-3.0-or-later. If one of these matters enough, fork it, or send the change back.

What is public

See all your sites in about five minutes

Add a site, install the connector with Composer, paste the one-time code. The control panel updates within minutes. Fourteen days free, no card required, and nothing on your sites changes.

Start free trial Read the setup guide

Craft CMS 4.4 and later