Skip to content
Manager for Craft

Security

Our security model: no shared passwords, no SSH access, no site database credentials

A tool watching multiple client sites is worth attacking, so Manager for Craft is built to hold as little as possible. It never receives a Craft administrator password, an SSH credential or a site database password.

You do not have to take that on trust. The control plane is public under AGPL-3.0-or-later, the security commitments are numbered, and there is one test file per commitment, named after the commitment it protects. Read the source.

Connected carefully

Manager for Craft is designed as a security-sensitive control plane, with outbound connections, isolated site credentials and explicit capabilities.

A connector, not a back door

The connector reports approved operational information and performs only explicitly enabled jobs. It cannot run arbitrary PHP, shell commands or SQL.

  • Does: The connector initiates all outbound communication.
  • Cannot: No Craft administrator passwords are required.
  • Cannot: No SSH credentials are required.
  • Does: Monitoring is read-only by default.
  • Does: Backup permission is enabled separately, per site.
  • Does: Every important action is recorded in the activity log.
  • Does: Credentials can be rotated or revoked at any time.
  • Does: Each site receives its own isolated credentials.
  • Cannot: Arbitrary PHP, shell commands and SQL cannot be executed.
  • Does: Manager collects operational metadata, not website content.

Connection direction

  1. Craft site

    craft 5.6.4 · php 8.1.14

  2. Manager Connector

    read-only · capabilities: metrics, updates

  3. Manager Cloud or Manager Self-Hosted

    operational metadata only

Manager opens no inbound access to the Craft installation. Nothing is exposed for Manager to reach into: the connector calls out, and the connection can be revoked from either end.

Find the sites that need patching first

Eighteen rules run against every report a site sends, plus one check Manager makes itself. A Craft security release still outstanding opens a critical finding. Dev mode in production, HTTPS not enforced, end-of-life PHP, a disk filling up and a TLS certificate that did not renew each open one of their own.

Findings carry first and last detected dates, and close themselves when the next report shows the site is fixed. You can acknowledge one you have decided to live with, which takes a password confirmation and a reason, so nothing quietly disappears from the list.

See all eighteen rules

Critical Craft security release outstanding First detected 14 Jul · last seen today

craftcms/cms 5.6.4

Craft flags 5.7.1 as a critical release. Three sites are still on a version below it.

Installed
5.6.4
Available
5.7.1
Affected sites
3
Review finding Acknowledge See affected sites

No release notes are stored. They describe the unpatched vulnerability, and they do not belong next to a list of sites that have not been patched yet.

Database backups, without sharing database credentials

Daily or weekly, per site, at an hour you choose. Craft takes the backup, the connector encrypts it on your own server, and what reaches storage is sealed to recovery keys you hold. How backups work in full.

  1. 01 A schedule comes due, or you ask, for an authorised site.
  2. 02 The connector asks Craft to create it.
  3. 03 The dump is encrypted on your server, then uploaded.
  4. 04 Manager verifies the artefact and applies retention.
  • Off until you turn it on, per site
  • Daily or weekly, at an hour you pick
  • Retention by period, set per site
  • Encrypted before it leaves your server
  • Sealed to recovery keys you hold
  • S3-compatible destinations
  • Failure notifications
  • Checksums and verification
Backup history · example-site.com Daily 03:00 · 30 days, 4 weeks, 12 months
Recent backup runs for example-site.com
Run Result Size Checksum
Today 02:15 Failed n/a timeout after 240s
Yesterday 02:15 Verified 412 MB sha256 9f3c…41ab
28 Jul 02:15 Verified 409 MB sha256 71de…c802
27 Jul 02:15 Verified 407 MB sha256 2ab8…5f19
26 Jul 11:40 Manual 406 MB sha256 c410…88d7

Artefacts are encrypted on your server before upload to your S3-compatible destination. The site's database password never leaves it.

See what changed and who handled it

Manager records every action across the organisation: findings opened and acknowledged, backups completed, connectors paired, capabilities granted and credentials rotated. Each entry carries who did it, when, and from where.

The log is append-only and the database itself rejects an attempt to change it, so it still answers the question six weeks later. You can also pin a note to a site, for the context a log entry cannot hold: PHP stays on 8.2 until the payment gateway is replaced.

How the audit log works

  1. 09:12 Finding opened · Craft security release outstanding on 3 sites System
  2. 09:40 Finding acknowledged · scheduled for Thursday release A. Mercer
  3. 10:02 Backup capability granted · example-site.com A. Mercer
  4. 10:03 Connector credentials rotated · example-site.com A. Mercer
  5. 11:20 Connector paired · brackenfield.co.uk (staging) J. Okafor
  6. 13:45 Backup completed and verified · 412 MB System
  7. 16:08 Finding resolved · disk usage back under 80 per cent System

See all your sites in about five minutes

Add a site, install the connector with Composer, paste the one-time code. The control panel updates within minutes. Fourteen days free, no card required, and nothing on your sites changes.

Start free trial Read the setup guide

Craft CMS 4.4 and later