Skip to content
Manager for Craft

It holds nothing worth
stealing

A tool that watches forty client sites is an obvious target. So Manager was built to be a disappointing one: no administrator passwords, no SSH credentials, no site database passwords. There is nowhere in the schema to put them, and a test proves it on every run.

Connected carefully

Manager is designed as a security-sensitive control plane, with outbound connections, isolated site credentials and explicit capabilities.

A connector, not a back door

The connector reports approved operational information and performs only explicitly enabled jobs. It cannot run arbitrary PHP, shell commands or SQL.

  • Does: The connector initiates all outbound communication.
  • Cannot: No Craft administrator passwords are required.
  • Cannot: No SSH credentials are required.
  • Does: Monitoring is read-only by default.
  • Does: Backup permission is enabled separately, per site.
  • Does: Every important action is recorded in the activity log.
  • Does: Credentials can be rotated or revoked at any time.
  • Does: Each site receives its own isolated credentials.
  • Cannot: Arbitrary PHP, shell commands and SQL cannot be executed.
  • Does: Manager collects operational metadata, not website content.

Connection direction

  1. Craft site

    craft 5.6.4 · php 8.3.14

  2. Manager Connector

    read-only · capabilities: metrics, updates

  3. Manager Cloud or Manager Self-Hosted

    operational metadata only

Manager opens no inbound access to the Craft installation. Nothing is exposed for Manager to reach into: the connector calls out, and the connection can be revoked from either end.

Find vulnerable dependencies before they are forgotten

Craft security releases, plugin advisories and Composer package advisories are matched against the versions actually installed on each site, with severity, evidence, fixed versions and remediation guidance.

Findings carry first and last detected dates, and can be acknowledged or recorded as accepted risk with a reason, so nothing quietly disappears from the list.

High Vulnerable Composer dependency First detected 14 Jul · last seen today

guzzlehttp/psr7 2.6.1

Affected by a published request-smuggling advisory. Upgrade to 2.7.0 or later.

Installed
2.6.1
Fixed in
2.7.0
Affected sites
3
Review finding Acknowledge See affected sites

Database backups, without sharing database credentials

  1. 01 Manager schedules an authorised backup.
  2. 02 The connector asks Craft to create it.
  3. 03 The backup is encrypted and uploaded.
  4. 04 Manager verifies the artifact and applies retention.
  • Optional per site
  • Configurable schedules
  • Configurable retention
  • Encrypted storage
  • S3-compatible destinations
  • Backup history
  • Failure notifications
  • Checksums and verification
Backup history · northgatetrust.org Daily 02:15 · keep 14
Recent backup runs for northgatetrust.org
Run Result Size Checksum
Today 02:15 Failed n/a timeout after 240s
Yesterday 02:15 Verified 412 MB sha256 9f3c…41ab
28 Jul 02:15 Verified 409 MB sha256 71de…c802
27 Jul 02:15 Verified 407 MB sha256 2ab8…5f19
26 Jul 11:40 Manual 406 MB sha256 c410…88d7

Artifacts are encrypted before upload to your S3-compatible destination. Production database passwords stay on the site.

See what changed and who handled it

Manager keeps an activity history across the organisation: findings opened and acknowledged, backups completed, connectors paired, capabilities enabled and credentials rotated.

Findings can be assigned so it is clear who is looking at what, without turning Manager into a project tracker.

  1. 09:12 Finding opened · guzzlehttp/psr7 advisory matched on 3 sites System
  2. 09:40 Finding acknowledged · scheduled for Thursday release A. Mercer
  3. 10:02 Backup capability enabled · northgatetrust.org A. Mercer
  4. 10:03 Connector credentials rotated · northgatetrust.org A. Mercer
  5. 11:20 Connector paired · brackenfield.co.uk (staging) J. Okafor
  6. 13:45 Backup completed and verified · 412 MB System
  7. 16:08 Issue resolved · SSL certificate renewed J. Okafor

Keep every Craft site in view

Add your sites, connect the plugin and see what needs attention.

Start with Manager Cloud Self-host Manager

Built for Craft CMS 5 and later. Read-only monitoring by default.