MainWP Dashboard¶
Purpose¶
The MainWP Dashboard is the WordPress fleet control plane (~50 sites): site health, backups, and Safe Updates. Child sites are managed from the Dashboard. The Dashboard plugin is not installed on a client site.
Daily monitoring that used to run on ManageWP is the same job on MainWP: notifications, failed backups, connection errors, vulnerabilities, and whether Safe Updates finished.
Audience¶
Website managers and developers who apply updates. Support tickets for failed jobs or down sites are created on GitHub (MD-n).
Access / URL¶
| Surface | URL | Notes |
|---|---|---|
| wp-admin | support.mindfuldesign.me | Cloudflare Access OTP, then WordPress login |
| MCP | support.mindfuldev.one | MCP stays on this hostname. Do not point MCP at the Cloudflare URL |
Never commit Application Passwords or MCP credentials.
How it works¶
The Dashboard runs MainWP Safe Updates (private repo). Prefer the plugin’s Safe Update buttons / schedules over raw “update plugins” on production.
| Path | What happens |
|---|---|
| Safe Update (default) | Scoped Updraft backup → visitor maintenance (503) → apply on live → purge caches → HTTP/HTML probes → rollback on fail |
| Advanced | New WP Staging clone (mdsu…), probe the clone, then live. Used for high-risk slugs when WP Staging is installed. Jobs do not refresh old clones |
High-risk examples: WooCommerce, SEO, cache plugins, page builders, security, WordPress core, The Events Calendar, Edwiser Bridge.
Core is off by default in Include settings.
Live vs staging¶
| Site size | Where to Safe Update first |
|---|---|
| Small | Main / live site first (still via Safe Update) |
| Large (e.g. FDCW, EdMa, SWL) | Staging first, then live |
Developer sandboxes (MainWP Clone onto a separate WordPress) are not staging. They must stay tagged dev-sandbox and are excluded from schedules / Safe Update All.
Child site requirements¶
| Component | Why |
|---|---|
| UpdraftPlus | Backup / restore for Safe Update |
MainWP Safe Updates Helper (mdsafe-helper.php) |
Visitor 503 + cache purge. Jobs fail if it is missing — maintenance is never skipped |
| WP Staging (+ MainWP Staging add-on on the Dashboard) | Only required for Advanced / high-risk sites |
Install the helper on children (MainWP → Install plugin). Install the Dashboard plugin only on the Dashboard.
Schedules and email¶
- Fleet jobs stagger; a small number of sites run at once (Dashboard setting).
- One digest email per finished job; immediate email on failure.
- Do not run Hostinger “Safe Updates” (or raw
update_site_*tools) on the same slugs while a Safe Update job is in flight.
Day-to-day procedures¶
Morning checks¶
- Notifications / site connection errors
- Safe Update jobs finished (or failed — read the job email)
- Outstanding plugin / theme / translation updates that were missed
- Vulnerabilities (Patchstack / Wordfence / RSS as configured)
- Failed UpdraftPlus backups
Recurring GitHub issues on the Recurring column of Mindful Support often point here. Log time in Kimai on the matching client.
If a Safe Update fails, do not retry blindly — follow the manual process and open or update an MD-n ticket.
Manual update (when Safe Update fails)¶
- Take a fresh staging copy if the clone is over ~30 days old — confirm staging is not in use.
- Update plugins on staging.
- Test — especially Elementor, The Events Calendar, WooCommerce, LearnDash.
- If clean, update live. For store / LearnDash: maintenance mode; no customers on the site mid-update.
- Complicated updates: outside office hours.
- If unsure, Team Lead or Manager.
After an update looks broken¶
- Clear site cache (LiteSpeed, NitroPack, …).
- Clear server cache.
- Elementor: turn off performance experiments if they fight the new plugin set; clear Elementor cache and regenerate CSS.
- If a header/footer template is wrong: Edit with Elementor, tiny change, change back, Publish.
- If it still fails: restore the backup / rollback and record it on the GitHub issue.
Critical vulnerability¶
- Exploitable → fix immediately (P1).
- Cannot fix → remove the plugin and find an alternative.
- Cannot remove yet → confirm RSS / Wordfence / Patchstack are on, then replace as soon as possible.
- Unsure → manager.
Automation / Cursor¶
Developers with Dashboard access use MainWP MCP against https://support.mindfuldev.one. Do not point MCP at support.mindfuldesign.me. Application passwords stay in local MCP config. Prefer Safe Update jobs over raw plugin-update tools. Plugin details: MainWP Safe Updates AGENTS.md.
Sources of truth¶
| Data | System |
|---|---|
| Site control, updates, backups | MainWP Dashboard |
| Failed job / down site as work | GitHub support ticket (MD-n) |
| Time spent | Kimai |
Related systems¶
- Support tickets
- Kimai (time)
- mainwp-safe-updates (private)
Gotchas¶
| Do | Don’t |
|---|---|
| Use Safe Update on the Dashboard | Install the Dashboard plugin on a child |
| Helper + Updraft on every child | Skip maintenance mode on large Woo/LMS updates |
| Ticket failures on GitHub | Leave a failed job undocumented |
| Staging first on large sites | Refresh random old WP Staging clones as the happy path |
MCP on support.mindfuldev.one |
Point MCP at the Cloudflare Access hostname |