Features
Sentro is built for the everyday work of maintaining a portfolio of WordPress sites. Here is what to expect from each part of it.
Sentro reads which core, plugin and theme updates are pending for every connected site, including the current and the new version. Pick what to update and run it per site or across several sites at once.
Every update can start with a restore point on the site itself and a screenshot of the page. Afterwards Sentro takes a second screenshot and compares the two, so a broken layout is caught before your client notices.
Trigger a full backup or a database-only dump and follow whether each attempt succeeded. Every backup shows its date, type, size and status.
Every site is polled at a fixed interval through a lightweight health endpoint. We record the response time and track when a site was unreachable.
Every site gets a public status page with its uptime history and current incidents, shared through a link. Your client checks the facts without needing an account.
Everything Sentro or a team member does lands in a chronological log, with the user's name and the time. That makes it easy to see afterwards who did what.
Every check looks at a fixed list of items that most often go wrong in practice. Each line has a status and a short explanation of what to do about it.
The connector scans core files, plugins and themes for malware patterns and unexpected changes. Scans run automatically every night and you can start one manually at any time.
Register the premium plugin and theme licences you manage, with their renewal dates. Sentro keeps the overview and emails you before a licence expires.
Put together a monthly report per client with the updates run, backups made, uptime and security status. On Pro and Lifetime you can add your own logo and colour.
Working with colleagues, you decide who can do what. Owners manage billing and keys, admins connect sites, and members carry out the maintenance work.
Group sites with your own tags: per client, per host or per maintenance window. Filter the site list by tag and run bulk actions for a whole group at once.
The connection runs through our own plugin with a locked-down REST namespace. Sentro reaches the site with signed requests, so you never share login details.
A management hub concentrates access: it knows every site, and it can change every site. That is why Sentro runs as a separate application with its own database instead of as a plugin inside another WordPress install.
Signed request from the hub to the site. The site never calls back.
A dashboard built as a WordPress plugin holds the keys to every client site inside a WordPress admin. That means a public login page, a plugin ecosystem around it, a theme layer, and an update cycle of its own — all of it in front of the credentials for every site you manage. One vulnerable plugin in that install is not one site’s problem, it is every site’s problem. Our hub is a separate application: no wp-admin, no public login for a WordPress instance, no third-party plugin code running next to your keys.
Each connected site gets its own signing secret. It is stored encrypted and is never displayed in the interface, never included in a report, and never exported — not for team members, not for us. Keys are scoped per site, so one revoked key affects one site and nothing else. A site owner can revoke or rotate the key from their own WordPress admin at any time, without asking us and without touching the other sites.
The hub calls the site; the site never calls back. Every request is signed with HMAC over the method, path, body, timestamp and a one-time value, so an intercepted request cannot be replayed. Requests are rate limited, and the connector only accepts what is signed with that site’s own secret. Within that, the site owner decides per site what is allowed: updates, plugin state, backups, scans. Anything not enabled is refused at the site, not merely hidden in the dashboard.
Because the hub is not running inside WordPress, checking a hundred sites does not depend on a PHP admin page staying open, on WP-Cron firing, or on one slow site holding up the rest. Checks run on their own schedule and monitoring keeps running, so an expired certificate, a failed update or a site going down surfaces when it happens instead of when someone opens a slow overview page.
This reduces the attack surface, it does not remove it. The connector’s permissions and the visible audit trail exist so a site owner can verify what happened.
The demo environment contains sample sites with updates, backups and alerts, so you can follow the workflow before connecting a site of your own.