WP Tender for macOS

A real desktop client for the same WP Tender account you use in the browser and on your phone. It exists for the work that wants a big window and a real file system: reading a 200-site fleet at a glance, pulling a backup archive onto the machine you are about to restore from, and printing a month of client reports.

1. Install

The app ships as a notarized DMG downloaded from wptender.com. It is not on the Mac App Store — the app writes files where you choose and talks to your own hosting, so it lives outside the store sandbox.

1. Download the build for your Mac. There are two: Apple Silicon (M-series) and Intel. If you are not sure, check Apple menu → About This Mac.
2. Open the DMG and drag WP Tender onto the Applications shortcut in the same window.
3. Eject the disk image and launch WP Tender from Applications or Spotlight.

The build is signed with an Apple Developer ID certificate, runs under the hardened runtime and is notarized by Apple, so Gatekeeper opens it on first launch — no right-click → Open, no security warning to click past. The window opens at 1280×840 and can be taken down to 940×600; the macOS traffic lights sit over the top of the sidebar, which is also the drag region for the window.

2. Sign in, sign up, reset a password — all in the app

Sign in with the same email and password as wptender.com. Same organization, same sites, same plan — the desktop app is another client, not another account.

Everything around sign-in is handled without leaving the window:

• New account — the sign-up form asks for your name, your organization (that name is what clients see on reports), email and a password with a live strength meter that tells you which rule is still unmet. Sign-up never signs you straight in; the app swaps the form for a “confirm your email” panel.
• Confirming an address — open the link from the email on any device, or paste the whole link into the app’s confirmation screen and it pulls the token out for you. A confirmed address is signed in immediately rather than bounced back to the sign-in form. Expired, already-used and unreadable links each get their own explanation and a way to send yourself a fresh one.
• Forgot password — request a link, then paste it back into the app and set the new password; you land signed in. The request always reports the same result whether or not an account exists, so it cannot be used to fish for addresses.
• Unconfirmed sign-in — signing in with an address that was never confirmed shows an explanation and a Resend verification email button instead of a raw error.

A brand-new organization lands on the plan picker before the dashboard. Once you are in, the session token is stored encrypted on the Mac through the system keychain, and every network call runs in the app’s main process — the window itself never holds the token.

3. The sidebar

Team only appears for owners and admins. The sidebar footer carries your organization name, the signed-in address, a plan pill, Sign out, and a theme button that cycles Light → Dark → High contrast → System.

Just above the footer, an active jobs pill appears whenever something is queued or running — click it for a popover listing each job with its site, type, status, age and a progress bar, plus View all jobs →. It disappears when the fleet is idle rather than sitting there reading “0 active”.

4. The fleet dashboard

The dashboard is built for a wide window. Four counters run across the top — Sites, Online, Warning, Offline, plus Unknown only when a site has never reported — followed by the fleet overview card (status and version distribution, backup recency, plan usage, licence state).

Below that, every site is a card, not a table row — two or three per row depending on the window. Each card carries:

• A home-page screenshot banner with the status pill over it, so a defaced or blank site is obvious without opening anything. Hover for a button that opens the site in your browser.
• Site name and host, plus the last error underneath when there is one.
• A metric strip: WordPress version with PHP under it, a disk bar with percent used, and the age of the last backup.
• Live CPU and RAM bars. CPU is the 1-minute load normalised by core count. RAM prefers the PHP memory limit over host RAM — a shared host may have 64 GB of RAM while PHP is capped at 256 MB, and it is the cap that actually takes the site down. Bars turn amber above 75% and red above 90%.
• A footer with the pair badge, free disk and when the site was last seen.

A site that is unreachable does not keep showing its last reading as if it were current — the bars are replaced with “Metrics paused while the site is unreachable.”

The header carries a filter box (it appears once you have more than four sites), Select, All sites, and the refresh-interval control — Manual, 3s, 5s, 15s, 1m or 5m, defaulting to 15s, remembered between launches, with a refresh-now button beside it.

5. Bulk actions

1. Click Select. Each card gets a checkbox on its preview.
2. Tick sites. If the filter box is in use, select-all applies to what is on screen — narrowing the list and then selecting everything does not quietly take the whole fleet.
3. A pill bar floats up from the bottom of the window with Bulk backup, Bulk restore, Install plugin, Migrate and Delete sites.

• Bulk backup — one type for the whole selection: Full, Database or Media only.
• Bulk restore — a two-step wizard: confirm the paired sites, then pick which archive each one restores from (the newest is preselected). Restores run as an overwrite, and sites with no backups are skipped.
• Install plugin — needs paired sites; with nothing selected it targets every paired site, and the modal stays open after a run so the per-site results stay readable and a second plugin can follow.
• Migrate — one source site at a time, so it is enabled only with exactly one site selected.
• Delete sites — removes them from WP Tender; the WordPress installs are untouched.

Results land in a banner at the top of the dashboard, including which sites failed and why.

6. Opening a site

Click a card. The site header gives you the name, the URL as a button that opens it in your browser, status and plan badges, a per-site colour theme picker, and the actions: Report (this month’s PDF), Refresh, Pull now (ask the agent for fresh status and say what came back), Unpair and Delete site.

Under it sits the same grid of live section cards the phone app uses — each one fetching its own summary so you can read the state before drilling in — grouped into Health (Overview, Events, Log Manager, Debug Log), Backup & recovery (Backups, Cloud, Migration, Replication), Manage (Plugins, Themes, Posts, Pages, Users, Comments) and Configure (Notifications, URL Replace). Click a card to open that section, and the link at the top takes you back to the grid.

Sections your plan does not include show the upgrade card in place of the controls, so you never walk into an unexplained refusal. If the agent link is broken — credentials rejected, site unreachable — a banner says so instead of every card quietly reading “unavailable”.

7. Downloading a backup to disk

This is the thing a desktop app can do that a browser tab cannot do cleanly. Open a site → Backups → Download on any archive:

1. A standard macOS save panel opens, pointed at your Downloads folder with the archive’s own filename.
2. Pick where it goes. The app streams the file straight from the API to disk — it is never buffered whole in memory, so a multi-hundred-megabyte full backup is fine.
3. A banner reports the exact path it saved to, or the reason it failed. Cancelling the save panel is silent, because you meant it.

The request is authenticated in the app’s main process, where the session token lives. That is why the download works at all: a plain link out of the window would arrive at the API with no session and hand you an error page instead of a plugin archive.

The same row also offers:

• Restore — Overwrite or Merge, with an optional safety backup taken first.
• Upload to cloud — duplicates the archive to a connected Google Drive, Amazon S3 or Cloudflare R2 destination. The transfer runs on the WordPress site, so it is followed by a live cloud-jobs panel that reports the real outcome rather than declaring success the moment the job is accepted.
• Delete — removes the .zip on the WordPress server.

8. Reports & the print view

The Reports screen lists every site with activity in the selected month. Months are built in your organization’s timezone with the last twelve offered, so a Mac in another zone cannot ask for a month the server disagrees is current. Per row you get the event count, the three busiest buckets, and three actions: Open, Email and PDF. A bundle button downloads every site’s report for the month as one ZIP.

PDFs and the ZIP go through the same authenticated save panel as backups, and the same rule applies: cancelled is silent, everything else is reported. If the server has no PDF renderer available, the failure banner offers Open print view — because the app can produce the same document itself.

The print view

Open a site’s report and press Print view. The report is laid out in an 820px A4 column over the whole window, and Print / Save as PDF hands it to the macOS print dialog — where Save as PDF gives you the same artefact the server would have rendered. Escape closes it.

The builder

Above the rendered report, owners and admins get the composer: a Monthly / Weekly toggle and period picker, toggles for which sections appear, a picker for the headline numbers, a note to the client, and your own titled sections. Generate report saves all of it in one call, and the rendered report, the print view and the PDF all pick it up.

9. Adding a site

1. Sites → Add site (owners and admins). Display name, site URL and optional notes.
2. Continue to pairing shows your organization’s activation token with a copy button — the same wpt_… token as the Integrations screen.
3. Install the WP Tender Agent on the WordPress site, paste the token under WP Admin → WP Tender → Settings and press Save & Verify.
4. The dialog polls every few seconds and opens the site as soon as the agent checks in.

If you are at your plan’s site cap, the dialog says so and links to the upgrade page instead of failing the save.

10. The rest of the sidebar

Jobs

Every backup, restore, cloud transfer, migration, replication and screenshot across the fleet, with the same refresh-interval control the dashboard uses.

Integrations

The shipped Agent version and installation count, the pairing token with rotate, and the list of active installations with their versions and last verification.

Support

Your ticket threads, with replies and JPEG screenshot attachments; uploads are sent through the main process for the same reason downloads are. Opening a ticket spends one support credit and covers a single site — tickets are not bundled with any plan.

Team

Owners and admins on Pro and above scope teammates to specific capabilities on specific sites.

Subscription

Plan, status, renewal and usage. Checkout opens in your default browser rather than inside the app window.

Settings

Appearance, your profile, password, the organization, the manager-managed cron pulse per site, outbound SMTP, report branding (name, accent colour, logo, footer) and account deletion. Sections your plan does not cover are shown locked with a link to upgrade, so you can always see what is on the other side.

11. One account, three clients

The desktop app talks to the live wptender.com API — the same one the web dashboard and the iPhone app use. A backup you start on the Mac appears in Jobs in the browser; a report you compose on the phone is the one the Mac prints. Nothing is cached in a separate desktop database: the only things stored on the machine are the encrypted session token and the files you deliberately save. Sign out removes the token from the Mac and leaves your other sessions alone.

See also: Using the Manager · The iPhone app · WP Tender Agent · FAQ.