Frequently asked questions
Answers to the questions we get most. Missing yours? Open a ticket.
Plans & pricing
Do I need a separate licence for the WP Tender Agent?
No. The Agent is the WordPress plugin the Manager talks to — it has no separate licence, no free / pro tiers, no checkout. It's bundled with every WP Tender plan (Free included). Install it on as many sites as your plan's site cap allows.
What does the 7-day Pro trial include?
Every WP Tender Pro feature, capped at the Pro plan's site limit (25 sites). No credit card. After 7 days you pick a plan or your account drops back to Free.
How is billing tiered?
WP Tender is billed per-organization. One subscription covers up to N sites depending on tier — Free 5, Starter 5, Pro 25, Agency 100. Each tier also has a monthly support-ticket quota. See pricing for the full grid.
Can I cancel anytime?
Yes. Card-on-file cancellations are immediate; you keep access until the end of the paid period. No refund for partial months.
Where can I get an invoice?
From the Subscriptions page → Manage billing. That opens the Freemius customer portal where invoices are downloadable as PDF.
Security
How is the activation token stored?
The activation token the Agent uses to talk to the Manager is encrypted at rest with AES-256-GCM using a server-side key (SECRET_KEY). Even with full DB access, an attacker can't use the token without the key file.
Does the Manager have access to my WordPress admin password?
No. The only credential is the per-org activation token paired with each site's ops token. We never see or store WordPress passwords.
Where do my backups actually live?
On your own WordPress sites — in wp-content/uploads/wptp-backups/ by default, or in your own S3 / R2 / Drive bucket if you wire a cloud destination. The Manager only stores metadata (jobs, timestamps, sizes) and optional homepage screenshots. We never store your backup archives on Manager servers.
Are SSRF / private-network requests blocked?
Yes. The Agent's outbound calls refuse RFC1918, loopback, link-local and cloud-metadata IP ranges by default. There's a dev-only env var to relax this for local testing.
Cloudflare in front?
Yes — full-strict mode with a 15-year origin certificate. Direct-to-origin connections fail TLS validation, forcing all traffic through Cloudflare (DDoS, WAF, bot management). HSTS preload + 2-year max-age.
Hosting compatibility
Will the Agent work on WP Engine / Kinsta / Pagely?
Yes. You may need to whitelist /wp-json/wpt/* in their WAF / firewall settings. Some managed hosts disable file_get_contents to remote URLs — replication needs it enabled.
Shared hosting?
Works in most cases but slow for backups of large sites — shared hosts often have aggressive PHP timeouts (30s) and small memory limits (128 MB). For sites over 1 GB consider a VPS.
WordPress multisite?
The Agent supports backing up the whole network or individual subsites. The Manager treats each subsite as a separate site, so you'd need one activation per subsite.
Minimum WordPress / PHP versions?
WordPress 5.6+, PHP 7.4+. We test against PHP 8.1, 8.2, 8.3. PHP 8.4 should work but isn't officially tested yet.
Operations
How often does WP Tender pull data from each site?
Live ping every 60 seconds (up/down + plugin presence). Full metrics every 5 minutes (CPU, RAM, disk, versions). Screenshot every 15 minutes by default. All intervals are configurable per site.
Can I restore a backup to a different domain?
Yes — that's the site-to-site migration flow. The destination site's siteurl is automatically used; search-replace runs on the database after restore.
How are Agent updates rolled out?
From the Manager's Integrations tab. When a new Agent build ships, you'll see an Update available badge — click Push to all sites and the Manager rolls it out over the existing ops-token channel. No WordPress.org channel, no per-site ZIP upload. You can also push to a single site from its detail page if you want to stage the rollout.
What happens to my data if I cancel WP Tender?
Your WordPress sites are untouched — the Agent keeps running, backups continue, and restores continue to work from the WP admin. You lose the multi-site dashboard, scheduled-backup push, and audit log on the Manager side. The activation token on each site stays valid until you remove the plugin or rotate the token from the Manager.
Can I export my data before cancelling?
Yes. From the Manager: Settings → Export everything downloads a JSON archive of every site, job, metric, screenshot, ticket, and audit event.
Migration & replication
What is site-to-site migration?
One-shot copy — take a backup of site A, ship it to site B, restore. Use for: moving hosts, dev → staging → prod, cloning a site. Both sites must have the Agent installed and be paired with the Manager.
Will migration overwrite my target site?
Yes, by design — the target's database and wp-content are replaced. Don't point migration at a target you care about. Use the staging restore option if you want to land on a separate disk first.
Misc
Can I host the Manager myself instead of using wptender.com?
Enterprise plan only. Includes on-prem Docker image + initial deployment support. Contact sales.
Is the source code open?
The WP Tender Agent is licensed under GPLv2-or-later (per WordPress.org rules); source ships with the plugin. The Manager SaaS itself is proprietary; not open-sourced.
Roadmap?
- Public REST API for tenant automation
- SSO (SAML, Google Workspace, Microsoft 365) on Agency+
- Mobile companion app (read-only first, alerts, on-call rotations)
Vote on the roadmap via support tickets.