Skip to main content
MainWP uses multiple layers of security to protect communication between your Dashboard and Child Sites. This includes secure initial connections when adding sites and encrypted, signed requests for all subsequent communication.

​
What You’ll Learn

  • How MainWP secures the initial site connection
  • How Dashboard-to-Child communication is encrypted
  • How request authentication prevents unauthorized access

​
Initial Connection Security

MainWP 5.3 introduced enhanced security features for the site connection process.

​
Password Authentication

MainWP uses the WordPress administrator’s password for verification during initial setup. This feature, enabled by default, ensures only verified administrators can authorize connections.
Consider creating a dedicated “MainWP Admin” account for connecting sites. This account can be monitored or modified independently.

​
Unique Security ID

An optional Unique Security ID adds another layer of authentication during setup. When enabled, this ID must match on both Dashboard and Child Site for the connection to succeed. This feature is valuable for sites requiring stricter access controls.

​
Connection Timeout

The MainWP Child plugin includes a connection timeout to minimize exposure. After activation, if no connection is established within the specified time (in minutes), the plugin automatically deactivates itself. This prevents idle plugins from remaining accessible.

​
Disconnect Site Option

The Disconnect Site feature allows you to clear all connection data for a Child Site directly from the Dashboard. Use this when:
  • Decommissioning sites
  • Re-establishing secure connections
  • Troubleshooting setup issues

​
Post-Connection Security

After a site is added, all communication uses OpenSSL-encrypted connections.

​
Key Pair Generation

When MainWP Dashboard connects to a child site for the first time:
  1. Dashboard generates Public and Private key pairs (2048 bits) using openssl_pkey_new()
  2. Public key is saved on both the child site and Dashboard
  3. Private key is encrypted and saved only on the Dashboard

​
Request Signing and Verification

The child site only processes requests with valid signatures that match its stored public key.

​
HTTPS Request Structure

MainWP Dashboard communicates with child sites via HTTPS requests using cURL. Each request includes:

​
Example Sync Request

If the mainwpsignature doesn’t match, the child site rejects the request.

​
Request Parameter Escaping

Before sending any request to a child site, MainWP Dashboard escapes all parameter values to prevent code injection. For example, the Jump to WP Admin feature escapes name and value attributes using esc_attr(): Code showing esc_attr function usage for escaping request parameters

​
Why This Matters

This escaping protects against scenarios where an attacker might:
  1. Trick you into clicking a crafted link
  2. Attempt to pass malicious code through request parameters
Since MainWP escapes all attributes, any potentially harmful code becomes harmless before reaching the child site.

​
Complete Request Flow

The security system works as follows:
  1. Preparation: Dashboard escapes all request attributes
  2. Transmission: HTTPS request sent with MainWP Signature and parameters
  3. Verification: Child site validates signature against stored public key
  4. Execution: Only authenticated requests are processed