The Site Care Plugin
- It answers only requests signed by your workspace. Anything else gets WordPress's own "not found," so a scan cannot tell it is installed.
- It runs a fixed list of operations, such as checking for updates or running a tested update. It never runs code or database queries sent over the network.
- Its own signing key is sealed with a key made from the site's own configuration, and it holds only public keys for your workspace, so a copy of the database gives nothing away.
- It never uses WP-Cron, never slows visitors, and sends no email.
- One-click sign in to WordPress uses a link that works once, for 60 seconds. Only a fingerprint of it is stored, and it never knows a password.
Backups
- Each site has its own encrypted backup repository, with its own key.
- Backups are kept outside the host, in storage whose lock rules stop them being deleted or overwritten.
- Every week a test restore checks the backup, restores the newest copy into scratch space, and counts and compares every file.
Sites
- A sign-in guard locks out repeated failed sign-ins, by address and by username, and turns XML-RPC off.
- Malware scans run with the nightly backups, and plugins are checked daily against a public vulnerability database.
- MountDev Hosting runs on WP Cloud, the managed WordPress platform from Automattic, and each site's domain stays on its own Cloudflare account, with Cloudflare's firewall in front.
Your Workspace
- Your agency's data is kept in its own database, with its own encryption key, in the United States.
- The workspace is built so our staff screens cannot show your records. If you want help inside your account, you grant a named person access for a set time, and everything they do is logged.
- You can export everything, at any time.
The workspace's own security pages go further: How Your Data Is Protected, Data Region, and Export Everything.
No Tracking
This site, the portal, and the plugin load no analytics, tracking pixels, or third-party scripts.
Reporting a Problem
If you think you have found a security problem, email help@mountdev.app. We answer every report, and we ask that you give us a fair chance to fix it before you share it.