Skip to main content
MainWP Dashboard is primarily self-hosted. Most day-to-day management traffic goes directly between your Dashboard and your child sites, not through MainWP-operated services. This page covers Dashboard-initiated outbound connections to external hosts. It does not include child site connections or self-calls on the same server.

​
What You’ll Learn

  • Which external hosts MainWP Dashboard may contact
  • Which hosts are required, recommended, or optional
  • How to build a practical firewall allowlist for restrictive environments

​
Quick Allowlist

Use this as a starting point when your Dashboard server has outbound firewall or proxy restrictions:
LevelHosts
Minimal for MainWP licensing and premium add-onsmainwp.com
Recommended for normal Dashboard UXmainwp.com, api.wordpress.org, downloads.wordpress.org, s0.wp.com
Optional extraswww.usetiful.com, www.youtube.com, supportassistant.mainwp.com
Feature-specificAdd only the API Backups provider hosts you actually use
For full WordPress.org-backed UI, you may also need to allow asset hosts returned by the WordPress.org API, typically *.w.org, for plugin and theme icons or screenshots.

​
Required for MainWP licensing and premium add-ons

HostUsed forNotes
mainwp.comLicense validation, purchased add-ons, API key retrieval and verification, and premium add-on update checksThis is the primary MainWP service host used by the Dashboard for premium features
The MainWP updater can consume a package URL returned by the MainWP API. In some environments, the actual package download may come from an additional host that is not visible in the Dashboard code. If update checks succeed but the package download fails, inspect the returned URL or server logs and allow that download host too.
HostUsed forNotes
api.wordpress.orgPlugin and theme information lookups through WordPress.org APIsSupports repository-backed plugin and theme details in the Dashboard
downloads.wordpress.orgMainWP Child download buttonRecommended if you want the Dashboard to download the MainWP Child plugin directly
s0.wp.comScreenshot and site preview thumbnailsCosmetic only; core management does not depend on it

​
WordPress.org asset hosts

WordPress.org API responses can include external icon and screenshot URLs. In practice, these are often served from *.w.org. Allow *.w.org if you want plugin and theme icons or screenshots to load reliably in the Dashboard. This host pattern is based on the URLs returned by WordPress.org, not a separate MainWP service requirement.

​
Optional UI services

These hosts are used only when the related feature is enabled and opened by the user.
HostFeatureNotes
www.usetiful.comGuided toursLoaded when guided tours are enabled
www.youtube.comEmbedded help and tutorial videosUsed when the user opens a help video
supportassistant.mainwp.comIn-Dashboard AI and chat supportUsed when the support assistant is enabled and opened
If you do not use these features, you do not need to allow these hosts.

​
Feature-specific connections for API Backups

These hosts are only needed when the API Backups module is enabled and you configure the matching provider.
ProviderHost to allow
Cloudwaysapi.cloudways.com
GridPanemy.gridpane.com
Vultrapi.vultr.com
Akamai (Linode)api.linode.com
DigitalOceanapi.digitalocean.com
Kinstaapi.kinsta.com
cPanel (WP Toolkit)Your configured cPanel hostname
Plesk (WP Toolkit)Your configured Plesk hostname
Allow only the provider hosts you actively use. cPanel and Plesk do not have a single global hostname because the Dashboard connects to the server hostnames you configure.

​
Practical recommendations

  1. Allow mainwp.com if you use MainWP API keys, purchased add-ons, or premium add-on updates.
  2. Add api.wordpress.org, downloads.wordpress.org, and s0.wp.com for a more complete Dashboard experience.
  3. Add *.w.org if your firewall blocks plugin and theme icons or screenshots returned by WordPress.org.
  4. Add www.usetiful.com, www.youtube.com, and supportassistant.mainwp.com only if you enable and use those UI features.
  5. Add API Backups provider hosts only for the providers configured in your Dashboard.
  6. If a premium add-on update still fails, inspect the returned package URL and allow that download host as well.

​
Self-Check Checklist

  • mainwp.com is reachable from the Dashboard server if premium features are in use
  • WordPress.org hosts needed by your workflow are reachable
  • Optional UI service hosts are either reachable or the related features are disabled
  • API Backups provider hosts are allowlisted only for the providers you use
  • Outbound DNS, proxy, and firewall rules allow these HTTPS requests