You stay in control
Monitoring does not automatically repair your site or change its plugins, themes, database, or hosting. You review recommendations and choose what to do. The Firefly Agent updater is a separate, user-requested action.
Built around your control
Reliability monitoring without taking control of your WordPress site.
Understand what the Agent collects, how access is protected, and where human review stays part of the process.
Useful evidence, less data
Checks use information such as status codes, timings, counts, component versions, and sanitized error details. Monitoring is designed to exclude passwords, cookies, authentication headers, form contents, customer orders, and session replay.
An authenticated Agent connection
A one-time pairing key connects the Agent to your site in StackFirefly. Subsequent requests are signed with scoped credentials and checked for freshness and replay. You do not give StackFirefly your WordPress administrator password.
Access belongs to your workspace
Workspace roles control who can view monitoring and manage settings. Server-side authorization and database row-level security enforce workspace boundaries. Authenticator-app two-factor authentication adds protection to your account.
AI explains; it does not operate your site
AI uses selected, sanitized monitoring context to explain findings and suggest next steps. It has no tools to change your WordPress site. Generated explanations are checked before display, and possible causes remain separate from observed facts.
You control external AI access
MCP connections use OAuth and default to read-only. You select the workspace and sites, can revoke access, and explicitly enable any issue actions. Acknowledgements and reported fixes are recorded; deterministic checks establish recovery. Connected tools do not expose Agent credentials or pairing keys. Your AI provider’s own data-processing terms apply to shared context.
Data has a lifecycle
Monitoring data is retained for defined periods, with different windows for detailed evidence and longer-term summaries. Workspace deletion disables access and schedules operational data for removal. See the privacy notice for retention and deletion details.
Help with context you choose
Requesting help lets you preview the context you submit. A support request does not grant access to your WordPress installation. Do not include passwords, access tokens, or customer information in a help request.
Responsible disclosure
Report a security issue
Found a vulnerability in StackFirefly? Email security@stackfirefly.com with the affected area and safe steps to reproduce it. Please leave out passwords, tokens, customer data, and destructive demonstrations.
Contact security