Security
Last revised October 2026
Where WP FloorMap sites run, who can get into them, how they stay current and what happens to the data.
Where it runs
Infrastructure
Hosting
Every WP FloorMap site runs on WP Engine, in your WP Engine account or ours, with CDN, SSL and a 24/7 managed support safety net beneath our own.
Environments
Every site carries development, staging and production environments. Changes are proven on staging and promoted, so an experiment never touches the live leasing site.
Backups
Daily backups with restore on managed hosting. If something goes wrong, the site is restored rather than rebuilt.
Who gets in
Login protection
Two-factor sign-in, automatic brute-force lockouts and hidden usernames are included in every plan and switch on in a click.
Two-factor sign-in
Admin accounts can require a second factor at sign-in, so a leaked password is not enough to get in.
Brute-force lockout
Repeated failed logins trip an automatic per-account lockout, and admin actions are protected against tampering.
Hidden usernames
The usual WordPress routes for harvesting author usernames are closed off, so attackers cannot build a list of logins to try.
How it changes
Updates
WP FloorMap updates through the same standard WordPress update flow you’d use for anything else. When a new version is ready it shows up in your dashboard next to your other updates, and a single click brings you current. Updates often add new sections, layouts and features at no extra charge. How much you touch depends on where your site is hosted. If it is hosted in our WP Engine account, or you’re on Studio, Foreword keeps WordPress core and your plugins current for you. If it is hosted in your own WP Engine account on Essentials or Launch, you (or your developer) stay in control and apply updates whenever you like. Because it all runs on open WordPress, the updates are yours to apply, test on staging or hold until a quieter week.
What flows where
Data
From SightMap and the PMS
Availability, pricing and floor plans flow one way, from your PMS through Engrain to the page. The link is locked to your account and re-checked on every request, so no one else can pull your numbers.
What Foreword stores
Foreword stores what the subscription needs: your account, your sites and your billing history. Prospect messages and tour bookings live on your own WordPress site, not on ours.
Encryption in transit
Every connection between your site and our service is encrypted, and tour cancellation links are signed so they cannot be forged.
Favorites
When a visitor saves favorite units, the list is stored only in their own browser. No personal data is collected or sent anywhere.
Something this page does not cover?
Write to us. A person in New York or Paris replies within one business day.
 Email | info@foreword.dev | every plan |
|---|---|---|
 WhatsApp and SMS | your Foreword contact | Launch and Studio |
 Dedicated Slack | a private channel with your team | Launch and Studio |
 Phone | priority response | Studio |
