Security
Last revised September 2026
How WP FloorMap sites are hosted, guarded and kept current, in plain words: the infrastructure, the logins, the updates and the data.
Where it runs
Infrastructure
Hosting
WP Engine
Managed sites run on WP Engine with CDN, SSL and a 24/7 managed support safety net beneath our own. Prefer your own host? The same site runs anywhere WordPress does.
Environments
dev · staging · production
Every managed site carries development, staging and production environments. Changes are proven on staging and promoted, so an experiment never touches the live leasing site.
Backups
daily
Daily backups with restore on managed hosting. If something goes wrong, the site goes back to the way it was, not to a rebuild.
Who gets in
Login protection
Two-factor sign-in, automatic brute-force blocking and hidden usernames, switched on in one click. No separate plugin to license.
Two-factor sign-in
2FA
Admin accounts can require a second factor at sign-in, so a leaked password is not enough to get in.
Brute-force lockout
rate-limits
Repeated failed logins trip an automatic per-account lockout, and admin actions are protected against tampering.
Hidden usernames
no enumeration
The usual WordPress routes for harvesting author usernames are closed off, so attackers cannot build a list of logins to try.
How it changes
Updates
Easily, and on your terms. WP FloorMap updates through the same standard WordPress update flow you’d use for anything else: when a new version is ready it shows up in your dashboard next to your other updates, and a single click brings you current. Updates often add new sections, layouts and features at no extra charge. How much you touch is up to your plan: on Plugin and Launch you (or your developer) stay in control and apply updates whenever you like; if you add optional managed hosting, or you’re on Studio, Foreword keeps WordPress core and your plugins current for you, so there’s nothing to babysit. Because it all runs on open WordPress, you’re never waiting on a closed vendor to decide what your site gets: the updates are yours to apply, test on staging, or hold.
What flows where
Data
From SightMap and the PMS
read-only
Availability, pricing and floor plans flow one way, from your PMS through Engrain to the page. The link is locked to your account and re-checked on every request, so no one else can pull your numbers.
What Foreword stores
minimal
Foreword stores what the subscription needs: your account, your sites and your billing history. Prospect messages and tour bookings live on your own WordPress site, not on ours.
Encryption in transit
HTTPS
Every connection between your site and our service is encrypted, and tour cancellation links are signed so they cannot be forged.
Favorites
client-side
When a visitor saves favorite units, the list is stored only in their own browser. No personal data is collected or sent anywhere.
Something this page does not cover?
Write to us. A person in New York or Paris replies within one business day.
 Email |
info@foreword.dev | every plan |
|---|---|---|
 WhatsApp and SMS |
your Foreword contact | Launch and Studio |
 Dedicated Slack |
a private channel with your team | Launch and Studio |
 Phone |
priority response | Studio |
