Get up and running in minutes

Getting Started

WP Remote Control is an Android app that connects directly to your WordPress sites, giving you full site management from your phone. Setup takes about 5 minutes per site. Here's the flow:

1. Download the WP Remote Control app from Google Play
2. Add your site -- the app walks you through creating a WordPress Application Password
3. The app installs the Remote Control plugin on your site automatically
4. Configure which pages to monitor and set your check interval

Step 1: Install the App

Download the WP Remote Control app from the Google Play Store. Once installed, open the app and tap Get Started. The app handles the rest of the setup -- it will guide you through connecting your first site and installing the plugin.

Step 2: Add Your Site

With the app installed, tap Add Site and enter your WordPress site URL. The app guides you through creating an Application Password:

1. Enter your site URL (e.g., https://yoursite.com)
2. The app opens your WordPress admin profile page where you can create an Application Password
3. In the Application Passwords section, type WP Remote Control as the name and click Add New Application Password
4. Copy the generated password and paste it back into the app
5. Tap Connect

Can't find Application Passwords?

If you don't see the Application Passwords section on your profile page, check these common causes:

• HTTPS not enabled: WordPress only shows Application Passwords on sites using HTTPS. If your site is HTTP-only, you'll need to enable SSL first.
• WordPress version too old: Application Passwords require WordPress 5.6 or newer. Check your version at Dashboard > Updates.
• Disabled by a plugin: Some security plugins disable Application Passwords. Check your security plugin settings. Common culprits include iThemes Security and Wordfence (look for "Application Passwords" or "REST API" settings).
• Disabled by hosting: Some managed WordPress hosts disable Application Passwords by default. Contact your host's support to enable them.

Step 3: Plugin Installation

Once you've connected to your site, the app automatically installs and activates the Remote Control plugin. This plugin adds REST API endpoints to your WordPress site that the app uses to fetch health data, manage plugins, and more. It's lightweight and adds zero overhead to your frontend page loads.

Once the plugin is active, your site appears on the dashboard with its current health status. You're ready to start managing it.

Using WP Remote Control

Dashboard

The dashboard is your home screen. It shows every connected site with a color-coded health indicator:

• Green (Healthy) -- All monitored pages are responding normally
• Yellow (Warning) -- Site is responding but with slow load times or PHP warnings
• Red (Down) -- One or more monitored pages are down or returning errors
• Gray (Unknown) -- Haven't checked yet -- tap to run a health check

Pull down to refresh all sites at once. Tap a site to see its details.

Uptime Monitor

WP Remote Control monitors your public-facing pages -- your homepage, shop page, contact page, and any other pages you configure -- and checks the HTTP status code and response time for each one.

• HTTP status code for each monitored URL
• Response time in milliseconds

Background monitoring runs as often as every 5 minutes. Push notifications alert you when a site goes down.

Uptime history log shows every check with timestamp, HTTP code, and response time.

To edit the monitored URL list, tap into a site's detail view and look for the Monitored URLs section.

Plugin Management

The Updates screen shows every pending plugin update across all your sites, grouped by plugin name. From here you can:

• Update individual plugins on a specific site
• Batch update a plugin across multiple sites
• Activate/deactivate any plugin from the site detail view

Maintenance Mode

Flip the Maintenance Mode toggle to show visitors a maintenance page while you work on a problem. One tap to enable, one tap to disable.

User Management

View and add WordPress users on any connected site:

• List users -- see all users with their display name, email, and role
• Add user -- enter an email address and select a role (Administrator, Editor, Author, Contributor, or Subscriber). WordPress sends the welcome email automatically.

Server Vitals

View server diagnostics for any connected site: PHP version, WordPress version, MySQL version and response latency, server software (Apache/nginx), system memory usage, disk usage, PHP process memory, last cron run, WP_DEBUG status, and timezone. Color-coded progress bars highlight when resources are running low.

Content Quick Edits

Browse posts and pages on any connected site. Filter by status (published, draft, pending, trash). Quick edit a post's title, slug, or status directly from the app. For full editing, tap Edit in Browser to open the WordPress block editor -- the app logs you in automatically.

Security Model

WP Remote Control takes security seriously. Here's how the system protects your sites:

Direct Communication

The WP Remote Control app connects directly to your WordPress sites over HTTPS. No data passes through our servers. There are no WP Remote Control servers. The app is a client, your site is the server, and the connection is direct.

Authentication

WP Remote Control uses WordPress Application Passwords (built into core since WordPress 5.6). Every API call is authenticated via HTTP Basic Authentication over HTTPS. The plugin refuses to serve over plain HTTP.

Application Passwords are:

• Per-app revocable -- delete the "WP Remote Control" password from your WordPress profile to instantly revoke access
• Capability-aware -- the authenticated user's WordPress role determines what they can do through the API
• Standard -- no custom auth, no third-party tokens, no refresh flows

Credential Storage

Your site URLs, usernames, and Application Passwords are stored in Android's hardware-backed Keystore. This is the same encryption system used by banking apps. Credentials never leave your device in an unencrypted form.

Permission Checks

The Remote Control plugin checks WordPress capabilities on every API request. The same permission rules that apply in wp-admin apply through the app:

• Plugin management requires the activate_plugins capability (Administrator)
• User management requires the create_users capability (Administrator)
• Quick toggles check the appropriate capability for the option being modified
• An Editor-level account can view health data but cannot manage plugins or users

Minimal Attack Surface

The plugin exposes no unauthenticated endpoints. The plugin adds no frontend JavaScript, no cron jobs, and no external HTTP calls.

Troubleshooting

"Can't reach this site"

The app couldn't connect to your WordPress site. Check:

• Is the site URL correct? Make sure it includes https:// and matches exactly (including or excluding www.)
• Is the site online? Try loading it in your phone's browser
• Is your phone connected to the internet? Check wifi or cellular data
• Is the site behind a firewall? WP Remote Control needs to reach the site's REST API. If the site is behind a VPN or IP whitelist, your phone's IP needs access

"Plugin not found"

The app couldn't detect the Remote Control plugin at the given URL. Check:

• Is the plugin installed and activated? Log into wp-admin and check Plugins
• Is the REST API accessible? Some security plugins or hosting configs block the REST API. Try visiting yourdomain.com/wp-json/wprc/v1/ping in a browser -- you should see a JSON response (or an authentication error, which is expected)
• Is a security plugin blocking it? Wordfence, iThemes Security, and similar plugins sometimes block REST API endpoints. Check their settings for REST API restrictions

"Authentication failed"

The username or Application Password was rejected. Check:

• Is the username correct? Use your WordPress login username, not your display name or email
• Is the Application Password correct? Application Passwords include spaces between groups (like xxxx xxxx xxxx xxxx). Copy the entire string including spaces
• Was the password revoked? Check your WordPress profile under Application Passwords to make sure the "WP Remote Control" entry still exists
• Are Application Passwords enabled? See the "Can't find Application Passwords?" section above

"Permission denied"

Your WordPress account doesn't have sufficient permissions. Plugin management and user management require an Administrator role. Check your role at Users > Profile in wp-admin.

HTTPS Issues

WP Remote Control requires HTTPS. If your site doesn't have SSL:

• Most hosting providers offer free SSL through Let's Encrypt. Check your hosting control panel
• Cloudflare's free plan includes SSL
• After enabling SSL, update your WordPress URL at Settings > General to use https://

Slow response times

If the app takes a long time to load data:

• Check your cellular/wifi signal strength
• The site itself may be slow -- check the response times reported in the health check
• Shared hosting can be slow during peak hours. This isn't a WP Remote Control issue but a hosting limitation

Frequently Asked Questions