The modular command center to manage
all of your clients' hosting
Stop jumping between fragmented hosting logins or paying compounding per-site SaaS fees. Clockwork Control gives you one self-hosted control panel to monitor, secure, and operate all client sites. Pick and choose only the hosting and cloud services your agency uses.
Manage all of your clients' hosting
in 3 steps
Every agency’s hosting setup is unique. Clockwork Control does not force you into a proprietary stack. You pick the tools you already use.
Pick Your Hosting Modules
Do you manage servers via SpinupWP or GridPane? Run client sites on Pressable, WP Engine, Kinsta, or Cloudways? Turn on only the hosting modules your agency uses.
• WP Engine • Cloudways • Custom VPS
• Pluggable for any future host
Pick Your Cloud & Services
Plug in your hypervisors (DigitalOcean, Hetzner, Vultr, Linode, Azure), connect Cloudflare, and activate Gatekeeper native login defense to push bans straight into Linux fail2ban.
• Cloudflare real-IP protection
• WordPress-to-Kernel fail2ban
Run One Unified Center
Sit back with total operational visibility. Inspect origin SSL certificates, fan-out downtime alerts to Slack, Mattermost, or instant Twilio SMS paging, and verify Bill.com care plan status before performing client work.
• Bill.com Care Plan Sync
• 100% Self-Hosted on your LAN
Inside the Command Center
Clockwork Control isn't mockups or vaporware. Browse authentic screens captured directly from an active installation running on local hardware, managing real Linux servers and client WordPress fleets.
Main Fleet Command Center (Modern Studio)
The modern studio fleet dashboard showing overall health across SpinupWP, Pressable, WP Engine, and Kinsta servers.
Choose how your team works:
Command Center or Modern Studio
One size never fits every engineer. Clockwork Control features two distinct production layouts, switchable with a single click from the header. Preferences are saved instantly with zero-flicker pre-rendering.
Command Center
Dense Operations Rail • NOC Telemetry
Engineered for busy DevOps engineers and multi-monitor operations desks. Features a persistent high-density left sidebar rail with live system diagnostic counters, rapid server switching, and an upward-oriented popover user menu.
data-layout-style="command-center"✓ Zero-Flicker InitModern Studio
Human-Centric • Card-Forward • Live Search
Spacious, elegant, and card-forward. Designed for agency founders and project managers who want high-level clarity, instant client-side live search filtering across the entire fleet, and streamlined primary navigation.
data-layout-style="modern-studio"✓ Zero-Flicker InitFull Theme Engine & Accessibility Parity
Reactive solar/moon toggle • High-Contrast Mode • Typography Font Scaler (Compact, Standard, Comfortable)
Modules built for your
agency’s exact stack
Enable what you need, ignore what you don’t. Need support for an in-house host or new provider? Clean, lightweight contracts make adding custom modules straightforward.
Hosting Provider Modules
Plug in the hosting platforms your agency uses
SpinupWP
Direct SSH substrate across VPS droplets. Checks apt security updates, executes graceful delayed reboots, tails Nginx logs, and manages fail2ban jails.
GridPane
High-performance cloud VPS orchestration. Discovers servers and sites via API v1, tracks origin SSL behind Cloudflare, and runs SSH commands.
Pressable
Zero-SSH REST API management. Executes async WP-CLI commands and relays backups to S3 Glacier Instant Retrieval for 90-day retention.
WP Engine
Enterprise WP Engine API v1 integration with per-site SSH runners for command execution and automated Companion deployment.
Kinsta
MyKinsta API v2 integration mapping Company → Site → Environment hierarchy with per-environment SSH tunnels.
Cloudways
Dual CloudProvider and HostingProvider contract implementation for Cloudways managed VPS servers and apps.
Custom VPS / Other Hosts
Extensible via clean contracts. Implement custom modules for any hosting API in minutes with lightweight PHP interfaces.
Cloud & Infrastructure Modules
Pull raw hardware metrics directly from hypervisors
DigitalOcean
Pulls droplet CPU, memory, disk, and load telemetry every 5 minutes via DO v2 API. Direct DO Spaces S3 backup verification with automated snapshot history.
Hetzner Cloud
Pulls CPU, disk I/O, and network telemetry for high-performance, cost-effective instances in Europe and North America.
Vultr Cloud
Tracks CPU, disk, memory specs, and automates server IP reconciliation across Vultr high-frequency and regular compute instances.
Linode (Akamai)
Pulls native CPU usage series, monitors hardware specs, and cross-references public IPs across worldwide Linode datacenters.
Azure Monitor
Enterprise Service Principal integration querying Azure Monitor for CPU percentage and available memory bytes.
Security, Storage & Client Modules
Layer on defense, off-host backups, and client reporting
Gatekeeper & fail2ban Bridge
Ingests native Gatekeeper login lockouts from WordPress and escalates them to Linux iptables drops via fail2ban.
Email Authentication Posture
Fleet-wide email authentication monitoring. Inspects RFC 7208 SPF lookup limits (<10) and void queries, RFC 7489 DMARC enforcement policies, multi-selector DKIM probing via DNS-over-HTTPS, and 1-click client notice composition.
AWS S3 Glacier Relay
Asynchronously archives client backups to S3 Glacier Instant Retrieval for long-term care plan compliance without opening ports.
Clockwork Companion
Lightweight mu-plugin for 1-click SSO into client wp-admin and a white-label Tools → Clockwork Control client portal.
Incident Alerting & Notification Modules
Instant alerts where your engineering team and clients communicate
Twilio SMS Text Alerts
Urgent on-call SMS text paging dispatched the moment a client site goes down, with off-hours scheduling and VIP client escalation.
Slack Integration
Real-time downtime alerts, origin SSL renewal warnings, and IP ban actions sent to Slack.
Mattermost Integration
Self-hosted incident alerting for agencies running private Mattermost chat. Gated on transitions to keep ops channels noise-free.
Client Slack Channels
Per-site customer Slack webhooks routing maintenance reports and verified backup confirmations directly to client channels.
Agency Operations & Billing Modules
Connect client contracts, invoices, and performance monitoring
Bill.com Care Plan Sync
Cross-references active Bill.com invoices so engineers instantly know whether a client site is covered by an active Care Plan before performing maintenance.
PageSpeed, GTmetrix & CrUX Field Data
Automated 4-category Lighthouse audits via Google PageSpeed Insights & GTmetrix, paired with 28-day rolling real-user Core Web Vitals field data from Google Chrome UX Report (CrUX).
4-Layer Threat Intel & Sucuri
Remote malware scans (Sucuri v3 API), Google Cloud Web Risk API domain blacklist monitoring, on-disk WP core checksum audits, and in-WP Companion malware probes bypassing Cloudflare.
Looking for production agency testers for Vultr, Linode, and Azure
Our core hypervisor telemetry integrations for Vultr Cloud, Linode (Akamai), and Azure Monitor are built and verified in development. If your agency hosts client WordPress sites on these platforms, test live metric polling and help shape the integrations!
This is why Agency Owners are using Clockwork Control
Fleet Directory & Visual Grid
View all 20, 50, or 250+ client websites across SpinupWP, Pressable, WP Engine, Kinsta, and cloud VPS in a unified list or responsive visual card grid with automated 16:10 website screenshot previews and health accent bars.
Dual-Layout Command Center
Switch instantly between Command Center (dense operations rail and live telemetry cards) and Modern Studio (spacious card view with instant live search), plus a 3-column per-site overview grid with draggable widgets.
Master Agency Brand Palette
Centralized brand palette in /settings/companion with 1-click cascade across wp-admin Companion chrome, Client Reports, and notification emails, plus two-tone contrast and full-page live preview.
4-Layer Threat Intelligence
Defense in depth: Google Cloud Web Risk API domain reputation (with Safe Browsing v4 fallback), remote Sucuri SiteCheck v3, on-disk WP core checksum audits, and in-WP Companion malware scans bypassing Cloudflare.
Spaces & Glacier Archival
Real-time DigitalOcean Spaces S3 backup verification and snapshot history modal on site overview, paired with zero-port AWS S3 Glacier Instant Retrieval archival for long-term care plan retention.
Fault Attribution & SLA Protection
Classify downtime incidents (provider, client DNS, expired domain, third-party API). Automatically excusing verified client errors from contractual SLA calculations ensures client mistakes don't breach your uptime guarantees.
Origin SSL Tracking
Directly probes origin Let's Encrypt certificates behind Cloudflare. Catches renewal failures and TLS handshake errors before clients or visitors ever encounter a broken page.
Zero Per-Site Rent
100% self-hosted on your own LAN, Mac Studio, or private VPS under the MIT License. Eliminate recurring per-site SaaS fees compared to ManageWP while keeping all client SSH keys and credentials in your sole custody.
Alerts & Crontab Heartbeat
Emergency Twilio SMS paging on downtime, Slack & Mattermost webhooks, synthetic contact form delivery testing, and automated crontab scheduler heartbeat tracking to warn if cron stalls.
Escalate WordPress lockouts to Linux firewall drops
Gatekeeper is Clockwork Control's native, zero-dependency login lockout engine built directly into Clockwork Companion and Renegade. While traditional security plugins only stop brute-force attacks inside WordPress, bots still consume Nginx connections and PHP-FPM worker processes.
Clockwork Control bridges WordPress to the Linux kernel: when Gatekeeper locks out an IP, Clockwork Control pulls the lockout data via HMAC-signed REST into a central review queue and fires an SSH command to fail2ban. Malicious packets are dropped at the Linux firewall (iptables) before they ever touch PHP or attack neighbor client sites.
Self-Healing Servers
24/7 AI Triage & Incident Forensics
When a server spikes to 100% CPU or a site goes down at 2:00 AM, Clockwork Control doesn't just send a generic alert. It connects via read-only SSH in under 2 seconds, reasons through telemetry with Claude Sonnet 4.5, identifies the exact rogue pool or process, and stages verified fixes.
Continuous Spike Watchdog
Rolling 5-min averages • CPU ≥ 85% • RAM ≥ 92%Monitors all active cloud and bare-metal servers. Evaluates rolling metrics and automatically triggers triage before server lockups impact client visitors.
Instant Forensic Reasoning
Claude Sonnet 4.5 • OpenRouter APICaptures live load averages, process tables, and service logs in under 2 seconds. Identifies specific rogue PHP-FPM pools, runaway crons, or systemd user initializations.
Zero-Risk Shadow Mode
Default Passive Observability • 0% ExecutionRuns silently in "Watch Mode". Logs full forensic root-cause analysis and records "What AiRemedy Would Have Done" without executing a single command on production.
Allowlist-Guarded Safety
Strict Regex Anchors • Tier 1 Safe OnlyAutonomous commands are strictly restricted to Tier 1 safe service reloads (systemctl reload nginx). Metacharacters are hard-banned with automated cooldown protection.
Frequently Asked Questions
What is Clockwork Control in simple terms?
Clockwork Control is a self-hosted command center designed specifically for Agency Owners to manage all of their clients' hosting in one place. Instead of logging into 5 different hosting dashboards or paying per-site SaaS fees, Clockwork Control lets you connect only the hosting providers and cloud services you actually use.
Can I pick and choose which hosting providers and tools to use?
Yes. Clockwork Control is completely modular. If your agency uses SpinupWP or GridPane on DigitalOcean, Hetzner, Vultr, or Linode, turn on those modules. If you host other clients on Pressable, WP Engine, Kinsta, or Cloudways, enable those modules. If you don't use Azure, leave it disabled. You only activate the modules your agency needs.
How does Clockwork Control handle downtime alerting and care plan billing?
Clockwork Control connects to Twilio to send emergency SMS text messages to on-call engineers when a production site goes down, while fanning out alerts to Slack or Mattermost channels. It also integrates with Bill.com to check client invoice and subscription status — so your team always knows if a website is covered by an active Care Plan before performing work or running automated updates.
How does it solve the Cloudflare + SpinupWP origin SSL blindspot?
When Cloudflare proxies a site, browsers connect to Cloudflare's edge SSL certificate. If the origin server fails to renew its Let's Encrypt certificate, SpinupWP sends an email that easily gets buried in busy agency inboxes. External pingers report "200 OK" because they only see Cloudflare's edge. Clockwork Control inspects origin certificates directly on the server and highlights real expiration dates on your dashboard before outages happen.
How does Gatekeeper and the fail2ban integration protect WordPress?
Gatekeeper is Clockwork Control's native login lockout engine built into Clockwork Companion and Renegade. While standard security plugins only block attackers inside WordPress (wasting PHP-FPM resources), Clockwork Control pulls active Gatekeeper lockouts into a central review queue and fires an instant SSH ban to the server's fail2ban jail — dropping the attacker's packets at the Linux firewall (iptables) before they ever touch PHP. Clockwork Control also seamlessly supports legacy LLAR lockouts.
Where do my client credentials and SSH keys live?
100% on your own infrastructure. Clockwork Control is not a multi-tenant SaaS. Your database lives on your local network (e.g. your office server or Mac Studio), and all credentials are encrypted at rest using AES-256-GCM via Laravel’s Crypt facade. Zero client data or credentials ever touch an external cloud.
Can I write my own modules for other hosts or services?
Yes! Clockwork Control is built around clean, lightweight contracts (~35 to 50 lines of PHP). The CloudProvider and HostingProvider interfaces define simple methods for health checks, SSH execution, and metric polling. You can implement and test a custom provider module for your agency in an afternoon.
How does the Self-Healing Server engine (AiRemedy) work?
When a server spikes past threshold CPU/RAM or a site drops offline, Clockwork Control gathers read-only SSH telemetry in under 2 seconds. Powered by OpenRouter (Claude Sonnet 4.5 / GPT-4o), it identifies the exact root cause (such as an orphaned worker or runaway MySQL query). By default, it operates in Shadow Mode — diagnosing and staging fixes in an audit log without touching production. Autonomous self-healing commands are strictly gated by deterministic allowlists for Tier 1 Safe actions.
Up and running on your LAN in 5 minutes
Let your AI coding assistant (like Claude Code) clone, configure, test, and boot Clockwork Control for you — or run the commands manually.
Clone and set up Clockwork Control locally on this machine for me:
1. Clone the repository:
git clone https://github.com/Clockwork-Web-Dev-LLC/clockwork-control.git && cd clockwork-control
2. Verify environment prerequisites:
- PHP 8.4+ with extensions: curl, mbstring, openssl, pdo_sqlite or pdo_mysql, pcntl
- Composer 2+
- Node.js 20+ and npm
3. Run automated setup & configure environment:
- Run: composer setup
(Installs dependencies, copies .env, generates APP_KEY, runs migrations, and builds frontend assets)
4. Verify the test suite:
- Run: php artisan test
- Confirm all 2,105 tests pass cleanly with 0 failures
5. Provision the initial agency admin user with local password authentication:
- Ask me for my agency email, name, and password, then run:
php artisan clockwork:add-user [email] --name="[name]" --password="[password]"
6. Launch the local application & queue scheduler:
- Run: php artisan serve --port=8000
- Run: php artisan schedule:work (in background)
- Open http://127.0.0.1:8000 and verify the dashboard renders cleanly.Prefer a browser-based setup wizard over CLI commands?
Clockwork Control includes an 8-step pre-auth installation wizard at /install:
- Requirements Check — PHP 8.4+, required extensions (pdo_mysql, openssl, mbstring, curl), storage permissions
- Live Database Connection — Configure MySQL / MariaDB host & credentials with a live connection test button
- Application Identity — Control panel title, public LAN URL, and agency timezone
- Outbound Mail (Optional) — SMTP configuration for alert dispatches or default to log
- SSO / Google OAuth (Optional) — Google Workspace client keys or skip for local password auth
- Admin Account & Password — Provision the first agency administrator with secure local password sign-in
- Hosting Provider Quick-Connect — Select your primary fleet substrate (SpinupWP, Pressable, GridPane, etc.)
- Atomic Install & Seal — Generates fresh APP_KEY, runs migrations, writes .env (0600), and seals wizard
composer install && npm run build, start php artisan serve, and navigate to http://localhost:8000/install.# 1. Clone the open-source control panel
$ git clone https://github.com/Clockwork-Web-Dev-LLC/clockwork-control.git && cd clockwork-control
# 2. Run automated setup (dependencies, app key, migrations, assets)
$ composer setup
# 3. Add your agency admin account with local password authentication
$ php artisan clockwork:add-user you@agency.com --name="Your Name" --password="YourPassword"
# 4. Start local server & scheduler (or open /install for the web wizard)
$ php artisan serve & php artisan schedule:work
