Every feature is part of the same kernel. There is no "pro plugin" that unlocks extra tables. Everything here ships in every plan; the plan decides how much of it you can use.
Staging
Clone & provision
OAuth connection
No SFTP. 90-second setup.
Serialized-safe rewrite
PHP objects preserved byte-for-byte.
Multisite support
Subdomain & subdirectory networks.
3-region provisioning
us-east · eu-central · ap-singapore
Warm pool boot
Median 2m 48s · P99 4m 12s
Custom-domain preview
staging.yourbrand.com via CNAME.
Isolation
Contain & defend
Rootless containers
Zero Linux capabilities granted.
seccomp + AppArmor
63-syscall allowlist. Everything else EPERM.
Egress allowlist
Default-deny. wp.org + your approved hosts.
Mail interception
wp_mail() routed to /dev/null + logged.
Payment gateway block
Live payment keys stubbed.
Auto-quarantine
Behavioral score > 90 → pause container.
Backups
Snapshot & restore
Pre-launch snapshot
Every staging creates a restore point.
SHA-256 hash chain
Tamper-evident snapshot history.
Nightly restore drill
We test 0.5% of backups every night.
Chunk-level dedup
Store 50 snapshots, pay for 1.4×.
Selective restore
Pick tables, files, or plugin states.
Cross-region replica
S3 → distinct region, KMS re-encrypted.
Observability
Log & stream
Real-time activity log
eBPF-sourced. 87 ms median latency.
Webhook delivery
Signed + retried. Any URL.
SIEM export
Splunk · Datadog · Elastic · raw S3
Query DSL
Scope by site, class, time, policy.
Performance profiler
Slow queries, PHP hotpaths, TTFB.
Slack + PagerDuty
Alert on quarantine · egress block.
Collaboration
Share & ship
Team workspaces
Unlimited seats on Pro & Scale.
Scoped roles
Viewer · Editor · Admin · Owner
Shareable URLs
Time-boxed. Password-protected.
Push-to-production
Selective promote. Pre-push snapshot.
SAML SSO
Okta · Azure AD · Google Workspace
Audit log export
Immutable. SOC 2 ready.
All of it. Even on free.
Everything ships in every plan. The plan decides quota, retention, seats.