Documentation

Spork Tools — Complete Feature Guide

Spork Tools is an all-in-one WordPress admin plugin that handles security, maintenance, performance, and monitoring — all from a single, clean dashboard. Instead of juggling five or six separate plugins (each slowing your site down a little), Spork puts everything under one roof. This guide walks through every feature in plain language so you know exactly what each tool does and when to use it.

On this page

The Dashboard Activity Log Auto-Updater Code Snippets Database Optimizer Firewall Image Optimizer Logs Maintenance Mode Malware Scanner Security Hardening Security Headers Site Prep System Monitor Two-Factor Auth Vulnerability Scanner A Note on Defaults Changelog

The Dashboard

When you open Spork, you land on the Hub — a card-based overview of all available modules. Each card has a short description and a button that takes you straight to that tool's settings. Think of it as your site's mission control.

Activity Log

What it does: Keeps a running diary of everything that happens on your site.

Every time someone logs in (or tries to and fails), creates or edits a post, uploads or deletes a photo, installs or removes a plugin, changes a theme, or modifies user accounts — Spork writes it down. Each entry records the date and time, who did it, their IP address, and a plain-English description of what happened.

Why it matters: If something goes wrong on your site — a post disappears, settings change unexpectedly, or you suspect someone unauthorized got in — the Activity Log is the first place you look. It's your paper trail.

Key features:

Stores up to 10,000 entries before automatically removing the oldest ones
Search the log by user, IP address, or any keyword
Sort newest-to-oldest or oldest-to-newest
Export the entire log as a spreadsheet (CSV) for record-keeping
Clear the log when you want a fresh start

Admin Account Alerts: A separate safety feature within the Activity Log settings. When turned on, the moment any new administrator account is created on your site — or any existing user gets promoted to admin — Spork immediately sends you an email warning and shows a red banner across every admin page until you review and dismiss it. This protects against a common attack where hackers create hidden admin accounts to maintain access after being discovered.

Auto-Updater

What it does: Keeps your WordPress site up to date automatically, without you having to log in and click "Update" manually.

Out of the box, WordPress only auto-applies small security fixes. Spork extends that to cover everything.

What you can auto-update:

WordPress Core — the main WordPress software itself, including major version upgrades (e.g. 6.5 → 6.6)
Plugins — all installed plugins stay on their latest versions
Themes — all installed themes stay current
Translations — language files update automatically

Silent Mode: By default, WordPress emails you every time it runs an automatic update. With Silent Mode on, those emails stop. Useful if you manage multiple sites and don't want your inbox flooded.

Why it matters: The number one reason WordPress sites get hacked is outdated software with known security holes. Auto-updates close those holes the moment a fix is available, without requiring any action on your part.

Code Snippets

What it does: Lets you inject custom HTML, JavaScript, or CSS code into specific locations on your site without editing any theme files.

This is the tool for adding tracking scripts, tag managers, analytics pixels, heat-map tools, live chat widgets, or any other third-party embed code that a service tells you to "paste into the head of your site."

Injection locations:

Head — inserted just before </head>. The right place for analytics scripts, tracking pixels, and anything that needs to load early.
Body Open — inserted immediately after the opening <body> tag. Required by Google Tag Manager's noscript fallback. Needs a theme that calls wp_body_open() — all modern WordPress themes do.
Footer — inserted just before </body>. The right place for deferred scripts, chat widgets, and anything that doesn't need to block page rendering.
Admin Head — inserted in the WordPress admin area only, not on the public site. Useful for internal dashboards or admin-only tools.

Quick-fill presets: The add form includes one-click presets for the most common services — click a preset button and the form fills in automatically with the correct template code and location. Available presets:

Google Analytics 4
Google Tag Manager (Head snippet)
Google Tag Manager (Body noscript)
Facebook / Meta Pixel
Hotjar

After selecting a preset, replace the placeholder IDs (e.g. G-XXXXXXXXXX, GTM-XXXXXXX) with your real account IDs before saving.

Managing snippets: Your saved snippets appear in a table with a toggle switch on each row. Flip the switch to enable or disable a snippet instantly without deleting it — useful for temporarily turning off a tracking script without losing the code. Each snippet also has Edit and Delete actions.

Note: Code Snippets injects code exactly as you enter it — it does not sanitize or validate the content. Only paste code from services you trust.

Database Optimizer

What it does: Cleans up the clutter that accumulates in your WordPress database over time.

Every time you edit a post, WordPress saves a copy of the old version (called a "revision"). Delete a post? It goes to trash first. Get a spam comment? It sits in the spam folder. Plugins often leave behind temporary data (called "transients") that should have been cleaned up automatically but wasn't. Over months and years, all of this adds up to a bloated database that can slow your site down.

What it cleans:

Post revisions — old saved versions of your posts and pages
Trashed posts — content sitting in the trash
Spam comments — filtered-out spam that's still taking up space
Trashed comments — deleted comments sitting in the trash
Expired transients — temporary plugin data that's past its expiry date
Orphaned post metadata — leftover data from posts that no longer exist

Autoloaded Options Audit: WordPress loads certain settings into memory on every single page load. If plugins have stuffed large amounts of data into this "autoloaded" list, your site loads slower on every request. The Database Optimizer shows you everything that's autoloaded, how big it is, and flags anything suspiciously large so you know where to investigate.

Scheduled cleanup: You can set the optimizer to run automatically every week so it stays clean without any effort on your part.

Firewall

What it does: Acts as a security checkpoint that stops malicious traffic before it ever reaches your site's code.

Think of it like a bouncer at the door. Every incoming web request gets checked against a set of rules, and anything suspicious gets turned away with a "403 Access Denied" response.

What it blocks:

SQL Injection — attackers trying to manipulate your database by sneaking commands into web addresses or form fields
Cross-Site Scripting (XSS) — attempts to inject malicious scripts into your pages
Directory Traversal — attempts to navigate your server's folder structure and read files they shouldn't
Sensitive File Access — requests specifically targeting WordPress configuration files, Git folders, environment files, and other things that should never be publicly accessible
Bad Bots — known vulnerability scanning tools (sqlmap, nikto, nmap, nuclei, and 20+ more) are recognized by their user agent signature and blocked outright
Empty User Agents — legitimate browsers and search engines always identify themselves. Requests with no identification at all are almost always automated attack tools

IP Allowlist: A list of IP addresses that are always let through — no matter what. Put your own IP address here to guarantee you're never accidentally blocked.

IP Blocklist: A list of IP addresses that are always blocked — no matter what. If you see the same IP address repeatedly attacking your site in the Firewall Log, add it here.

AbuseIPDB IP Reputation: Automatically blocks visitors whose IP address has a high abuse reputation score. When enabled, each visitor's IP is checked against AbuseIPDB — a community-maintained database of IPs reported for hacking, spam, and DDoS attacks. You set a confidence threshold (0–100; 75 is the recommended starting point), and any IP scoring at or above it is blocked immediately. Scores are cached for 6 hours per IP so you stay well within the free API limit of 1,000 checks per day. Requires a free API key from abuseipdb.com.

Restrict wp-admin to Allowlist IPs: The most powerful protection — only IP addresses you've explicitly approved can even reach the WordPress login page or admin area. Everyone else gets a 403 before they can attempt a login. When you turn this on, Spork automatically adds your current IP to the allowlist so you don't lock yourself out immediately.

Emergency Access URL: What happens if your IP address changes (you're at a coffee shop, on your phone, or your home internet provider assigned you a new IP) and you've enabled the admin restriction? You'd be locked out. Spork solves this with a secret emergency URL you can generate and bookmark. If you ever get locked out, visiting that URL from any device automatically adds your new IP to the allowlist and drops you at the login page. It's one-time use — it self-destructs after you use it.

Firewall Log: Every blocked request is recorded — the IP address, the reason it was blocked, the URL it was trying to reach, and the browser/tool it identified as. Stores up to 5,000 entries and shows the most recent 500 in the table, which can be cleared at any time. Each entry has a Whitelist button — click it to instantly add that IP to the allowlist without leaving the log.

Use the search box above the table to filter live by IP, reason, URL, or user agent as you type. Click any column header to sort the table by that column — click again to reverse the order.

Image Optimizer

What it does: Automatically shrinks and compresses photos when you upload them to your site, so your pages load faster without you having to manually resize anything.

Large photos are one of the most common reasons websites load slowly. A photo taken on a modern smartphone can easily be 4–6 megabytes and 4,000+ pixels wide — far larger than anything a website actually needs to display.

How it works:

When you upload a photo, Spork intercepts it before it saves to your media library
It resizes it so the longest side doesn't exceed your configured maximum (default: 1,024 pixels — suitable for most blog images)
It compresses the quality slightly (default: 82 out of 100 — visually identical to the original on screen, but noticeably smaller in file size)
The oversized original is replaced with the optimized version, saving disk space

What you can configure:

Maximum image width — anywhere from 200px to 5,000px depending on your site's design needs
JPEG quality — lower = smaller files, higher = better quality. 80–85 is the sweet spot for most sites

Why it matters: Faster pages mean happier visitors and better Google rankings. Image optimization is one of the highest-impact performance improvements you can make.

Logs

What it does: Lets you read your server's error logs right from the WordPress admin — without needing FTP access or a server control panel.

When something breaks on your site, PHP (the programming language WordPress runs on) writes a note about what went wrong to a log file. Normally you'd need technical server access to read those files. Spork surfaces them directly in the admin.

What it shows:

The last 100 lines of your WordPress debug log
The last 100 lines of your server's PHP error log
Any additional error logs it finds nearby

WP_DEBUG toggle: WordPress has a built-in debugging mode that makes error messages more detailed and writes them to a log file. Normally turning this on requires editing your wp-config.php file (a technical task). Spork adds a simple checkbox to turn it on or off right from this page.

Log management: Each log file has a "Delete" button if you want to clear it and start fresh. Useful after fixing a bug to confirm the errors stop appearing.

Why it matters: When a plugin is throwing errors, a page is breaking, or something isn't working as expected — the error log is where you find out why.

Maintenance Mode

What it does: Shows a "we'll be right back" page to your visitors while you work on the site behind the scenes.

If you're making big changes — redesigning a page, installing a new theme, doing a major update — you don't want visitors stumbling onto a half-finished site. Maintenance Mode solves this by showing an attractive holding page to anyone who visits, while you continue working normally in the admin.

How it works: Anyone who isn't logged in sees the maintenance page. Anyone who is logged in (regardless of their role) sees the live site as normal. So you can work, preview your changes, and have colleagues review the site while the public sees the maintenance message.

What you can customize:

Headline — the main message (default: "We'll Be Right Back")
Message body — the explanatory text below it
Image — upload your own logo or illustration, or use the built-in default graphic

The page sends a 503 Service Unavailable status to browsers and search engines, which is the correct signal for temporary downtime — Google knows to come back later rather than removing your pages from its index.

Malware Scanner

What it does: Scans every file in your WordPress plugins folder, themes folder, and uploads folder looking for code that malware typically uses.

Hackers who successfully break into a WordPress site usually leave behind hidden code — often buried deep in plugin files or disguised as image uploads — that lets them maintain access, steal data, or redirect your visitors to malicious sites. This code has recognizable patterns, and Spork knows what to look for.

How it works: Spork reads through your files line by line and checks each one against a library of known-bad patterns, organized by risk level:

High Risk — things like encoded commands that execute whatever a hacker sends them, known web shell file names (c99, r57, b374k — these are hacker tools that give full server control), and code that runs dangerous functions based on visitor input
Medium Risk — dangerous functions used in a suspicious context, remote code inclusion, and other patterns that are sometimes legitimate but worth reviewing
Low Risk — things like phpinfo() calls (a developer diagnostic tool that shouldn't be left in production code)

Severity Filter: A High / Medium / Low filter controls which findings appear in the results table and are included in email alerts. By default only High severity findings are shown — Medium and Low are hidden until you need them. The summary counts at the top of the page always reflect all findings regardless of the filter.

External Scan: For any flagged file, click 🔬 External Scan to submit it to one or more external security services. Three services are supported: VirusTotal (checks against 70+ antivirus engines), Hybrid Analysis (sandboxed behavioral analysis), and FileScan.io (multi-engine static and dynamic analysis). You can scan with each service individually, or use the Scan All Enabled Services button to query all configured services in parallel with a single click. Files are always checked by hash first — file content is only uploaded if the hash isn't already known to the service. Each service requires its own free API key, configured in Scanner Settings.

File Viewer: Click "View File" on any flagged item to read its contents right in the browser. You'll also see who owns the file on the server, when it was last modified, and a "Likely Origin" guess about how it got there — useful for figuring out whether a file is legitimate or suspicious.

Scheduled scanning: You can schedule automatic scans (daily or weekly) with email alerts if anything suspicious is found, so you don't have to remember to check manually.

Security Hardening

What it does: Tightens up a long list of WordPress security settings that are either off by default or configured in a way that's convenient but not particularly secure.

Each option is independent — you can enable exactly the ones that make sense for your site.

Login & Access

Disable XML-RPC — XML-RPC is an old remote-access protocol that's heavily targeted by attackers for brute-force and DDoS attacks. Most modern sites don't need it. Disable it unless you use the WordPress mobile app or Jetpack.
Limit Login Attempts — After a configurable number of failed login attempts (default: 5), that IP address is locked out for 30 minutes. Makes automated password-guessing attacks impractical.
Hide Login Error Details — By default WordPress tells you "wrong password" or "no account with that username." That helps attackers confirm which usernames exist. This option replaces both messages with a single vague response.
Remove WordPress Version Number — WordPress puts its version number in your page's HTML source code. This makes it easy for scanners to find sites running outdated versions. Spork removes it.
Disable Admin Bar for Non-Admins — Hides the black WordPress toolbar at the top of the page for subscribers, customers, and other non-admin roles.
Disable User Registration — If you don't need public user accounts on your site, turn this off. Prevents spam bot registrations.

Feeds & Head

Disable RSS/Atom Feeds — If you don't need people to subscribe to your content via RSS readers, this turns those URLs off and redirects visitors to your homepage.
Disable oEmbed — Prevents other websites from automatically embedding your content and removes the discovery links from your page's head section.
Remove RSD & WLW Manifest Links — Removes two old legacy links from your page's HTML that most sites don't use. They reveal that you're running WordPress and serve no purpose on modern sites.

Files & Directories

Disable Theme & Plugin File Editing — WordPress has a built-in code editor that lets admins edit plugin and theme files directly in the browser. If a hacker gets into your admin area, this is an easy way for them to inject malicious code. Disabling it removes that risk.
Disable All File Modifications — A stronger version of the above: blocks all plugin/theme installs, updates, and file edits from the WordPress admin. For high-security sites where all changes go through a developer.
Disable Directory Browsing — If a folder on your server doesn't have an index page, some servers will show visitors a list of all files in that folder. This turns that off.
Block PHP Execution in Uploads Folder — Your uploads folder (where images and files go) should never run code. This places a security rule that prevents any PHP, Perl, Python, or shell scripts in that folder from being executed — even if a hacker manages to upload one disguised as an image.
8G Firewall — A comprehensive set of server-level firewall rules that block attack patterns before they even reach WordPress. Covers malicious URLs, known hacking tool signatures, dangerous HTTP methods, and suspicious referrers. Based on the well-regarded 8G Firewall by Jeff Starr.

Enumeration & REST

Disable User Enumeration — WordPress has a quirk where visiting yoursite.com/?author=1 redirects to a URL that reveals your admin username. Attackers use this to collect usernames for brute-force attacks. This blocks that, and also removes the /wp/v2/users REST API endpoints, which list usernames the same way.
Remove Generator Meta Tag — Removes the HTML tag that announces "this site runs WordPress version X.X." Less information for scanners.
Restrict REST API to Logged-In Users — Limits the core WordPress REST API (/wp/v2/ and related core endpoints) to logged-in users only. Third-party plugin REST endpoints — such as SEO tools, booking systems, and other integrations — are not affected and remain publicly accessible. If a connected service stops working after enabling this, use the Log Unauthenticated REST Requests toggle below to identify which endpoint it's hitting.

Security Headers

What it does: Adds a set of invisible instructions to every page your site sends out, telling visitors' browsers how to behave — specifically, what to trust and what to reject.

These are called HTTP security headers, and they're one of the most effective defenses against certain types of attacks. Browsers that receive them will refuse to do things that attackers commonly exploit.

The headers Spork can add:

Strict-Transport-Security (HSTS) — Tells browsers "this site is always HTTPS — never try HTTP." For the next year, your browser will automatically use the secure version, even if someone tries to redirect you to an insecure version. Only enable this if your entire site runs on HTTPS.
X-Frame-Options — Prevents your site from being loaded inside an invisible frame on another website — a trick called "clickjacking" where visitors think they're clicking your content but they're actually clicking something malicious overlaid on top.
X-Content-Type-Options — Stops browsers from guessing what type of file something is and executing it accordingly. Prevents certain file-based attacks.
Referrer-Policy — Controls how much information your site shares when visitors click a link to another site. By default browsers send the full URL you came from — this limits it to just the domain name, protecting user privacy.
Permissions-Policy — Explicitly blocks your site from ever accessing visitors' camera, microphone, location, or payment APIs. Even if a script is somehow injected into your page, it can't silently activate those features.
Content-Security-Policy (CSP) — The most powerful of all: tells browsers exactly which domains are allowed to load scripts, styles, fonts, and images on your site. Anything from an unlisted source gets blocked. This is your strongest defense against Cross-Site Scripting attacks. If a third-party widget (live chat, booking calendar, etc.) stops working once CSP is on, add its domain to the Allowed Domains field under the CSP toggle instead of disabling the header — it gets appended to script-src, style-src, connect-src, frame-src, img-src, and font-src.

You can enable headers one at a time or use the "Enable All" button. Spork includes a tip to test your site on SecurityHeaders.com after enabling them — aim for an A grade.

Site Prep

What it does: Handles the repetitive foundation work you do on every new WordPress site — cleaning up the default content, setting sensible defaults, and getting the site ready for real use.

Every WordPress installation comes pre-loaded with demo content (a "Hello World" post, a sample page, default themes) and some default settings that aren't ideal for a real site. Site Prep automates the cleanup.

Important: Most of these options run once and then disable themselves — they're not ongoing toggles. Check the boxes for what you want done, save, and each task runs exactly once.

Available tasks:

Set Timezone — Sets the site timezone to America/Winnipeg (adjustable by a developer if needed)
SEO Permalinks — Changes the URL structure from the default ugly ?p=123 format to the clean /category/post-name/ format that search engines prefer
Disable Comments — Closes comments on all existing posts and turns them off for all future posts. Useful for business sites and portfolios that don't need a comment section
Disable Avatars — Stops WordPress from loading user profile pictures from Gravatar (a third-party service), which improves privacy and reduces external requests
Purge Hello World — Deletes the default "Hello World" demo post that comes with every WordPress install
Purge Sample Pages — Deletes the "Sample Page" and "Privacy Policy" placeholder pages
Purge Themes — Removes the bundled Twenty Twenty-Three, Twenty Twenty-Four, and Twenty Twenty-Five default themes (the ones you're not using)
Purge Plugins — Removes the default Hello Dolly and Akismet plugins that ship with WordPress

System Monitor

What it does: Gives you a detailed look at your WordPress installation, your server, and your database — all in one place.

Think of it as a health dashboard for your site's infrastructure.

What it shows:

Plugin and Theme Status — every installed plugin and theme, its version, author, and whether it's active. Performs integrity checks on both plugins and themes — comparing installed files against the WordPress.org checksums to confirm nothing has been tampered with. A "Files verified" badge means everything matches; a warning flags any unexpected additions or modifications.
Storage Usage — how much disk space your WordPress folders are using (uploads, plugins, themes, core)
Database Tables — every table in your WordPress database, its size, and how much overhead has accumulated (a sign it could benefit from optimization)
Server Information — your PHP version, memory limits, max upload size, server software, and other technical details useful for troubleshooting
Unexpected Files — files found inside the core WordPress folders that aren't supposed to be there. These could be leftover backup files, forgotten scripts, or in a worst case, malicious files planted by an attacker. For any unexpected file, you can click "View File" to see its full path, contents, owner, permissions, and modification times right in the browser.

Two-Factor Auth

What it does: Adds a second layer of protection to the WordPress login process. Even if someone knows your password, they can't get in without also having access to your email inbox.

This is called "two-factor authentication" or 2FA — the idea is that getting in requires two things: something you know (your password) and something you have (your email account).

How the login flow works:

You enter your username and password as normal
WordPress verifies the password is correct
Instead of logging you in immediately, Spork sends a 6-digit code to your email address
A second screen appears asking for that code
You enter the code (valid for 10 minutes, maximum 5 attempts)
Only then does WordPress complete the login

What you can configure:

Turn 2FA on or off
Choose which user roles require 2FA (e.g. administrators only, or all users)
Codes expire in 10 minutes and are invalidated after 5 wrong guesses, preventing code-guessing attacks

Why it matters: Password leaks are extremely common. If your password shows up in a data breach from an unrelated site (and you reused it), an attacker could walk right into your WordPress admin. 2FA makes a leaked password useless without also having access to your email.

Vulnerability Scanner

What it does: Checks every piece of software installed on your WordPress site — core, plugins, and themes — against a database of known security vulnerabilities, and tells you if anything you're running has a known bug that attackers could exploit.

Security researchers discover vulnerabilities in software every day. When they do, they're published in public databases. The Vulnerability Scanner cross-references your installed software versions against those databases so you always know if you're running something with a known issue.

How it works: Spork uses the WPScan vulnerability database — the most comprehensive database of WordPress-specific vulnerabilities, maintained by security professionals. It checks your exact installed version of each plugin, theme, and WordPress itself against every known vulnerability and tells you which ones affect you.

What it shows for each vulnerability:

Severity — Critical, High, Medium, or Low based on the CVSS (Common Vulnerability Scoring System) industry standard, with the numeric score
Title — a plain-language description of what the vulnerability is
Fixed In — the version number where the issue was patched, so you know what to update to
CVE Number — the official security advisory ID, with a direct link to the full technical details at the National Vulnerability Database
Published Date — when the vulnerability was publicly disclosed

Clean components (those with no known issues) are shown in a collapsed section so they don't clutter the view — you can expand them to confirm everything checked out.

Caching: The scanner caches results for 12 hours. The free WPScan API tier allows 25 requests per day, and most sites have fewer than 25 plugins plus themes plus core — so a daily scan stays comfortably within the free limit. If you've just updated a plugin and want to re-check immediately, use the "Force Fresh" button to bypass the cache.

Scheduled scanning: Set it to run daily or weekly and receive email alerts whenever vulnerabilities are found.

Getting started: You'll need a free API key from wpscan.com — registration is free and the free tier covers most sites.

Changelog

A record of all notable changes to Spork Tools, newest version first.

1.4.8 — 2026-07-12

Fixed

Content-Security-Policy (CSP) — WordPress core's default emoji CDN (cdn.jsdelivr.net) wasn't in the CSP img-src allowlist, so emoji rendered as broken images on any site with CSP enabled running WordPress 7.0+. Added https://cdn.jsdelivr.net to the default img-src directive.

1.4.7 — 2026-07-01

Added

Integrity Monitor — Each flagged file (modified, missing, unexpected, or a stray PHP file in uploads) now has an "Ignore" action, and unexpected/uploads files also get a "Delete" action. Ignored items move to a dedicated "Ignored Items" section with an "Un-ignore" option, and no longer count as issues.

Fixed

Integrity Monitor — Email alerts were re-sent on every scheduled scan for the same unresolved file. The scanner now only emails when there's a genuinely new (previously unseen) issue; a resolved issue that recurs later will alert again.

1.4.6 — 2026-07-01

Fixed

Auto-Updater — spork-update.json was being written with a UTF-8 byte-order mark (BOM) by the release script. A leading BOM makes PHP's json_decode() silently return null, which means every Spork install (including this one) has been failing to detect new versions via the self-update check, with no visible error anywhere. The release script now writes the file without a BOM, and the plugin strips a BOM defensively before decoding as a safety net.

1.4.5 — 2026-06-30

Fixed

8G Firewall — The Apache-level ruleset was blocking requests to the Spork update feed (/scripts/spork/) when a caller's HTTP User-Agent was empty or matched a generic client-library signature. This could silently prevent other Spork installs from detecting or downloading updates from nanoapps.ca, since the block happens before WordPress loads and produces no visible error. The update feed path is now exempt from all 8G ruleset checks.

1.4.4 — 2026-06-30

Fixed

Firewall Log — "Whitelist" button now uses a POST form instead of a GET link, fixing a 403 nonce failure that occurred when caching or session state caused the GET-based nonce to be rejected.

1.4.3 — 2026-06-30

Added

License — "View Changelog" link next to the version number, pointing to the release notes on the manual page.

1.4.2 — 2026-06-30

Added

License — Plugin version number now shown in the License page table.

1.4.1 — 2026-06-30

Fixed

Admin notices — "Settings saved" and other in-page notices now show white text correctly against the dark background. WordPress admin CSS was overriding the inherited text color on
elements inside notice divs.

1.4 — 2026-06-28

Added

Security Headers — CSP now has an "Allowed Domains" field. Add a third-party widget's domain (live chat, booking calendar, etc.) and it's appended to script-src, style-src, connect-src, frame-src, img-src, and font-src, so you no longer have to disable CSP entirely to make a blocked widget work.
Firewall Log — Search box filters the table live by IP, reason, URI, or user agent as you type.
Firewall Log — Click any column header to sort the table by that column; click again to reverse direction.

Changed

Firewall Log — Now shows the last 500 entries instead of 200.
Security Hardening — "Disable User Enumeration" description now mentions it also removes the /wp/v2/users REST endpoints (it already did this; the description just didn't say so).

1.3 — 2026-05-19

Added

License System — Plugin now requires a valid license key to unlock features. Enter your key under Spork → License. Includes a 7-day grace period if the license server is temporarily unreachable.

1.2 — 2026-05-19

Added

Firewall Log — "Whitelist" button on each log row; one click adds the blocked IP to the allowlist with a confirmation prompt. IPs already on the allowlist show a "✓ Allowlisted" indicator instead.
Security Hardening — New toggle "Log Unauthenticated REST Requests" (Enumeration & REST section). When enabled, writes every unauthenticated REST request (method, URI, IP, all headers) to the PHP error log. Viewable in the Debug Log tab. Off by default.

Fixed

Security Hardening — "Restrict REST API to Logged-In Users" now only blocks unauthenticated access to core WordPress namespaces (/wp/). Custom plugin namespaces (e.g. Xagio SEO, WooCommerce, contact form plugins) are passed through so they can handle their own authentication. Previously, any unauthenticated REST request was rejected with 401 regardless of namespace.
Security Hardening — Updated description for the REST restriction option to clarify the new behaviour.

1.1 — 2026-05-10

Added

Code Snippets — New module. Inject custom HTML, JavaScript, or CSS into four page locations: wp_head, wp_body_open, wp_footer, and admin_head. Toggle snippets on/off without deleting them. Includes presets for GA4, Google Tag Manager (head + body), Facebook Pixel, and Hotjar.
Firewall — AbuseIPDB IP reputation integration. Checks visitor IPs against the AbuseIPDB crowd-sourced abuse database. Results cached for 6 hours to stay within the free API limit (1,000 checks/day). Configurable confidence score threshold (default 75). New spork_fw_abuseipdb_enabled toggle and API key field in settings.
Malware Scanner — Hybrid Analysis and FileScan.io external scan integrations, alongside the existing VirusTotal integration. New "Scan with All Services" option to run all configured scanners in parallel from the file detail modal.
Malware Scanner — Severity filter settings (spork_malware_show_high/medium/low). Control which severity levels appear in scan results and trigger email alerts.

Changed

Core — Module loading split into frontend and admin/cron groups. Security, firewall, 2FA, and activity log modules load on every request; admin-only modules (optimizer, scanner, monitor, etc.) load only in the WP admin area or during cron. Reduces memory usage on public-facing pages.
Firewall — wp-admin path detection switched from strpos to regex (/wp-admin(/|$)/) to prevent false positives on custom paths like /wp-admin-custom/.
Malware Scanner — VirusTotal file upload migrated from curl_init() to wp_remote_post() for better proxy and SSL compatibility.
Security Hardening — Code consolidation and refactoring (net file size reduction).

Fixed

Two-Factor Auth — OTP token moved from URL query parameter to an HttpOnly; Secure; SameSite=Strict cookie. Prevents token exposure in server logs, browser history, and HTTP Referer headers.

1.0 — 2026-04-27

Changed

Dashboard — Admin menu icon updated to custom spork SVG (white, proper fill-rule path).
Dashboard — Emoji icons added to all module cards. Vulnerability Scanner card added to dashboard.
Dashboard — Module card order adjusted; Debug Log moved to match admin menu order.

0.9 — 2026-04-26

Initial release. Includes all core modules:

A Note on Defaults

Spork is designed to be safe out of the box. Features that could affect how your site behaves — the Firewall, Security Headers, Security Hardening options, Maintenance Mode — are all off by default. You turn on what you need, when you're ready. Nothing activates automatically just by installing the plugin.

The Auto-Updater is the exception: it defaults to on, because keeping software updated is nearly always the right choice for security.

Spork Tools is developed by NanoApps. For support, visit nanoapps.ca.

↑ Back to top