One plugin.
Sixteen tools.
WP Toolkit bundles security, maintenance, performance, and monitoring into a single clean dashboard — so you can stop juggling five separate plugins (each one slowing your site down a little).
WP Toolkit (1 license)
$50.00 CAD
WP Toolkit (100 License)
$100.00 CAD
WP Toolkit (1000 license)
$200.00 CAD
Stop running six plugins to do one job.
Most WordPress sites end up with a tangled stack — a security plugin, a backup plugin, an optimizer, an activity logger, a 2FA add-on, an update manager. Each one adds weight, eats memory, and demands its own settings page.
WP Toolkit replaces all of them. Same protection, same automation, one clean codebase, one settings panel.
- Built as a single, lightweight admin plugin
- Safe defaults — nothing risky activates on install
- Every module is independent — turn on what you need
- Plain-language settings, no jargon walls
- No upsells, no premium tier, no nag screens
Six layers of protection, all in one place.
Firewall
Blocks SQL injection, XSS, directory traversal, and 20+ known scanning tools before they reach your code. Includes IP allowlist/blocklist, AbuseIPDB reputation checking, wp-admin lockdown with an emergency recovery URL, and a one-click Whitelist button in the Firewall Log to instantly allowlist any blocked IP.
Two-Factor Auth
Email-based 6-digit codes after password login. Configurable by user role, with built-in protection against code-guessing.
Security Hardening
Disable XML-RPC, limit login attempts, hide version numbers, block PHP execution in uploads, and 15+ other independent toggles.
Security Headers
HSTS, CSP, X-Frame-Options, Permissions-Policy, and more. Aim for an A grade on SecurityHeaders.com with a single click.
Malware Scanner
Pattern-matches every plugin, theme, and upload file against known malware signatures. Severity filter controls which findings are shown. External Scan submits flagged files to VirusTotal, Hybrid Analysis, or FileScan.io — individually or all at once.
Vulnerability Scanner
Cross-references your installed versions against the WPScan database. Severity scores, CVE links, and the exact version that fixes each issue.
Keeps the site fast and fresh, automatically.
Auto-Updater
Core, plugins, themes, and translations stay current without you logging in. Silent Mode hushes the email firehose if you manage multiple sites.
Database Optimizer
Clears post revisions, trash, spam, and orphaned data. Audits autoloaded options and flags anything suspiciously bloated. Browse every database table with its owner and status, and optimize, empty, or delete any of them. Schedule it weekly.
Image Optimizer
Resizes and compresses photos the moment they're uploaded. Configurable max width and JPEG quality. No more 6MB phone photos slowing pages down.
Page Cache
Full-page caching for logged-out visitors — on by default. Automatically clears on publish, comment, theme switch, or plugin activation.
Know what's happening on your site at a glance.
Activity Log
Records every login, edit, install, and user change with timestamp and IP. Up to 10,000 entries, searchable and CSV-exportable. Includes admin account creation alerts.
System Monitor
Plugin and theme integrity checks, storage usage, database table sizes, server info, a full cron event schedule with owner detection, and a scan for unexpected files in core directories.
Error Logs
Read PHP and WordPress debug logs straight from the admin — no FTP needed. WP_DEBUG toggle is right there too.
For launches, redesigns, and the boring setup work.
Maintenance Mode
A clean "we'll be right back" page for visitors while logged-in users see the live site. Sends the correct 503 status to Google so your rankings stay safe.
Site Prep
One-time cleanup tasks for new installs — purge Hello World, sample pages, default themes, set permalinks, disable comments. Tick the boxes, save, done.
Code Snippets
Inject custom HTML, JavaScript, or CSS into your site's head, footer, or body. Quick-fill presets for Google Analytics 4, Google Tag Manager, Facebook Pixel, and Hotjar.
A few favourites worth pointing out
Emergency Access URL
Locked wp-admin to your IP, then your IP changed at the coffee shop? Visit your secret bookmarked URL from any device — it adds your new IP to the allowlist, drops you at the login page, then self-destructs.
Admin Account Alerts
The moment any new admin is created — or any user gets promoted — you get an email and a red banner across the dashboard. Stops one of the most common post-breach persistence tricks cold.
WPScan-Backed Scanning
Daily checks against the most respected WordPress vulnerability database, with severity scores, fix versions, and CVE links. Cached smartly so a site of typical size never exceeds the free API tier.
Ready to clean up your plugin list?
WP Toolkit is built and maintained by NanoApps. Install it like any other WordPress plugin.