WP Toolkit — Complete Feature Guide
WP Toolkit is an all-in-one WordPress admin plugin that handles security, maintenance, performance, and monitoring — all from a single, clean dashboard. Instead of juggling five or six separate plugins (each slowing your site down a little), WP Toolkit puts everything under one roof. This guide walks through every feature in plain language so you know exactly what each tool does and when to use it.
The Dashboard
When you open WP Toolkit, you land on the Hub — a card-based overview of all available modules. Each card has a short description and a button that takes you straight to that tool’s settings. Think of it as your site’s mission control.
Activity Log
What it does: Keeps a running diary of everything that happens on your site.
Every time someone logs in (or tries to and fails), creates or edits a post, uploads or deletes a photo, installs or removes a plugin, changes a theme, or modifies user accounts — WP Toolkit writes it down. Each entry records the date and time, who did it, their IP address, and a plain-English description of what happened.
Why it matters: If something goes wrong on your site — a post disappears, settings change unexpectedly, or you suspect someone unauthorized got in — the Activity Log is the first place you look. It’s your paper trail.
Key features:
- Stores up to 10,000 entries before automatically removing the oldest ones
- Search the log by user, IP address, or any keyword
- Sort newest-to-oldest or oldest-to-newest
- Export the entire log as a spreadsheet (CSV) for record-keeping
- Clear the log when you want a fresh start
Auto-Updater
What it does: Keeps your WordPress site up to date automatically, without you having to log in and click “Update” manually.
Out of the box, WordPress only auto-applies small security fixes. WP Toolkit extends that to cover everything.
What you can auto-update:
- WordPress Core — the main WordPress software itself, including major version upgrades (e.g. 6.5 → 6.6)
- Plugins — all installed plugins stay on their latest versions
- Themes — all installed themes stay current
- Translations — language files update automatically
Silent Mode: By default, WordPress emails you every time it runs an automatic update. With Silent Mode on, those emails stop. Useful if you manage multiple sites and don’t want your inbox flooded.
Why it matters: The number one reason WordPress sites get hacked is outdated software with known security holes. Auto-updates close those holes the moment a fix is available, without requiring any action on your part.
Code Snippets
What it does: Lets you inject custom HTML, JavaScript, or CSS code into specific locations on your site without editing any theme files.
This is the tool for adding tracking scripts, tag managers, analytics pixels, heat-map tools, live chat widgets, or any other third-party embed code that a service tells you to “paste into the head of your site.”
Injection locations:
- Head — inserted just before
</head>. The right place for analytics scripts, tracking pixels, and anything that needs to load early. - Body Open — inserted immediately after the opening
<body>tag. Required by Google Tag Manager’s noscript fallback. Needs a theme that callswp_body_open()— all modern WordPress themes do. - Footer — inserted just before
</body>. The right place for deferred scripts, chat widgets, and anything that doesn’t need to block page rendering. - Admin Head — inserted in the WordPress admin area only, not on the public site. Useful for internal dashboards or admin-only tools.
Quick-fill presets: The add form includes one-click presets for the most common services — click a preset button and the form fills in automatically with the correct template code and location. Available presets:
- Google Analytics 4
- Google Tag Manager (Head snippet)
- Google Tag Manager (Body noscript)
- Facebook / Meta Pixel
- Hotjar
After selecting a preset, replace the placeholder IDs (e.g. G-XXXXXXXXXX, GTM-XXXXXXX) with your real account IDs before saving.
Managing snippets: Your saved snippets appear in a table with a toggle switch on each row. Flip the switch to enable or disable a snippet instantly without deleting it — useful for temporarily turning off a tracking script without losing the code. Each snippet also has Edit and Delete actions.
Database Optimizer
What it does: Cleans up the clutter that accumulates in your WordPress database over time.
Every time you edit a post, WordPress saves a copy of the old version (called a “revision”). Delete a post? It goes to trash first. Get a spam comment? It sits in the spam folder. Plugins often leave behind temporary data (called “transients”) that should have been cleaned up automatically but wasn’t. Over months and years, all of this adds up to a bloated database that can slow your site down.
What it cleans:
- Post revisions — old saved versions of your posts and pages
- Trashed posts — content sitting in the trash
- Spam comments — filtered-out spam that’s still taking up space
- Trashed comments — deleted comments sitting in the trash
- Expired transients — temporary plugin data that’s past its expiry date
- Orphaned post metadata — leftover data from posts that no longer exist
Autoloaded Options Audit: WordPress loads certain settings into memory on every single page load. If plugins have stuffed large amounts of data into this “autoloaded” list, your site loads slower on every request. The Database Optimizer shows you everything that’s autoloaded, how big it is, and flags anything suspiciously large so you know where to investigate.
Scheduled cleanup: You can set the optimizer to run automatically every week so it stays clean without any effort on your part.
Tables tab: Lists every table in your database — table name, best-effort owner, install status, row count, and size. Owner detection is authoritative for WordPress core and WP Toolkit’s own tables, and best-effort (a curated list of common plugins matched by table prefix) for everything else; anything unmatched shows as “Unknown” rather than a guess. Status shows whether the owning plugin is currently Active, installed but Inactive, or Abandoned — no matching plugin folder found at all, a common sign of leftover tables from an old uninstall. Click any column header to sort by that column; click again to reverse. Each table has an Optimize button (safe, defragments the table). Empty (deletes all rows, keeps the table) and Delete (drops the table entirely) are available for everything except WordPress core tables, which stay Optimize-only. WP Toolkit’s own log tables (Activity Log, Firewall Log) also get an Empty button — matching the “Clear Log” action already available on those modules’ own pages — but not Delete, since dropping the table would break the module until reactivation.
Firewall
What it does: Acts as a security checkpoint that stops malicious traffic before it ever reaches your site’s code.
Think of it like a bouncer at the door. Every incoming web request gets checked against a set of rules, and anything suspicious gets turned away with a “403 Access Denied” response.
What it blocks:
- SQL Injection — attackers trying to manipulate your database by sneaking commands into web addresses or form fields
- Cross-Site Scripting (XSS) — attempts to inject malicious scripts into your pages
- Directory Traversal — attempts to navigate your server’s folder structure and read files they shouldn’t
- Sensitive File Access — requests specifically targeting WordPress configuration files, Git folders, environment files, and other things that should never be publicly accessible
- Bad Bots — known vulnerability scanning tools (sqlmap, nikto, nmap, nuclei, and 20+ more) are recognized by their user agent signature and blocked outright
- Empty User Agents — legitimate browsers and search engines always identify themselves. Requests with no identification at all are almost always automated attack tools
IP Allowlist: A list of IP addresses that are always let through — no matter what. Put your own IP address here to guarantee you’re never accidentally blocked.
IP Blocklist: A list of IP addresses that are always blocked — no matter what. If you see the same IP address repeatedly attacking your site in the Firewall Log, add it here.
AbuseIPDB IP Reputation: Automatically blocks visitors whose IP address has a high abuse reputation score. When enabled, each visitor’s IP is checked against AbuseIPDB — a community-maintained database of IPs reported for hacking, spam, and DDoS attacks. You set a confidence threshold (0–100; 75 is the recommended starting point), and any IP scoring at or above it is blocked immediately. Scores are cached for 6 hours per IP so you stay well within the free API limit of 1,000 checks per day. Requires a free API key from abuseipdb.com.
Restrict wp-admin to Allowlist IPs: The most powerful protection — only IP addresses you’ve explicitly approved can even reach the WordPress login page or admin area. Everyone else gets a 403 before they can attempt a login. When you turn this on, WP Toolkit automatically adds your current IP to the allowlist so you don’t lock yourself out immediately.
Firewall Log: Every blocked request is recorded — the IP address, the reason it was blocked, the URL it was trying to reach, and the browser/tool it identified as. Stores up to 5,000 entries and shows the most recent 500 in the table, which can be cleared at any time. Each entry has a Whitelist button — click it to instantly add that IP to the allowlist without leaving the log.
Use the search box above the table to filter live by IP, reason, URL, or user agent as you type. Click any column header to sort the table by that column — click again to reverse the order.
Image Optimizer
What it does: Automatically shrinks and compresses photos when you upload them to your site, so your pages load faster without you having to manually resize anything.
Large photos are one of the most common reasons websites load slowly. A photo taken on a modern smartphone can easily be 4–6 megabytes and 4,000+ pixels wide — far larger than anything a website actually needs to display.
How it works:
- When you upload a photo, WP Toolkit intercepts it before it saves to your media library
- It resizes it so the longest side doesn’t exceed your configured maximum (default: 1,024 pixels — suitable for most blog images)
- It compresses the quality slightly (default: 82 out of 100 — visually identical to the original on screen, but noticeably smaller in file size)
- The oversized original is replaced with the optimized version, saving disk space
What you can configure:
- Maximum image width — anywhere from 200px to 5,000px depending on your site’s design needs
- JPEG quality — lower = smaller files, higher = better quality. 80–85 is the sweet spot for most sites
Why it matters: Faster pages mean happier visitors and better Google rankings. Image optimization is one of the highest-impact performance improvements you can make.
Logs
What it does: Lets you read your server’s error logs right from the WordPress admin — without needing FTP access or a server control panel.
When something breaks on your site, PHP (the programming language WordPress runs on) writes a note about what went wrong to a log file. Normally you’d need technical server access to read those files. WP Toolkit surfaces them directly in the admin.
What it shows:
- The last 100 lines of your WordPress debug log
- The last 100 lines of your server’s PHP error log
- Any additional error logs it finds nearby
WP_DEBUG toggle: WordPress has a built-in debugging mode that makes error messages more detailed and writes them to a log file. Normally turning this on requires editing your wp-config.php file (a technical task). WP Toolkit adds a simple checkbox to turn it on or off right from this page.
Log management: Each log file has a “Delete” button if you want to clear it and start fresh. Useful after fixing a bug to confirm the errors stop appearing.
Why it matters: When a plugin is throwing errors, a page is breaking, or something isn’t working as expected — the error log is where you find out why.
Maintenance Mode
What it does: Shows a “we’ll be right back” page to your visitors while you work on the site behind the scenes.
If you’re making big changes — redesigning a page, installing a new theme, doing a major update — you don’t want visitors stumbling onto a half-finished site. Maintenance Mode solves this by showing an attractive holding page to anyone who visits, while you continue working normally in the admin.
How it works: Anyone who isn’t logged in sees the maintenance page. Anyone who is logged in (regardless of their role) sees the live site as normal. So you can work, preview your changes, and have colleagues review the site while the public sees the maintenance message.
What you can customize:
- Headline — the main message (default: “We’ll Be Right Back”)
- Message body — the explanatory text below it
- Image — upload your own logo or illustration, or use the built-in default graphic
The page sends a 503 Service Unavailable status to browsers and search engines, which is the correct signal for temporary downtime — Google knows to come back later rather than removing your pages from its index.
Malware Scanner
What it does: Scans every file in your WordPress plugins folder, themes folder, and uploads folder looking for code that malware typically uses.
Hackers who successfully break into a WordPress site usually leave behind hidden code — often buried deep in plugin files or disguised as image uploads — that lets them maintain access, steal data, or redirect your visitors to malicious sites. This code has recognizable patterns, and WP Toolkit knows what to look for.
How it works: WP Toolkit reads through your files line by line and checks each one against a library of known-bad patterns, organized by risk level:
- High Risk — things like encoded commands that execute whatever a hacker sends them, known web shell file names (c99, r57, b374k — these are hacker tools that give full server control), and code that runs dangerous functions based on visitor input
- Medium Risk — dangerous functions used in a suspicious context, remote code inclusion, and other patterns that are sometimes legitimate but worth reviewing
- Low Risk — things like
phpinfo()calls (a developer diagnostic tool that shouldn’t be left in production code)
Severity Filter: A High / Medium / Low filter controls which findings appear in the results table and are included in email alerts. By default only High severity findings are shown — Medium and Low are hidden until you need them. The summary counts at the top of the page always reflect all findings regardless of the filter.
External Scan: For any flagged file, click 🔬 External Scan to submit it to one or more external security services. Three services are supported: VirusTotal (checks against 70+ antivirus engines), Hybrid Analysis (sandboxed behavioral analysis), and FileScan.io (multi-engine static and dynamic analysis). You can scan with each service individually, or use the Scan All Enabled Services button to query all configured services in parallel with a single click. Files are always checked by hash first — file content is only uploaded if the hash isn’t already known to the service. Each service requires its own free API key, configured in Scanner Settings.
File Viewer: Click “View File” on any flagged item to read its contents right in the browser. You’ll also see who owns the file on the server, when it was last modified, and a “Likely Origin” guess about how it got there — useful for figuring out whether a file is legitimate or suspicious.
Scheduled scanning: You can schedule automatic scans (daily or weekly) with email alerts if anything suspicious is found, so you don’t have to remember to check manually.
Page Cache
What it does: Saves a static HTML copy of each page the first time a logged-out visitor loads it, then serves that copy directly for a set duration instead of rebuilding the page from scratch on every request. On by default.
WordPress normally rebuilds every page from the database on every single visit — running PHP, querying the database, and assembling the HTML from scratch each time, even if the page hasn’t changed. Page Cache skips all of that for repeat visitors by serving a saved copy instead.
How it works: The first time a logged-out visitor loads a page, WP Toolkit saves the fully-rendered HTML to disk. Every subsequent visit to that same URL is served directly from that saved copy — no database queries, no PHP page-building — until it expires or gets cleared. Logged-in users always see a freshly-generated page, never a cached one.
Automatic cache clearing: The entire cache is cleared automatically whenever you publish or edit a post, add a comment, switch themes, or activate/deactivate a plugin — so visitors never see stale content after a change.
Settings:
- Ignore Unrecognized Query Parameters — On by default. Normally, a URL with an unrecognized
?query=stringparameter skips the cache entirely, since that parameter might change what’s on the page. Some bots deliberately attach random parameters on every request specifically to defeat page caches. With this on, unrecognized parameters are ignored for caching purposes, so those requests still get served from cache. A fixed set of parameters that commonly affect page content (like search and sorting) always skip the cache regardless of this setting. - Cache Duration — How many minutes a cached page stays valid before it’s rebuilt fresh on the next visit. Defaults to 1,440 minutes (24 hours).
The settings page shows live status — whether the cache is actually installed and active, how many pages are currently cached, and total cache size — along with a manual Clear Cache button.
Security Hardening
What it does: Tightens up a long list of WordPress security settings that are either off by default or configured in a way that’s convenient but not particularly secure.
Each option is independent — you can enable exactly the ones that make sense for your site.
Login & Access
- Disable XML-RPC — XML-RPC is an old remote-access protocol that’s heavily targeted by attackers for brute-force and DDoS attacks. Most modern sites don’t need it. Disable it unless you use the WordPress mobile app or Jetpack.
- Limit Login Attempts — After a configurable number of failed login attempts (default: 5), that IP address is locked out for 30 minutes. Makes automated password-guessing attacks impractical.
- Hide Login Error Details — By default WordPress tells you “wrong password” or “no account with that username.” That helps attackers confirm which usernames exist. This option replaces both messages with a single vague response.
- Remove WordPress Version Number — WordPress puts its version number in your page’s HTML source code. This makes it easy for scanners to find sites running outdated versions. WP Toolkit removes it.
- Disable Admin Bar for Non-Admins — Hides the black WordPress toolbar at the top of the page for subscribers, customers, and other non-admin roles.
- Disable User Registration — If you don’t need public user accounts on your site, turn this off. Prevents spam bot registrations.
- Block New Admin Account Creation — On by default. Prevents any user from being created with, or promoted to, the administrator role — including via compromised code or a vulnerable plugin, not just the Add User screen. The account is still created, but WP Toolkit immediately demotes it and logs the event. If you actually need to add or promote an admin, turn this off first — a warning with a direct link to this setting appears right on the Add New User screen so you don’t get caught out mid-task.
Feeds & Head
- Disable RSS/Atom Feeds — If you don’t need people to subscribe to your content via RSS readers, this turns those URLs off and redirects visitors to your homepage.
- Disable oEmbed — Prevents other websites from automatically embedding your content and removes the discovery links from your page’s head section.
- Remove RSD & WLW Manifest Links — Removes two old legacy links from your page’s HTML that most sites don’t use. They reveal that you’re running WordPress and serve no purpose on modern sites.
Files & Directories
- Disable Theme & Plugin File Editing — WordPress has a built-in code editor that lets admins edit plugin and theme files directly in the browser. If a hacker gets into your admin area, this is an easy way for them to inject malicious code. Disabling it removes that risk.
- Disable All File Modifications — A stronger version of the above: blocks all plugin/theme installs, updates, and file edits from the WordPress admin. For high-security sites where all changes go through a developer.
- Disable Directory Browsing — If a folder on your server doesn’t have an index page, some servers will show visitors a list of all files in that folder. This turns that off.
- Block PHP Execution in Uploads Folder — Your uploads folder (where images and files go) should never run code. This places a security rule that prevents any PHP, Perl, Python, or shell scripts in that folder from being executed — even if a hacker manages to upload one disguised as an image.
- 8G Firewall — A comprehensive set of server-level firewall rules that block attack patterns before they even reach WordPress. Covers malicious URLs, known hacking tool signatures, dangerous HTTP methods, and suspicious referrers. Based on the well-regarded 8G Firewall by Jeff Starr.
Enumeration & REST
- Disable User Enumeration — WordPress has a quirk where visiting
yoursite.com/?author=1redirects to a URL that reveals your admin username. Attackers use this to collect usernames for brute-force attacks. This blocks that, and also removes the/wp/v2/usersREST API endpoints, which list usernames the same way. - Remove Generator Meta Tag — Removes the HTML tag that announces “this site runs WordPress version X.X.” Less information for scanners.
- Restrict REST API to Logged-In Users — Limits the core WordPress REST API (
/wp/v2/and related core endpoints) to logged-in users only. Third-party plugin REST endpoints — such as SEO tools, booking systems, and other integrations — are not affected and remain publicly accessible. If a connected service stops working after enabling this, use the Log Unauthenticated REST Requests toggle below to identify which endpoint it’s hitting.
Security Headers
What it does: Adds a set of invisible instructions to every page your site sends out, telling visitors’ browsers how to behave — specifically, what to trust and what to reject.
These are called HTTP security headers, and they’re one of the most effective defenses against certain types of attacks. Browsers that receive them will refuse to do things that attackers commonly exploit.
The headers WP Toolkit can add:
- Strict-Transport-Security (HSTS) — Tells browsers “this site is always HTTPS — never try HTTP.” For the next year, your browser will automatically use the secure version, even if someone tries to redirect you to an insecure version. Only enable this if your entire site runs on HTTPS.
- X-Frame-Options — Prevents your site from being loaded inside an invisible frame on another website — a trick called “clickjacking” where visitors think they’re clicking your content but they’re actually clicking something malicious overlaid on top.
- X-Content-Type-Options — Stops browsers from guessing what type of file something is and executing it accordingly. Prevents certain file-based attacks.
- Referrer-Policy — Controls how much information your site shares when visitors click a link to another site. By default browsers send the full URL you came from — this limits it to just the domain name, protecting user privacy.
- Permissions-Policy — Explicitly blocks your site from ever accessing visitors’ camera, microphone, location, or payment APIs. Even if a script is somehow injected into your page, it can’t silently activate those features.
- Content-Security-Policy (CSP) — The most powerful of all: tells browsers exactly which domains are allowed to load scripts, styles, fonts, and images on your site. Anything from an unlisted source gets blocked. This is your strongest defense against Cross-Site Scripting attacks. If a third-party widget (live chat, booking calendar, etc.) stops working once CSP is on, add its domain to the Allowed Domains field under the CSP toggle instead of disabling the header — it gets appended to script-src, style-src, connect-src, frame-src, img-src, and font-src.
You can enable headers one at a time or use the “Enable All” button. WP Toolkit includes a tip to test your site on SecurityHeaders.com after enabling them — aim for an A grade.
Site Prep
What it does: Handles the repetitive foundation work you do on every new WordPress site — cleaning up the default content, setting sensible defaults, and getting the site ready for real use.
Every WordPress installation comes pre-loaded with demo content (a “Hello World” post, a sample page, default themes) and some default settings that aren’t ideal for a real site. Site Prep automates the cleanup.
Available tasks:
- Set Timezone — Sets the site timezone to America/Chicago, Central Time with DST (adjustable by a developer if needed)
- Permalinks — Changes the URL structure from the default ugly
?p=123format to the clean/category/post-name/format that search engines prefer - Disable Comments — Closes comments on all existing posts and turns them off for all future posts. Useful for business sites and portfolios that don’t need a comment section
- Disable Avatars — Stops WordPress from loading user profile pictures from Gravatar (a third-party service), which improves privacy and reduces external requests
- Purge Defaults — Deletes the default “Hello World” post, the “Sample Page” and “Privacy Policy” placeholder pages, the bundled Twenty Twenty-Three/Four/Five themes, and the default Hello Dolly and Akismet plugins — all in one step
System Monitor
What it does: Gives you a detailed look at your WordPress installation, your server, and your database — all in one place.
Think of it as a health dashboard for your site’s infrastructure.
What it shows:
- Plugin and Theme Status — every installed plugin and theme, its version, author, and whether it’s active. Performs integrity checks on both plugins and themes — comparing installed files against the WordPress.org checksums to confirm nothing has been tampered with. A “Files verified” badge means everything matches; a warning flags any unexpected additions or modifications.
- Storage Usage — how much disk space your WordPress folders are using (uploads, plugins, themes, core)
- Database Tables — every table in your WordPress database, its size, and how much overhead has accumulated (a sign it could benefit from optimization)
- Server Information — your PHP version, memory limits, max upload size, server software, and other technical details useful for troubleshooting
- Unexpected Files — files found inside the core WordPress folders that aren’t supposed to be there. These could be leftover backup files, forgotten scripts, or in a worst case, malicious files planted by an attacker. For any unexpected file, you can click “View File” to see its full path, contents, owner, permissions, and modification times right in the browser.
- Cron — every WP-Cron event scheduled on the site: name, frequency, next run time and date, and owner. Owner is resolved from WordPress core’s well-known cron hooks, WP Toolkit’s own scheduled tasks, and a best-effort match against installed plugins and themes; anything unmatched shows as “Unknown” rather than a guess. Past-due events are highlighted — WP-Cron only runs on a page visit, so this usually just means the site had no visitors since, not that something is broken.
Two-Factor Auth
What it does: Adds a second layer of protection to the WordPress login process. Even if someone knows your password, they can’t get in without also having access to your email inbox.
This is called “two-factor authentication” or 2FA — the idea is that getting in requires two things: something you know (your password) and something you have (your email account).
How the login flow works:
- You enter your username and password as normal
- WordPress verifies the password is correct
- Instead of logging you in immediately, WP Toolkit sends a 6-digit code to your email address
- A second screen appears asking for that code
- You enter the code (valid for 10 minutes, maximum 5 attempts)
- Only then does WordPress complete the login
What you can configure:
- Turn 2FA on or off
- Choose which user roles require 2FA (e.g. administrators only, or all users)
- Codes expire in 10 minutes and are invalidated after 5 wrong guesses, preventing code-guessing attacks
Why it matters: Password leaks are extremely common. If your password shows up in a data breach from an unrelated site (and you reused it), an attacker could walk right into your WordPress admin. 2FA makes a leaked password useless without also having access to your email.
Vulnerability Scanner
What it does: Checks every piece of software installed on your WordPress site — core, plugins, and themes — against a database of known security vulnerabilities, and tells you if anything you’re running has a known bug that attackers could exploit.
Security researchers discover vulnerabilities in software every day. When they do, they’re published in public databases. The Vulnerability Scanner cross-references your installed software versions against those databases so you always know if you’re running something with a known issue.
How it works: WP Toolkit uses the WPScan vulnerability database — the most comprehensive database of WordPress-specific vulnerabilities, maintained by security professionals. It checks your exact installed version of each plugin, theme, and WordPress itself against every known vulnerability and tells you which ones affect you.
What it shows for each vulnerability:
- Severity — Critical, High, Medium, or Low based on the CVSS (Common Vulnerability Scoring System) industry standard, with the numeric score
- Title — a plain-language description of what the vulnerability is
- Fixed In — the version number where the issue was patched, so you know what to update to
- CVE Number — the official security advisory ID, with a direct link to the full technical details at the National Vulnerability Database
- Published Date — when the vulnerability was publicly disclosed
Clean components (those with no known issues) are shown in a collapsed section so they don’t clutter the view — you can expand them to confirm everything checked out.
Caching: The scanner caches results for 12 hours. The free WPScan API tier allows 25 requests per day, and most sites have fewer than 25 plugins plus themes plus core — so a daily scan stays comfortably within the free limit. If you’ve just updated a plugin and want to re-check immediately, use the “Force Fresh” button to bypass the cache.
Scheduled scanning: Set it to run daily or weekly and receive email alerts whenever vulnerabilities are found.
Getting started: You’ll need a free API key from wpscan.com — registration is free and the free tier covers most sites.
Changelog
A record of all notable changes to WP Toolkit, newest version first.
1.7.3 — 2026-07-29
Security
- Page Cache — Patched a security issue in the page cache. Sites should update as soon as possible.
- Cache drop-in auto-refresh — The installed cache drop-in now stays in sync with the plugin’s own version, so future security and bug fixes to it reach sites automatically on the next admin visit instead of requiring the cache to be manually toggled off and back on.
Fixed
- Page Cache — Deactivating the plugin (not just toggling the cache setting off) left the drop-in, the
WP_CACHEconstant, and the whole cache in place — the drop-in reads from disk before plugins load at all, so it isn’t gated by WordPress’s own plugin-active check. A logged-out visitor could keep seeing stale cached pages for up to the full cache duration after deactivation. The plugin now removes the drop-in on deactivation, and correctly restores it on reactivation if the cache is still supposed to be enabled. - Page Cache — Widget and menu changes (Appearance → Widgets, Appearance → Menus) didn’t purge the cache; only Customizer-based changes did. Added
update_option_sidebars_widgetsandwp_update_nav_menuto the purge triggers. - Page Cache — HEAD requests served from cache incorrectly included the full response body via
readfile(). Now sends headers (including a correctContent-Length) with no body for HEAD requests, matching HTTP semantics.
Changed
- Page Cache — The one-time default-bootstrap check ran 3 database queries on every single
admin_init, forever, instead of just once. Now short-circuits after the first successful check. - Page Cache — The cache-file count/size shown on the settings page is now cached for 1 minute instead of walking the entire cache directory on every page load.
1.7.2 — 2026-07-29
Security
- Page Cache — Patched a security issue in the page cache. Sites should update as soon as possible.
- System Monitor — Patched a security issue in the file-integrity viewer. Sites should update as soon as possible.
Changed
- Release tooling —
update-page.py‘s WordPress application-password credential is no longer hardcoded in the file; it’s read from aWPTOOLKIT_NANOAPPS_CREDSenvironment variable, set once at the OS user level.build.ps1checks for it and fails with a clear message if unset, rather than silently having nothing to read.
1.7.1 — 2026-07-19
Fixed
- Page Cache — Caching never actually activated on a site installed via a fully automated flow (e.g.
wp plugin install --activate) that never loads wp-admin, since the only code that installs theadvanced-cache.phpdrop-in and theWP_CACHEconstant was wired toadmin_init, which never fires on that path. The Page Cache settings page could still show “Active” (a PHP-level default, not a check of what’s actually installed), while the site silently cached nothing. The bootstrap now also runs from the plugin’s existing activation hook, which fires on every install path, including CLI activation — closing the gap for good.
1.7 — 2026-07-18
Added
- System Monitor — New “Cron” tab. Lists every scheduled WP-Cron event on the site — name, frequency, next run time and date, and owner — sortable by any column. Owner detection is authoritative for WordPress core (a hardcoded set of well-established core hooks) and WP Toolkit’s own scheduled tasks; everything else is matched against installed plugins and themes by whether the plugin/theme’s slug appears in the hook name, falling back to “Unknown” rather than a wrong guess. Past-due events are highlighted, since WP-Cron only runs on a page visit.
1.6.1 — 2026-07-18
Changed
- Database Optimizer (Tables tab) — Table Name, Owner, Status, Rows, and Size columns are now sortable by clicking the column header (click again to reverse). Removed the unexplained “Protected” label next to Optimize-only tables — it’s simply omitted now. WP Toolkit’s own log tables (Activity Log, Firewall Log) now show an Empty button, matching the “Clear Log” action already available elsewhere in the plugin; Delete stays blocked on them since dropping the table (rather than just clearing it) would break the module until reactivation.
1.6 — 2026-07-18
Added
- Database Optimizer — New “Tables” tab. Lists every table in the database with its owner, install status, row count, and size, plus per-table Optimize / Empty / Delete actions. Owner is resolved from WordPress core’s own table list, WP Toolkit’s own tables, and a curated list of common plugins matched by table prefix — anything unmatched shows as “Unknown” rather than a guess. Status shows whether the owning plugin is currently Active, installed but Inactive, or Abandoned (no matching plugin folder found — a common sign of leftover tables from an uninstall). Empty and Delete are blocked server-side (not just hidden) for WordPress core tables and WP Toolkit’s own tables; Optimize is available on every table.
1.5.1 — 2026-07-18
Changed
- Page Cache — Default cache duration changed from 60 minutes to 1,440 minutes (24 hours). The cache is already cleared automatically on publish/edit, new comments, theme switch, and plugin activation/deactivation, so a longer duration doesn’t risk stale content on the common change paths — it just means far fewer regenerations for typical low-traffic sites.
Fixed
- Page Cache — The cache duration option was never bootstrapped like the other two Page Cache settings, so its option row never existed until an admin explicitly saved a different value. On sites where the cache was already active, this meant the duration silently stayed on whatever value was mirrored into the cache-settings file at the time caching was first turned on, even after a plugin update changed the default. It’s now bootstrapped the same way as the other two settings, and the cache-settings file is written directly as part of that bootstrap instead of relying on an incidental side effect of another option’s
add_optionhook.
1.5 — 2026-07-17
Added
- Security Hardening — New “Block New Admin Account Creation” option, on by default. Prevents any user from being created with, or promoted to, the administrator role — including via compromised code or a vulnerable plugin, not just the Add User screen. The account is created but immediately demoted, and the event is logged. A warning with a direct link to disable the option appears on the Add New User screen so you’re not caught out mid-task.
- Page Cache — New module, on by default, with “Ignore Unrecognized Query Parameters” also on by default. Full-page caching for logged-out visitors via a standard
advanced-cache.phpdrop-in — saves a static copy of each page on first visit and serves it until it expires. Automatically cleared on publish/edit, new comments, theme switch, and plugin activation/deactivation. Cache duration and the query-parameter behavior are both configurable, with a manual “Clear Cache” button and live status (drop-in state, cached file count and size) on the settings page.
1.4.10 — 2026-07-17
Changed
- Site Prep — Consolidated the four separate purge options (Purge Hello World, Purge Sample Pages, Purge Themes, Purge Plugins) into a single “Purge Defaults” option that does all four in one step.
- Site Prep — Default timezone changed from America/Winnipeg to America/Chicago (Central Time, DST-observing).
- Site Prep — Renamed “SEO Permalinks” to “Permalinks”, and removed the “Runs once then self-disables.” and filter-override text from option descriptions to keep them shorter.
1.4.9 — 2026-07-17
Fixed
- Admin Styles — Every module’s own settings page (Firewall, Security Headers, Malware Scanner, etc.) was loading with no CSS at all — only the dashboard hub page rendered styled. The enqueue check was matching against
wptoolkit_page_*hook names, but WordPress actually generateswp-toolkit_page_*(derived from sanitizing the “WP Toolkit” menu title) — a leftover mismatch from the Spork-to-WP-Toolkit rebrand. - Links — The “HELP ?” link, the locked-feature panel’s “Purchase a license at” link, and the License page’s “View Changelog” link pointed at a placeholder domain instead of the real product/manual pages.
- Icons — Replaced all raw emoji (dashboard cards, module page headers, and inline Active/Inactive/warning status badges throughout every module) with WordPress’s built-in Dashicons. Some themes rewrite WordPress’s emoji rendering to pull from a third-party CDN mirror with a broken URL path, which showed a broken-image icon next to every emoji throughout the plugin’s admin pages on affected sites. Dashicons are bundled with WordPress core and require no external request, so this can’t recur regardless of the active theme.
1.4.8 — 2026-07-12
Fixed
- Content-Security-Policy (CSP) — WordPress core’s default emoji CDN (
cdn.jsdelivr.net) wasn’t in the CSPimg-srcallowlist, so emoji rendered as broken images on any site with CSP enabled running WordPress 7.0+. Addedhttps://cdn.jsdelivr.netto the defaultimg-srcdirective.
1.4.7 — 2026-07-01
Added
- Integrity Monitor — Each flagged file (modified, missing, unexpected, or a stray PHP file in uploads) now has an “Ignore” action, and unexpected/uploads files also get a “Delete” action. Ignored items move to a dedicated “Ignored Items” section with an “Un-ignore” option, and no longer count as issues.
Fixed
- Integrity Monitor — Email alerts were re-sent on every scheduled scan for the same unresolved file. The scanner now only emails when there’s a genuinely new (previously unseen) issue; a resolved issue that recurs later will alert again.
1.4.6 — 2026-07-01
Fixed
- Auto-Updater —
spork-update.jsonwas being written with a UTF-8 byte-order mark (BOM) by the release script. A leading BOM makes PHP’sjson_decode()silently returnnull, which means every Spork install (including this one) has been failing to detect new versions via the self-update check, with no visible error anywhere. The release script now writes the file without a BOM, and the plugin strips a BOM defensively before decoding as a safety net.
1.4.5 — 2026-06-30
Fixed
- 8G Firewall — The Apache-level ruleset was blocking requests to the Spork update feed (
/scripts/spork/) when a caller’s HTTP User-Agent was empty or matched a generic client-library signature. This could silently prevent other Spork installs from detecting or downloading updates from nanoapps.ca, since the block happens before WordPress loads and produces no visible error. The update feed path is now exempt from all 8G ruleset checks.
1.4.4 — 2026-06-30
Fixed
- Firewall Log — “Whitelist” button now uses a POST form instead of a GET link, fixing a 403 nonce failure that occurred when caching or session state caused the GET-based nonce to be rejected.
1.4.3 — 2026-06-30
Added
- License — “View Changelog” link next to the version number, pointing to the release notes on the manual page.
1.4.2 — 2026-06-30
Added
- License — Plugin version number now shown in the License page table.
1.4.1 — 2026-06-30
Fixed
- Admin notices — “Settings saved” and other in-page notices now show white text correctly against the dark background. WordPress admin CSS was overriding the inherited text color on
1.4 — 2026-06-28
Added
- Security Headers — CSP now has an “Allowed Domains” field. Add a third-party widget’s domain (live chat, booking calendar, etc.) and it’s appended to script-src, style-src, connect-src, frame-src, img-src, and font-src, so you no longer have to disable CSP entirely to make a blocked widget work.
- Firewall Log — Search box filters the table live by IP, reason, URI, or user agent as you type.
- Firewall Log — Click any column header to sort the table by that column; click again to reverse direction.
Changed
- Firewall Log — Now shows the last 500 entries instead of 200.
- Security Hardening — “Disable User Enumeration” description now mentions it also removes the /wp/v2/users REST endpoints (it already did this; the description just didn’t say so).
1.3 — 2026-05-19
Added
- License System — Plugin now requires a valid license key to unlock features. Enter your key under Spork → License. Includes a 7-day grace period if the license server is temporarily unreachable.
1.2 — 2026-05-19
Added
- Firewall Log — “Whitelist” button on each log row; one click adds the blocked IP to the allowlist with a confirmation prompt. IPs already on the allowlist show a “✓ Allowlisted” indicator instead.
- Security Hardening — New toggle “Log Unauthenticated REST Requests” (Enumeration & REST section). When enabled, writes every unauthenticated REST request (method, URI, IP, all headers) to the PHP error log. Viewable in the Debug Log tab. Off by default.
Fixed
- Security Hardening — “Restrict REST API to Logged-In Users” now only blocks unauthenticated access to core WordPress namespaces (
/wp/). Custom plugin namespaces (e.g. Xagio SEO, WooCommerce, contact form plugins) are passed through so they can handle their own authentication. Previously, any unauthenticated REST request was rejected with 401 regardless of namespace. - Security Hardening — Updated description for the REST restriction option to clarify the new behaviour.
1.1 — 2026-05-10
Added
- Code Snippets — New module. Inject custom HTML, JavaScript, or CSS into four page locations:
wp_head,wp_body_open,wp_footer, andadmin_head. Toggle snippets on/off without deleting them. Includes presets for GA4, Google Tag Manager (head + body), Facebook Pixel, and Hotjar. - Firewall — AbuseIPDB IP reputation integration. Checks visitor IPs against the AbuseIPDB crowd-sourced abuse database. Results cached for 6 hours to stay within the free API limit (1,000 checks/day). Configurable confidence score threshold (default 75). New
spork_fw_abuseipdb_enabledtoggle and API key field in settings. - Malware Scanner — Hybrid Analysis and FileScan.io external scan integrations, alongside the existing VirusTotal integration. New “Scan with All Services” option to run all configured scanners in parallel from the file detail modal.
- Malware Scanner — Severity filter settings (
spork_malware_show_high/medium/low). Control which severity levels appear in scan results and trigger email alerts.
Changed
- Core — Module loading split into frontend and admin/cron groups. Security, firewall, 2FA, and activity log modules load on every request; admin-only modules (optimizer, scanner, monitor, etc.) load only in the WP admin area or during cron. Reduces memory usage on public-facing pages.
- Firewall — wp-admin path detection switched from
strposto regex (/wp-admin(/|$)/) to prevent false positives on custom paths like/wp-admin-custom/. - Malware Scanner — VirusTotal file upload migrated from
curl_init()towp_remote_post()for better proxy and SSL compatibility. - Security Hardening — Code consolidation and refactoring (net file size reduction).
Fixed
- Two-Factor Auth — OTP token moved from URL query parameter to an
HttpOnly; Secure; SameSite=Strictcookie. Prevents token exposure in server logs, browser history, and HTTP Referer headers.
1.0 — 2026-04-27
Changed
- Dashboard — Admin menu icon updated to custom spork SVG (white, proper fill-rule path).
- Dashboard — Emoji icons added to all module cards. Vulnerability Scanner card added to dashboard.
- Dashboard — Module card order adjusted; Debug Log moved to match admin menu order.
0.9 — 2026-04-26
Initial release. Includes all core modules:
A Note on Defaults
WP Toolkit is designed to be safe out of the box. Features that could affect how your site behaves — the Firewall, Security Headers, Security Hardening options, Maintenance Mode — are all off by default. You turn on what you need, when you’re ready. Nothing activates automatically just by installing the plugin.
The Auto-Updater is the exception: it defaults to on, because keeping software updated is nearly always the right choice for security.
WP Toolkit is developed by NanoApps. For support, visit nanoapps.ca.