WP Toolkit Mini — Complete Feature Guide

The Dashboard

When you open WP Toolkit Mini, you land on a card-based overview of all three modules. Each card has a short description and a button that takes you straight to that tool’s settings.

Auto-Updater

What it does: Keeps your WordPress site up to date automatically, without you having to log in and click “Update” manually.

Out of the box, WordPress only auto-applies small security fixes. WP Toolkit Mini extends that to cover everything.

What you can auto-update:

• WordPress Core — the main WordPress software itself, including major version upgrades (e.g. 6.5 → 6.6)
• Plugins — all installed plugins stay on their latest versions
• Themes — all installed themes stay current
• Translations — language files update automatically

Silent Mode: By default, WordPress emails you every time it runs an automatic update. With Silent Mode on, those emails stop. Useful if you manage multiple sites and don’t want your inbox flooded.

Why it matters: The number one reason WordPress sites get hacked is outdated software with known security holes. Auto-updates close those holes the moment a fix is available, without requiring any action on your part.

All five toggles — Core, Plugins, Themes, Translations, and Silent Mode — are on by default.

Page Cache

What it does: Saves a static HTML copy of each page the first time a logged-out visitor loads it, then serves that copy directly for a set duration instead of rebuilding the page from scratch on every request. On by default.

WordPress normally rebuilds every page from the database on every single visit — running PHP, querying the database, and assembling the HTML from scratch each time, even if the page hasn’t changed. Page Cache skips all of that for repeat visitors by serving a saved copy instead.

How it works: The first time a logged-out visitor loads a page, WP Toolkit Mini saves the fully-rendered HTML to disk. Every subsequent visit to that same URL is served directly from that saved copy — no database queries, no PHP page-building — until it expires or gets cleared. Logged-in users always see a freshly-generated page, never a cached one.

Automatic cache clearing: The entire cache is cleared automatically whenever you publish or edit a post, add a comment, switch themes, or activate/deactivate a plugin — so visitors never see stale content after a change.

Settings:

• Ignore Unrecognized Query Parameters — On by default. Normally, a URL with an unrecognized ?query=string parameter skips the cache entirely, since that parameter might change what’s on the page. Some bots deliberately attach random parameters on every request specifically to defeat page caches. With this on, unrecognized parameters are ignored for caching purposes, so those requests still get served from cache.
• Cache Duration — How many minutes a cached page stays valid before it’s rebuilt fresh on the next visit. Defaults to 1,440 minutes (24 hours).

The settings page shows live status — whether the cache is actually installed and active, how many pages are currently cached, and total cache size — along with a manual Clear Cache button.

Block Admin Account Creation

What it does: Prevents any user from being created with, or promoted to, the administrator role. On by default.

One of the most common ways attackers maintain access to a hacked WordPress site is by quietly creating a new administrator account — through the Add User screen, a vulnerable plugin, or directly manipulated code. That new account gives them a way back in even after the original break-in is discovered and patched.

How it works: WP Toolkit Mini watches for any user being created with, promoted to, or given the administrator role — not just through the Add New User screen, but through any code path, including compromised plugins. The account itself isn’t blocked from being created; instead, WP Toolkit Mini immediately demotes it back to subscriber and logs the event.

If you actually need to add or promote an admin: Turn this off first, from the WP Toolkit Mini dashboard. A warning with a direct link to this setting appears right on the Add New User screen whenever blocking is active, so you don’t get caught out mid-task.

Why it matters: This closes off one of the most common post-breach persistence tricks — a rogue admin account that survives a cleanup because nobody noticed it was created.

Changelog

A record of all notable changes to WP Toolkit Mini, newest version first.

1.1.4 — 2026-07-29

Security

• Page Cache — Patched a security issue in the page cache. Sites should update as soon as possible.
• Cache drop-in auto-refresh — The installed cache drop-in now stays in sync with the plugin’s own version, so future security and bug fixes to it reach sites automatically on the next admin visit instead of requiring the cache to be manually toggled off and back on.

Fixed

• Page Cache — Deactivating the plugin (not just toggling the cache setting off) left the drop-in, the WP_CACHE constant, and the whole cache in place — the drop-in reads from disk before plugins load at all, so it isn’t gated by WordPress’s own plugin-active check. A logged-out visitor could keep seeing stale cached pages for up to the full cache duration after deactivation. The plugin now removes the drop-in on deactivation, and correctly restores it on reactivation if the cache is still supposed to be enabled.
• Page Cache — Widget and menu changes (Appearance → Widgets, Appearance → Menus) didn’t purge the cache; only Customizer-based changes did. Added update_option_sidebars_widgets and wp_update_nav_menu to the purge triggers.
• Page Cache — HEAD requests served from cache incorrectly included the full response body via readfile(). Now sends headers (including a correct Content-Length) with no body for HEAD requests, matching HTTP semantics.

Changed

• Page Cache — The one-time default-bootstrap check ran 3 database queries on every single admin_init, forever, instead of just once. Now short-circuits after the first successful check.
• Page Cache — The cache-file count/size shown on the settings page is now cached for 1 minute instead of walking the entire cache directory on every page load.

1.1.3 — 2026-07-29

Security

• Page Cache — Patched a security issue in the page cache. Sites should update as soon as possible.

Changed

• Release tooling — update-page.py‘s WordPress application-password credential is no longer hardcoded in the file; it’s read from a WPTOOLKIT_NANOAPPS_CREDS environment variable, set once at the OS user level. build.ps1 checks for it and fails with a clear message if unset, rather than silently having nothing to read.

1.1.2 — 2026-07-19

Fixed

• Page Cache — Caching never actually activated on a site installed via a fully automated flow (e.g. wp plugin install --activate) that never loads wp-admin, since the only code that installs the advanced-cache.php drop-in and the WP_CACHE constant was wired to admin_init, which never fires on that path. The dashboard could still show “Active” (a PHP-level default, not a check of what’s actually installed), while the site silently cached nothing. The bootstrap now also runs on the plugin’s activation hook, which fires on every install path, including CLI activation — closing the gap for good.

1.1.1 — 2026-07-18

Fixed

• Page Cache — The cache duration option was never bootstrapped like the other two Page Cache settings, so its option row never existed until an admin explicitly saved a different value. On sites where the cache was already active, this meant the duration silently stayed on whatever value was mirrored into the cache-settings file at the time caching was first turned on, even after a plugin update changed the default. It’s now bootstrapped the same way as the other two settings, and the cache-settings file is written directly as part of that bootstrap instead of relying on an incidental side effect of another option’s add_option hook.

1.1 — 2026-07-18

Changed

• Page Cache — Default cache duration changed from 60 minutes to 1,440 minutes (24 hours). The cache is already cleared automatically on publish/edit, new comments, theme switch, and plugin activation/deactivation, so a longer duration doesn’t risk stale content on the common change paths — it just means far fewer regenerations for typical low-traffic sites.

1.0 — 2026-07-18

Initial release. Includes three modules:

Added

• Auto-Updater — Automatic updates for core (major & minor), plugins, themes, and translations, with a Silent Mode to suppress update emails.
• Page Cache — Full-page caching for logged-out visitors via a standard advanced-cache.php drop-in, on by default. Automatically cleared on publish/edit, new comments, theme switch, and plugin activation/deactivation. Configurable cache duration and query-parameter handling, with a manual “Clear Cache” button and live status.
• Block Admin Account Creation — On by default. Prevents any user from being created with, or promoted to, the administrator role — including via compromised code or a vulnerable plugin. The account is created but immediately demoted, and a warning with a direct link to disable the option appears on the Add New User screen.

A Note on Defaults

All three modules in WP Toolkit Mini are on by default — auto-updates, page cache, and admin-account blocking. This is a deliberate departure from the full WP Toolkit, where security and behavior-changing modules stay off until you opt in: WP Toolkit Mini’s three modules are specifically chosen because keeping software updated, caching public pages, and blocking rogue admin accounts are safe, broadly beneficial defaults for almost every site.

WP Toolkit Mini is developed by NanoApps. For support, visit nanoapps.ca.

↑ Back to top