manifest / security / skyline-lockdown

SkyLineWP – Lock Down Everything

Only user ID 1 can manage plugins (incl. MU-plugins), install/update/delete/switch themes, use the customiser, access tools or edit files, or modify via REST API. Everyone else is redirected and stripped of the related caps and menu items.

by Dom · github.com/dompl/skyline-lockdown

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/dompl/skyline-lockdown/archive/refs/heads/master.zip

No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Readme github.com/dompl/skyline-lockdown ↗

Only user ID 1 can:

Manage plugins (including MU-plugins)
Install, update, delete or switch themes
Use the Customiser or edit theme options
Access Tools (import, export, site-health)
Use the file editors (core, plugin or theme editors)
Make non-GET/HEAD REST API requests

All other users are redirected to the dashboard and have those capabilities stripped.

Installation

Copy the skyline-lockdown.php file into a folder named skyline-lockdown inside your wp-content/mu-plugins/ (or wp-content/plugins/) directory.
If in wp-content/plugins/, activate it in Plugins → Installed Plugins.
Ensure your site is running PHP 7.4+ and WP 5.5+.

Changelog

See CHANGELOG.md.

Development & Versioning

This plugin uses Semantic Versioning.
After you bump the version in the plugin header (in skyline-lockdown.php), update CHANGELOG.md, then:

git add skyline-lockdown.php CHANGELOG.md
git commit -m "Release v1.X.X"
git tag -a vX.X.X -m "Version X.X.X"
git push origin main --tags

Replace main with your default branch, and update the remote URL as needed:

git remote add origin git@github.com:yourusername/skyline-lockdown.git