Tool Kits

WordPress admin toolkit for database work, security, optimization, monitoring, cache, and operational utilities in one dashboard.

---

Section 1: Overview

Short Description

Tool Kits helps WordPress administrators manage five main areas:

• Site security.
• Performance optimization.
• Database migration and maintenance.
• Site health monitoring.
• Operational plugin access control.

Key Features

• Database export/import SQL.
• Preload export with serialized-safe find/replace.
• DB cleanup for revisions, trash, spam comments, transients, and table optimization.
• Hide Login, Minify, Auto WebP, Lazy Load, Asset Optimization.
• Upload limits and User ID changer.
• Captcha and anti-spam Contact Form 7.
• IP-based login rate limiting with an unblock panel.
• Login log for successful and failed attempts with retention.
• Hardening (XML-RPC, headers, WAF basic, HTTP Auth, CORS).
• Firewall with payload WAF, IP/CIDR allowlist/blocklist, user-agent rules, and event log.
• Signature-based Malware Scanner for executable uploads, obfuscation, encoded payloads, and web-shell markers, including line numbers, reasons, and code snippets in reports and alert emails. Theme iframe/SVG cases are skipped where they commonly create false positives.
• Vulnerability Scanner for outdated WordPress core, plugin/theme updates, inactive components, and security-sensitive configuration.
• Incident Response workflow for malware investigation/removal tracking, post-incident blocklist removal, and search engine security cleanup.
• SMTP (preset provider + test email + log).
• Monitoring (checks, realtime, 404 monitor, healthcheck, heartbeat).
• Cache tools (page cache, object flush, opcache reset, fragment flush).
• Theme checker (summary, largest file, duplicate PHP, risky functions).
• Tool Kits Access (role/IP access, alerts, audit log, owner mode, license).
• Role Management for custom roles, per-module capabilities including custom post type CRUD, and visible dashboard menus per role.

Latest Updates (Access, License, Monitoring)

• Collector, heartbeat, and license configuration now follow one shared configuration flow.
• The Tool Kits Access > License tab shows Collector URL, auto-derived Heartbeat URL and License server URL, plus Configured/Missing badges.
• Added Test Heartbeat and Test License Reachability before license activation.
• Diagnostics show connection status, last success, last failure, last error, and the latest heartbeat/license endpoint.
• Monitoring only shows valid healthcheck data to avoid misleading output on local or shared hosting.

Latest Updates (Hardening)

• Direct /wp-login.php requests are now redirected to the homepage when Hide Login is enabled; only the configured custom login slug can reach the WordPress login flow.
• Login honey trap and progressive lockout added to reduce repeated bot hits against common login URLs.
• Login Shield added with generic login errors, common attacker username protection, same-site Origin/Referer guard, and configurable 404 scanner trap.
• Firewall Summary Blocklist now includes active blocked IPs and configured Firewall IP/CIDR rules, not only historical blocklist events.
• WordPress fingerprint reduction added for public discovery links, REST link headers, feed links, emoji traces, author redirect signals, and common scanner-readable root files.
• HSTS header is now available as a toggle and recommended on by default.
• Strict CSP option added without unsafe-inline or unsafe-eval.
• Hide server signature option added for X-Powered-By/expose_php.
• Force HttpOnly/Secure on response cookies option added.
• Disable WP-Cron (DISABLE_WP_CRON) option added from the hardening panel.
• URL Parameter Guard option added to block suspicious query strings.
• HTTP methods filtering added with method and path allowlists.
• Dangerous HTTP method blocking added. Default methods: PUT, DELETE, TRACE, CONNECT.
• Harden robots.txt option added with a minimal policy.
• Unwanted file blocking added with a custom filename list.
• Public MySQL risk check for port 3306 added to hardening monitoring.
• Note: the plugin cannot close port 3306 directly; final mitigation must be handled in the server firewall or security group.

Struktur Menu

• Tool Kits
• Tool Kits > Database
• Tool Kits > Optimization
• Tool Kits > Spam Protection
• Tool Kits > Rate Limit
• Tool Kits > Brute Force Protection
• Tool Kits > Login Log
• Tool Kits > Hardening
• Tool Kits > Firewall
• Tool Kits > Malware Scanner
• Tool Kits > Vulnerability Scanner
• Tool Kits > SMTP
• Tool Kits > Monitoring
• Tool Kits > Cache
• Tool Kits > Themes Checker
• Tools > Tool Kits Access
• Tool Kits > Role Management

Note: some menus depend on license status.

Build Release ZIP

Run from the workspace root:

bash plugins/tool-kits/scripts/build-release-zip.sh

The default output is created at:

plugins/tool-kits.zip

To choose a custom output path:

bash plugins/tool-kits/scripts/build-release-zip.sh /tmp/tool-kits.zip

Module Details

1) Database

For backups, migrations, and data maintenance.

• The full Database module can be used without license activation or Collector Token.
• Export Database: download a full SQL dump.
• Export Download (Preload): generate a SQL.gz file with serialized-safe find/replace pairs.
• Import Database: import .sql or .sql.gz into the active database.
• Change Prefix: rename table prefixes and update related keys, including an automatic backup before the process.
• DB Cleanup: clean unnecessary data to keep the database lighter.

When to use it:

• Moving domains or staging to production.
• Backing up before major changes.
• Periodic cleanup of redundant data.

2) Optimization

For faster loading and reduced frontend overhead.

• Hide Login: change the default login URL.
• Minify: compress HTML, inline CSS, and inline JS.
• Auto WebP: automatically convert images and generate WebP for existing media.
• Lazy Load: defer image, iframe, and video loading.
• Assets: critical CSS, deferred/preloaded CSS, font preload, and font-display swap.
• Uploads: configure separate size limits for images, documents/PDFs, and videos.
• User ID: change a specific user ID. This is a sensitive action.

3) Spam Protection

To reduce bot submissions and form abuse.

• Captcha: enable/disable captcha and login form options.
• Anti-spam Contact: honeypot and minimum submit delay for CF7.

4) Rate Limit

To limit brute-force login attempts.

• Configure the window, attempt count, and lockout duration.
• Optional permanent IP block on failure.
• Safe IP whitelist.
• Unblock IPs from the admin panel.

5) Login Log

For login auditing.

• Record successful and failed login attempts.
• Store time, IP, and user agent.
• Filter status + clear log.
• Configure log retention.

6) Hardening

To reduce the WordPress attack surface.

• Disable file editor.
• Disable XML-RPC or block risky methods.
• Disable REST user enumeration.
• Add security headers, including HSTS.
• Strict CSP mode (optional).
• Hide server/PHP signature headers.
• Force HttpOnly/Secure for response cookies.
• Disable WP-Cron from settings.
• URL parameter guard.
• HTTP methods filtering + block dangerous methods.
• Block PHP execution in uploads.
• Basic WAF based on path/method rules.
• HTTP Basic Auth scope frontend/backend.
• CORS allowlist custom.
• Harden robots.txt.
• Block unwanted file access.
• Check public DB host risk as an indicator of MySQL port 3306 exposure.

6.1) Incident Response

For controlled post-compromise cleanup and evidence tracking.

• Investigation and Malware Removal checklist.
• Investigation snapshot with WordPress, PHP, theme, plugin, administrator, malware finding, firewall, and login log counts.
• Malware removal log for confirmed removed files, restored clean files, credential rotation, and patch notes.
• Post-incident Blocklist Removal checklist and vendor review links.
• Post-incident Search Engine Security Cleanup checklist for spam URLs, sitemap/indexing repairs, Search Console, Bing Webmaster Tools, and recrawl tracking.
• Exportable plain-text incident report.

6.2) Vulnerability Scanner

For update and exposure review without requiring an external API key.

• Refresh WordPress update metadata before scanning.
• Report available WordPress core updates.
• Report plugin and theme updates, prioritizing active components.
• Flag inactive plugins and themes for removal review.
• Flag HTTPS configuration risk when WordPress does not detect SSL.
• Keep the latest report in Tool Kits options until cleared.

6.3) Brute Force Protection

For login endpoint protection and bot lockout workflows.

• Dedicated Brute Force Protection menu entry.
• IP-based login throttling.
• Progressive lockout steps.
• Manual permanent IP block option.
• Attacker username blocking.
• Same-site login Origin/Referer guard.
• Login honey trap for common bot paths when Hide Login is active.
• 404 scanner trap for repeated probes against sensitive paths.

7) SMTP

For reliable WordPress email delivery.

• Preset Gmail/Microsoft 365/Custom.
• Setting host, port, secure mode, auth.
• Send a test email and review the result log.

8) Monitoring

For operational visibility and early issue detection.

• Configuration checks.
• Quick actions (cache clear, toggle update, wp-config permission).
• Realtime health monitor.
• 404 monitor + exclude rules.
• Healthcheck endpoint + secret key.
• Scheduled heartbeat to an external collector.
• Summary of collector/heartbeat status and latest heartbeat result.

9) Cache

• For cache control from one place.
• File-based page cache for anonymous visitors.
• TTL dan path exclude.
• Purge page cache.
• Flush object cache.
• Reset OPcache.
• Flush fragment cache keys.

10) Themes Checker

For active theme quality auditing.

• File and asset size summary.
• Largest file list.
• Duplicate PHP detection.
• Risky function pattern detection.

11) Tool Kits Access

For controlling who can access the plugin.

• Role allowlist.
• IP allowlist.
• Lock settings.
• Security alerts via email.
• Change audit log.
• Owner mode and license settings.
• Collector/heartbeat/license connection status, token status, and latest check result.

Installation

1. Upload the tool-kits folder to wp-content/plugins/.
2. Activate the plugin from the Plugins screen.
3. Open Tool Kits and Tools > Tool Kits Access.
4. Configure the license, access roles, and alert email before using it in production.

Best Practice

• Always back up before Import DB, Change Prefix, or Change User ID.
• Test sensitive features such as Hide Login, WAF, HTTP Auth, CORS, and IP blocking on staging.
• Save the custom login URL if Hide Login is active.
• Use the SMTP test after changing providers.

---

Section 2: English

Short Description

Tool Kits is an all-in-one WordPress admin toolkit focused on:

• Security hardening.
• Performance optimization.
• Database migration and cleanup.
• Site monitoring and health visibility.
• Operational access control for plugin features.

Core Features

• SQL database export/import.
• Preloaded export with serialized-safe find/replace pairs.
• Database cleanup (revisions, trash, spam comments, transients, optimize table).
• Hide Login, Minify, Auto WebP, Lazy Load, Asset Optimization.
• Upload limits and User ID changer.
• Captcha and Contact Form 7 anti-spam.
• IP-based login rate limiting with unblock panel.
• Login logs with retention.
• Hardening options (XML-RPC, headers, WAF basic, HTTP Auth, CORS).
• Firewall with payload WAF, IP/CIDR allow/block rules, user-agent rules, and an event log.
• Signature-based Malware Scanner for executable uploads, obfuscation, encoded payloads, and web-shell markers.
• SMTP presets + test email + test logs.
• Monitoring (checks, realtime health, 404 monitor, healthcheck, heartbeat).
• Cache controls (page cache, object flush, OPcache reset, fragment flush).
• Theme checker (summary, largest files, duplicate PHP, risky functions).
• Access controls (roles/IP allowlist, alerts, audit log, owner mode, license).
• Role Management for creating custom roles, configuring capabilities by module, and choosing visible dashboard menus per role.

Recent Updates (Access, License, Monitoring)

• Collector, heartbeat, and license configuration now follow one shared setup flow.
• Tool Kits Access > License now shows explicit collector input, derived heartbeat/license URLs, and Configured/Missing status badges.
• Added Test Heartbeat and Test License Reachability actions before license activation.
• Diagnostics now surfaces connection status, last success, last failure, last error, and last checked endpoint for heartbeat/license flows.
• Monitoring now hides invalid healthcheck values instead of displaying misleading placeholders.

Recent Updates (Hardening)

• HSTS header toggle is available and recommended defaults are enabled.
• Strict CSP mode added (without unsafe-inline/unsafe-eval).
• Server signature hiding option added (X-Powered-By/expose_php).
• Force HttpOnly/Secure cookie response flags added.
• WP-Cron disable option (DISABLE_WP_CRON) added in hardening settings.
• URL Parameter Guard added for suspicious query strings.
• HTTP methods filtering added (method allowlist + path allowlist).
• Dangerous HTTP methods blocking added (default: PUT, DELETE, TRACE, CONNECT).
• robots.txt hardening option added (minimal policy).
• Unwanted file access blocking added with custom filename list.
• MySQL public exposure risk check (port 3306 indicator) added in monitoring checks.
• Note: the plugin cannot close port 3306 directly; final mitigation must be done via server firewall/security groups.