Smart Admin Plugin Manager WP Registry grade A. No security issues foundWP RegistryNo security issues foundOpen the reportA

Intelligent WordPress plugin loading management for both admin and public frontend — per-screen and per-context control with automatic optimization suggestions.

Description

Smart Admin Plugin Manager (SAPM) is an advanced WordPress plugin that optimizes performance by controlling which plugins load on specific admin screens and on the public frontend. Unlike traditional solutions that load all active plugins on every page, SAPM allows granular per-screen and per-context control, automatically detecting unnecessary plugins and providing data-driven optimization suggestions.

The plugin operates at the core WordPress level using the MU-plugins mechanism, intercepting the plugin loading process before WordPress initialization completes. This allows for dramatic performance improvements by preventing heavy plugins from loading where they are not needed — whether in the WordPress admin, on public pages, in AJAX requests, REST API calls, or WP-Cron tasks.

Current Version: 1.3.6
Status: Active Development
Minimum Requirements: WordPress 6.0+, PHP 7.4+

Key Features

Core Functionality

• Per-Screen Plugin Control

  • Granular control over which plugins load on each admin screen
  • Support for WordPress core screens (Dashboard, Posts, Pages, Settings, etc.)
  • Custom Post Type compatibility
  • WooCommerce admin screens integration
  • Plugin-specific admin pages detection

• Three Operation States Per Plugin

  • Enabled: Always load on specified screen
  • Disabled: Never load on specified screen
  • Defer: Load after main page load (reduces initial page load time by ~70%)

• Smart Menu Preservation

  • Admin menu items preserved for blocked/deferred plugins
  • Automatic snapshot system captures plugin menu structures
  • Users retain access to plugin settings even when plugin is blocked
  • Works seamlessly with deferred loading

• Hierarchical Rule System

  • Global rules (apply to all admin screens)
  • Group rules (apply to screen categories: Core, Content, WooCommerce, etc.)
  • Screen-specific rules (override group/global rules)
  • Inheritance system prevents rule duplication

Advanced Features

1. Automatic Mode with AI-Suggested Rules

• Sampling-Based Analysis: Monitors plugin performance across admin screens
• Confidence Scoring: Each suggestion includes confidence level (0-100%)
• Contextual Intelligence: Recognizes plugin purposes and screen relevance
• Database Storage: 30-day retention of performance samples
• Request Type Support: Admin screens, AJAX, REST API, WP-Cron, WP-CLI

2. Dependency Cascade Blocking

• Automatic Detection: Identifies plugin dependencies (e.g., WooCommerce extensions)
• Smart Blocking: When parent plugin is blocked, dependents are automatically blocked
• Known Patterns: Pre-configured patterns for popular plugin ecosystems
• Manual Override: Can be configured via filters

3. Request Type Optimization

• AJAX Request Control: Three modes (Passthrough, Blacklist, Whitelist)
• REST API Management: Per-namespace plugin control
• WP-Cron Optimization: Background task plugin filtering
• WP-CLI Support: Command-specific plugin loading

4. Update Optimizer

• Three Strategies:
  • TTL Extension: Reduces update check frequency (12h to 24-72h)
  • Page-Specific: Only checks updates on relevant pages
  • Cron-Only: All update checks via background tasks
• Plugin Updater Blocking: Blocks third-party plugin update API calls
• Performance Impact: Saves 0.3-0.6s per admin page load
• Update Badge Preservation: Maintains accurate update counts

5. Performance Monitoring

• Per-Plugin Metrics:
  • Load time measurement (milliseconds)
  • Database query counting
• Admin Screen Sampling: 100% sampling for admin screens
• Request Type Sampling: 10% sampling for AJAX/REST/Cron/CLI
• Frontend Sampling: 5% sampling for public frontend requests
• Real-time Dashboard: Visual performance reports

6. Frontend Optimizer (Public Pages)

• Per-Context Filtering Modes: Passthrough, Blacklist, Whitelist for frontend contexts (WooCommerce, core pages, content, archives, special).
• Per-Page Overrides: Optional post/term-level overrides from the frontend drawer for one specific page or taxonomy term.
• Asset Manager: Per-context CSS/JS dequeue rules with optional script defer / async attributes. The feature is not yet fully implemented in the sense that it does not currently allow you to define or create rules for loading assets on a specific page or group of pages. This is planned as a future feature.
• Safety Controls: Admin Bypass, WooCommerce critical-page protection, and one-click Safe Mode recovery URL.

Developer Tools

• Admin Drawer: Quick plugin management overlay on any admin screen
• WP-Admin Bar Integration: At-a-glance disabled plugin count
• Debug Mode: Detailed logging via Query Monitor integration
• AJAX Handlers: 22 admin-ajax.php handlers for all plugin operations
• Filters & Actions: 20+ customization hooks

Compatibility

WordPress Requirements

• WordPress Version: 6.0 or higher
• PHP Version: 7.4 or higher (8.0+ recommended)
• Database: MySQL 5.6+ or MariaDB 10.0+
• Multisite: Fully compatible

Third-Party Plugin Compatibility

Tested & Compatible:

• WooCommerce 7.0+
• Elementor & Elementor Pro
• Advanced Custom Fields (ACF)
• Yoast SEO / Rank Math
• Query Monitor (debug integration)
• LiteSpeed Cache
• Redis Object Cache
• All major page builders (Bricks, Divi, Beaver Builder)

Known Conflicts:

• Plugin activation/deactivation may be blocked if performed on incompatible screens (by design)
• Some security plugins may flag MU-plugin loader (false positive)

Hosting Environment Compatibility

• Shared Hosting: Compatible (low resource usage)
• VPS/Dedicated: Recommended for best performance
• Managed WordPress: Compatible (SiteGround, Kinsta, WP Engine tested)
• Server Types: Apache, Nginx, LiteSpeed, OpenLiteSpeed

How It Works

Architecture Overview

WordPress Load
    ↓
MU-Plugin Loader (wp-content/mu-plugins/smart-admin-plugin-manager.php)
    ↓
SAPM Core Initialization (VERY EARLY)
    ↓
Filter: option_active_plugins (Priority 1)
    ↓
    ├─ Screen Detection (Dashboard? Edit Post? WooCommerce Orders?)
    ├─ Rule Evaluation (Global → Group → Screen)
    ├─ Dependency Check (Block cascading dependencies)
    ├─ Filter Plugin List (Remove disabled plugins)
    └─ Load Remaining Plugins
    ↓
WordPress Continues Normal Load
    ↓
Admin Menu Restoration (Priority 9998 on admin_menu)
    ├─ Load menu snapshots from database
    ├─ Restore menu items for blocked/deferred plugins
    └─ Users retain access to plugin settings
    ↓
Menu Snapshot Capture (Priority 9999 on admin_menu)
    ├─ Detect all plugin menu items
    ├─ Store menu structure and URLs
    └─ Update snapshot database
    ↓
Deferred Plugins Load (Priority 999 on plugins_loaded)
    ↓
Performance Data Collection (If sampling enabled)

Plugin Loading Process

1. Early Initialization:

   • MU-plugin loads SAPM Core before regular plugins
   • Hooks into option_active_plugins filter at priority 1
   • Detects current admin screen (Dashboard, Edit Post, etc.)

2. Rule Application:

   • Loads rules from database (wp_options)
   • Applies inheritance: Global → Group → Screen
   • Evaluates per-plugin state (enabled/disabled/defer)

3. Dependency Resolution:

   • Checks if blocked plugin has dependents
   • Automatically blocks dependent plugins
   • Prevents "missing dependency" warnings

4. Plugin Filtering:

   • Removes disabled plugins from active_plugins list
   • Stores deferred plugins for later loading
   • WordPress loads only filtered plugin list

5. Deferred Loading:

   • Loads deferred plugins after all regular plugins
   • Reduces initial page load time
   • Maintains full functionality

Performance Sampling

• Admin Screens: 100% of page loads sampled

• AJAX/REST/Cron/CLI: 10% random sampling

• Metrics Collected:

  • Plugin load time (milliseconds)
  • Database queries executed
  • Memory usage
  • Request frequency

• Data Storage:

  • Custom database table: {prefix}_sapm_sampling_data
  • 30-day retention policy
  • Automatic cleanup via WP-Cron

Automatic Mode Algorithm

1. Data Collection: Performance samples from all request types
2. Pattern Analysis: Identifies plugins with high load time but low usage
3. Contextual Check: Verifies plugin relevance for screen type
4. Confidence Calculation:

   Confidence = Base_Score + (Load_Time_Factor × 0.3) + (Presence_Factor × 0.4)
   Where:
   - Base_Score = 0.4 (40%)
   - Load_Time_Factor = avg_ms / 80 (normalized to 0-1)
   - Presence_Factor = 1 - (screens_used / total_screens)

5. Suggestion Generation: Only suggestions with confidence ≥ threshold (default 70%)

Installation

Automatic Installation

1. Upload smart-admin-plugin-manager.zip to WordPress
2. Activate through Plugins screen
3. Navigate to Settings → Plugin Manager
4. Configure rules or enable Automatic Mode

Manual Installation

1. Upload smart-admin-plugin-manager/ directory to wp-content/plugins/
2. Activate plugin
3. MU-plugin loader automatically created at wp-content/mu-plugins/smart-admin-plugin-manager.php

Requirements Check

The plugin automatically checks:

• PHP version (7.4+ required)
• WordPress version (6.0+ required)
• Write permissions for wp-content/mu-plugins/
• Database table creation capability

Usage

Quick Start (Manual Mode)

1. Access Plugin Manager:

   • Go to Settings → Plugin Manager
   • View current screen ID and active plugins

2. Set Global Rules:

   • Find "Primary rules (WordPress Core)" section
   • Click plugin name to cycle: Gray → Green → Red → Orange
   • Rules save automatically

3. Override for Specific Screen:

   • Expand screen category (e.g., "Content")
   • Click plugin to set screen-specific state
   • Overrides group/global rules

Automatic Mode

1. Enable Automatic Mode:

   • Switch from "Manual" to "Auto" radio button
   • Plugin starts collecting performance data

2. Wait for Data Collection:

   • Minimum 24-48 hours recommended
   • Browse all admin sections to collect samples
   • Check "Sampling Statistics" for data count

3. Review Suggestions:

   • Auto mode displays suggestions automatically
   • Each suggestion shows:
     • Plugin name
     • Confidence score (%)
     • Reason (e.g., "Plugin has 45.2ms load, used on 30% of screens")
     • Potential savings (ms)

4. Apply Suggestions:

   • Review each suggestion carefully
   • Click "Apply suggestions" to implement
   • Test admin functionality after applying

Request Type Configuration

AJAX Settings:

Mode: Blacklist (recommended for AJAX)
Disabled Plugins:
  - [Heavy plugins that don't use AJAX]
Smart Detection: Enabled (auto-enables WooCommerce for woocommerce_* actions)

REST API Settings:

Mode: Whitelist (recommended for REST)
Default Plugins:
  - woocommerce/woocommerce.php (if using WooCommerce app)
  - jetpack/jetpack.php (if using Jetpack)
Smart Detection: Enabled (namespace-based detection)

WP-Cron Settings:

Mode: Passthrough (recommended - stay safe)
Comment: Cron tasks need reliable plugin access

Update Optimizer

Recommended Configuration:

Strategy: Cron-Only (most aggressive)
Cron Interval: Twice daily
Show Stale Indicator: Enabled
Plugin Updater Blocking: All known updaters blocked except security plugins

Performance Impact:

• Blocks 4-8 HTTP requests per admin page load
• Saves 0.3-0.6 seconds total
• Preserves update badge accuracy

Admin Drawer (Quick Access)

• Activation: Click "Plugin Manager" in Admin Bar
• Features:
  • Current screen info
  • Disabled plugins list
  • Quick rule toggle
  • Performance metrics for current screen

Frontend Optimizer

Frontend Optimizer controls which plugins and assets are loaded on public-facing pages. It is disabled by default (Passthrough mode) and must be explicitly configured.

1. Enable Frontend Optimizer:

• Go to Settings → Plugin Manager → Frontend tab
• Toggle Frontend Optimizer to enabled
• Optionally enable Admin Bypass (logged-in admins skip all frontend rules)
• Optionally enable WooCommerce Critical-Page Protection (cart, checkout, account pages always use Passthrough)

2. Configure per-context rules:

Each frontend context (WooCommerce, Core Pages, Content, Archives, Special) has an independent filtering mode:

Mode	Behaviour
Passthrough	All plugins load normally (safe default)
Blacklist	Listed plugins are blocked; all others load
Whitelist	Only listed plugins load; all others are blocked

Start with Blacklist for contexts where you want to block only a few heavy plugins (e.g., page builders on archive pages). Use Whitelist for very controlled contexts like a plain blog post where only a minimal set of plugins is needed.

3. Per-page overrides (optional):

• While browsing a specific post or taxonomy term as a logged-in admin, open the Frontend Drawer from the admin bar
• Toggle individual plugins on or off for that single page only
• The override applies only to that specific post/term ID; other pages follow context rules
• To clear overrides for the current page, click Reset overrides in the drawer (sapm_frontend_reset_overrides)

4. Safe Mode recovery:

• If frontend rules accidentally break the site (blank page, broken layout), use the Safe Mode URL
• The URL is shown in Settings → Plugin Manager → Frontend (under Safety Controls)
• Opening this URL temporarily bypasses all frontend rules for your session and lets you access the admin to correct the configuration
• The token is rotated each time Safe Mode is triggered

Recommended workflow:

1. Enable on staging site first
2. Start all contexts in Passthrough mode
3. Run the Asset Audit to discover what loads on each context
4. Switch one context to Blacklist and block only plugins confirmed unneeded
5. Test frontend thoroughly before switching to Whitelist mode
6. Deploy to production only after complete testing

Advantages

Performance Benefits

1. Admin Load Time Reduction:

   • Typical improvement: 30-50% faster admin pages
   • Example: Dashboard load reduced from 2.1s to 1.3s
   • Heavy plugin pages (Settings): 40-60% improvement

2. Database Query Reduction:

   • Fewer plugins = fewer queries
   • Typical reduction: 20-40 queries per page
   • Compound effect across entire admin session

3. Memory Usage Optimization:

   • Each blocked plugin saves 1-5 MB memory
   • Important for shared hosting environments
   • Prevents memory limit errors on heavy pages

User Experience

• Faster Admin Navigation: Noticeable speed improvement
• Reduced Server Load: Lower CPU/MySQL usage
• Better Hosting Performance: Works within resource limits
• No Lost Access: Plugin settings remain accessible even when blocked
• Seamless Experience: Admin menu preserved automatically
• Developer-Friendly: Granular control, extensive debugging

SEO & Business Impact

• Better Core Web Vitals: Faster TTFB (Time to First Byte)
• Improved Productivity: Less waiting for admin pages
• Cost Savings: Run on cheaper hosting tiers
• Scalability: Handle more concurrent admin users

Disadvantages & Warnings

Potential Issues

1. Complexity:

   • Requires understanding of WordPress admin structure
   • Manual mode needs careful configuration
   • Risk of blocking needed functionality

2. Plugin Conflicts:

   • Some plugins may not work if dependencies blocked
   • Cascade blocking may be too aggressive
   • Must test after applying rules

3. Debugging Difficulty:

   • Blocked plugins don't appear in error traces
   • May complicate troubleshooting
   • Need to disable SAPM to diagnose some issues

4. Maintenance Overhead:

   • Rules need updating after plugin additions
   • Automatic mode accuracy depends on usage patterns
   • May need adjustment after major WordPress/plugin updates

Critical Warnings

DO NOT BLOCK THESE:

• Security plugins (Wordfence, Sucuri) - Block AJAX/REST only, keep Cron
• Cache plugins (LiteSpeed Cache, WP Rocket) - Need to run everywhere
• Form plugins (Contact Form 7, Gravity Forms) - Need AJAX
• The SAPM plugin itself - Auto-protected but don't manually disable

CAREFUL WITH:

• WooCommerce on non-product pages - May break checkout/cart
• Page builders outside editor - May break frontend editing
• SEO plugins on non-content pages - May lose metadata

RECOMMENDED WORKFLOW:

1. Start with Automatic Mode on staging site
2. Review suggestions, test thoroughly
3. Export rules, apply to production
4. Monitor for 1 week, adjust if needed

Known Limitations

• Frontend Optimization is optional: Frontend filtering exists, but is disabled by default (Passthrough) until explicitly configured.
• Active Plugins Only: Cannot control inactive plugins
• No Network Activation: (Multisite requires per-site activation)
• Database Overhead: Sampling data can grow (auto-cleanup after 30 days)

Development Status

Current Version: 1.3.6

Status: Active Development

This plugin is actively developed and maintained. While stable for production use, new features are continuously added and edge cases discovered.

What This Means:

• Core functionality is tested and stable
• API may change between versions
• New features added regularly
• Bug reports addressed promptly

Production Readiness:

• Safe for production with proper testing
• Backup recommended before deployment
• Test on staging site first
• Monitor admin functionality after activation

Roadmap

Version 1.4.0 (Planned):

• Multi-language admin interface (Czech, German)
• Import/Export rules functionality
• Advanced scheduling (time-based rules)
• Performance comparison reports

Future Considerations:

• Frontend optimization presets and import/export
• Plugin conflict detector
• Automatic rollback on errors
• Cloud rule sharing

Changelog

For complete version history and release notes, see CHANGELOG.md.

Technical Details

Database Tables

sapm_sampling_data:

CREATE TABLE {prefix}_sapm_sampling_data (
    id BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
    request_type VARCHAR(20) NOT NULL,
    trigger_name VARCHAR(255) NOT NULL,
    plugin_file VARCHAR(255) NOT NULL,
    avg_ms DECIMAL(10,2) DEFAULT 0,
    avg_queries DECIMAL(10,2) DEFAULT 0,
    sample_count INT UNSIGNED DEFAULT 0,
    total_ms_sum DECIMAL(12,2) DEFAULT 0,
    total_queries_sum INT UNSIGNED DEFAULT 0,
    first_sample DATETIME NOT NULL,
    last_sample DATETIME NOT NULL,
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    UNIQUE KEY idx_trigger_plugin (request_type, trigger_name, plugin_file),
    KEY idx_request_type (request_type),
    KEY idx_trigger_name (trigger_name),
    KEY idx_last_sample (last_sample),
    KEY idx_plugin_file (plugin_file)
);

WordPress Options

• sapm_plugin_rules - Main rule storage (screen → plugin → state)
• sapm_request_type_rules - AJAX/REST/Cron configuration
• sapm_frontend_settings - Frontend optimizer settings (enabled, admin_bypass, wc_protection, sampling_enabled, asset_audit)
• sapm_frontend_rules - Frontend plugin rules per context (_mode, disabled_plugins, enabled_plugins)
• sapm_frontend_asset_rules - Frontend asset rules per context (dequeue, defer, async)
• sapm_frontend_asset_audit - Cached audit of enqueued frontend CSS/JS assets
• sapm_frontend_safe_key - Secret token for one-click Safe Mode recovery URL
• sapm_mode - Operation mode (manual/auto)
• sapm_update_optimizer_config - Update optimizer settings
• sapm_db_version - Database schema version (current: 1.0.0)
• sapm_menu_snapshots - Admin menu structure snapshots for blocked/deferred plugins
• sapm_admin_theme - Admin UI theme preference
• sapm_github_updater_last_good_meta - Last successfully fetched GitHub release metadata (fallback)
• sapm_github_updater_http_cache - ETag/Last-Modified HTTP cache for GitHub API requests
• sapm_last_cron_update_check - Timestamp of last background update check

AJAX Handlers

All plugin operations use WordPress admin-ajax.php (wp_ajax_*). The plugin does not expose a REST API.

Base: wp-admin/admin-ajax.php (nonce-protected, logged-in users only)

• sapm_save_rules - Save admin plugin rules
• sapm_drawer_toggle_rule - Toggle rule from admin drawer
• sapm_get_current_screen - Get current screen info and active plugins
• sapm_detect_plugins - Detect plugins for current screen
• sapm_save_request_type_rules - Save AJAX/REST/Cron/CLI rules
• sapm_get_request_type_performance - Get performance data by request type
• sapm_clear_request_type_performance - Clear request type performance data
• sapm_set_mode - Switch between manual/auto mode
• sapm_get_auto_suggestions - Get automatic optimization suggestions
• sapm_apply_auto_rules - Apply automatic suggestions as rules
• sapm_reset_auto_data - Reset sampling/performance data
• sapm_get_sampling_stats - Get sampling statistics
• sapm_save_update_optimizer - Save Update Optimizer configuration
• sapm_force_update_check - Trigger immediate update check
• sapm_save_admin_theme - Save admin UI theme preference
• sapm_save_frontend_settings - Save Frontend Optimizer global settings
• sapm_save_frontend_rules - Save frontend plugin rules per context
• sapm_save_frontend_asset_rules - Save frontend asset dequeue/defer/async rules
• sapm_get_frontend_asset_audit - Get audit of enqueued frontend assets
• sapm_get_frontend_suggestions - Get frontend optimization suggestions
• sapm_frontend_toggle_rule - Toggle rule from frontend admin-bar drawer
• sapm_frontend_reset_overrides - Reset per-page frontend overrides

Filters & Actions

Filters:

// Modify safe-to-block patterns
add_filter('sapm_safe_to_block_patterns', function($patterns) {
    $patterns['my-plugin'] = ['ajax', 'rest', 'cron'];
    return $patterns;
});

// Modify required plugins (never suggest blocking)
add_filter('sapm_required_plugins', function($required) {
    $required['critical-plugin'] = []; // Never block
    return $required;
});

// Add or modify admin screen definitions
add_filter('sapm_screen_definitions', function($screens) {
    $screens['my_screen'] = [
        'label' => 'My Custom Screen',
        'group' => 'custom',
        'matcher' => fn($s) => $s === 'my-screen-id',
    ];
    return $screens;
});

// Enable/disable cascade blocking
add_filter('sapm_cascade_blocking_enabled', '__return_false');

// Protect additional parent plugins from cascade blocking
add_filter('sapm_protected_parent_plugins', function($parents) {
    $parents[] = 'my-suite/my-suite.php';
    return $parents;
});

// Enable/disable performance tracking
add_filter('sapm_perf_enabled', '__return_false');

// Change request type sampling rate (default 10%)
add_filter('sapm_request_type_sampling_rate', function() { return 0.05; });

// Add custom frontend contexts
add_filter('sapm_frontend_contexts', function($contexts) {
    $contexts['my_context'] = ['label' => 'My Context', 'matcher' => fn() => is_page('special')];
    return $contexts;
});

// Override detected frontend context
add_filter('sapm_frontend_detected_context', function($ctx) {
    return 'woocommerce'; // force to WooCommerce context
});

// Modify filtered plugin list on frontend
add_filter('sapm_frontend_filtered_plugins', function($plugins) {
    $plugins[] = 'my-plugin/my-plugin.php'; // always load on frontend
    return $plugins;
});

// Override GitHub repository for updater
add_filter('sapm_github_updater_repo', function() {
    return 'my-org/my-fork';
});

// Add trusted hosts for update package download
add_filter('sapm_github_updater_allowed_hosts', function($hosts) {
    $hosts[] = 'my-cdn.example.com';
    return $hosts;
});

Note: The plugin does not expose public action hooks (do_action) for rule application or sampling events in the current version.

Performance Impact

Memory Usage:

• Plugin itself: ~3-5 MB
• Sampling data (30 days): 5-20 MB database
• Per-request overhead: < 1 MB

Database Queries:

• Rule loading: 2-3 queries per admin page (cached)
• Sample storage: 1 query per sampled request
• Auto-suggestions: 5-10 queries (only when requested)

Processing Time:

• Rule evaluation: < 5ms
• Plugin filtering: < 10ms
• Sample storage: < 2ms

Contributing

Contributions welcome! This plugin is under active development.

Development Setup

1. Clone repository to wp-content/plugins/
2. Install WordPress development environment
3. Enable WP_DEBUG and WP_DEBUG_LOG
4. Install Query Monitor plugin

Coding Standards

This project adheres to the WordPress Coding Standards as closely as practical.

Fully compliant areas:

• File naming: class-sapm-*.php lowercase-with-hyphens convention
• Class naming: SAPM_ClassName prefix pattern
• Method/variable naming: snake_case throughout
• Nonce verification: all AJAX handlers open with check_ajax_referer()
• Capability checks: current_user_can('manage_options') before every privileged action
• Input sanitization: sanitize_key(), sanitize_text_field(), absint() applied to all inputs
• Output escaping: esc_html(), esc_attr(), esc_url() used in HTML output
• Internationalization: all user-facing strings wrapped in __(), _e() with sapm text-domain
• WordPress helper functions: checked(), selected(), wp_localize_script() used correctly
• Security header: if ( ! defined( 'ABSPATH' ) ) { exit; } in every file

Known deviations (not security issues, stylistic only):

• Spacing inside parentheses: if(!defined(...)) instead of WPCS if ( ! defined( ... ) )
• Yoda conditions not consistently applied
• _e() used instead of esc_html_e() in some output contexts
• Class-level PHPDoc blocks missing on SAPM_Admin and SAPM_Core
• Direct file_put_contents() / file_get_contents() instead of WP_Filesystem API (MU-loader install)
• Inline `