WP Manifestindependent plugin directory
manifest / utilities / user-first-essential

User First Essential WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

User First Essential is a plugin for customizing your WordPress installation. It allows you to set permalink structures, remove default plugins, themes, posts, and pages. With User First Essential, you can streamline your site's setup process and start with a clean slate.

★ 1stars
v1.1.1latest · 3 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/huzaifaalmesbah/user-first-essential/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

User First Essential is a plugin for customizing your WordPress installation. It allows you to set permalink structures, remove default plugins, themes, posts, and pages. With User First Essential, you can streamline your site's setup process and start with a clean slate.

Features

  • Set your permalink structure to post name for better SEO-friendly URLs.
  • Remove default plugins like Hello Dolly and Akismet that may not be needed.
  • Remove default themes like Twenty Twenty-One, Twenty Twenty-Two, and Twenty Twenty-Three to keep your theme selection clean.
  • Delete default posts and pages like "Hello World" and "Sample Page" to start with a fresh site.

Installation

  1. Upload the user-first-essential folder to the /wp-content/plugins/ directory.
  2. Activate the plugin through the 'Plugins' menu in WordPress.
  3. Go to the 'User First Essential' settings page to configure your plugin settings.

Frequently Asked Questions

How do I use this plugin?

After activating the plugin, go to the 'UFE' menu in your WordPress dashboard. There you can choose to set your permalink structure, remove default plugins, remove default themes, and remove default pages and posts. Make sure to carefully review and backup your website before performing removal actions.

Can I undo the removal of default content?

No, the removal of default content like plugins, themes, posts, and pages is irreversible. Make sure to back up your data before using this plugin.

Changelog

1.1.1

  • Fix: WordPress Coding Standards.
  • Fix: Deprecated: Function get_page_by_title is deprecated since version 6.2.0! Use WP_Query instead.
  • Fix: Setting Page location Change to Under tools
  • Add: ✔ Setting Page After Change or already Set

1.0

  • Initial release.

Contribute

If you find a bug or have a feature suggestion, please submit it in the GitHub repository.

Credits

Developed by Huzaifa Al Mesbah.

License

This plugin is released under the GPLv3 license. You can find a copy of the license in the 'license.txt' file included with this package or visit http://www.gnu.org/licenses/gpl-3.0.html.

Releases

2 releases.

Tag
Published
v1.1.1 latest
Sep 17, 2023 3 years ago
Sep 12, 2023 3 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

User First Essential 1.1.1 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.1.1
Findings
1
Worst severity
high
Content hash
b63fe48827f9c540eb92129a…

Findings

  • high Missing capability check on destructive UFE admin_init handler

    missing_capability

    handle_form_submission runs on admin_init whenever ufe_nonce verifies. It does not call current_user_can('manage_options') despite the submenu requiring that capability. Any authenticated user who can access wp-admin and forge their own nonce can delete Hello Dolly/Akismet, delete default themes, delete posts, and change permalinks.

    class-user-first-essential-plugin.php:114-147

    Recommendation

    Require current_user_can('manage_options') before processing. Optionally also verify the request targets the UFE settings page.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.