Client Sandbox Lockdown

A lightweight, secure, and user-friendly WordPress plugin designed to lockdown and declutter the WordPress administration dashboard for client demo accounts, staging environments, and sandbox preview users.

Now featuring an intuitive Admin Settings UI (Settings > Sandbox Lockdown) to effortlessly toggle menu items, widgets, admin bar shortcuts, and URL blocking rules without touching a line of code!

---

🌟 Why Client Sandbox Lockdown?

• 🖥️ Modern Admin Settings UI: Visually configure target usernames, user roles, sidebar menus, widgets, and URL blocking rules directly from the WordPress dashboard (Settings > Sandbox Lockdown).
• 🛡️ Dual-Mode Operation: Run as a Standard WordPress Plugin (wp-content/plugins/) or as an undeactivatable Must-Use (MU) Plugin (wp-content/mu-plugins/).
• ⚡ Zero Bloat: Pure, lightweight code with zero external libraries or heavy dependencies. Fast and efficient.
• 🏢 Multisite Compatible: Enforce sandbox lockdowns across standard WordPress installations and multisite networks.
• 🧰 Developer Extensible: Filter hooks and wp-config.php constants remain fully supported for advanced programmatic control.

---

🎨 User-Friendly Settings UI

The plugin provides a sleek, tabbed settings interface under Settings > Sandbox Lockdown:

Tab	Features & Capabilities
🎯 Target Accounts	Enter restricted usernames (comma-separated, default: demo) and select target user roles with built-in admin safeguard badges.
🚫 Sidebar Menus	Checkbox grid to remove core screens (Plugins, Themes, Tools, Settings, Users, Media, Pages, Posts, Comments) and third-party panels (Elementor, Hostinger, LiteSpeed), complete with Select All / Deselect All buttons.
📊 Widgets & Admin Bar	Strip overview widgets (At a Glance, Activity, Quick Draft, WordPress Events & News, Site Health, Welcome Panel) and clean up top admin bar nodes (WP logo, update badges, comments bubble, + New menu, builder links).
🛡️ URL & File Protection	Intercept direct address bar entries to sensitive files (plugins.php, themes.php, tools.php, options-general.php, post.php) and blocked ?page= keywords with instant HTTP 403 Forbidden screens.
🎨 Branding & Styling	Toggle one-click suppression of chatbot floating action buttons (such as Hostinger's Kodee assistant) and inject custom admin CSS for restricted users.

[!TIP] Built-in Safety: Only administrators with manage_options who are not restricted can access the settings screen. A real-time status banner confirms your session state.

---

🚀 Installation

Option 1: Standard Plugin Installation (Recommended)

1. Download or clone this repository into your WordPress plugins directory:

   wp-content/plugins/client-sandbox-lockdown/

2. Navigate to Plugins > Installed Plugins in your WordPress dashboard.
3. Activate Client Sandbox Lockdown.
4. Click Settings or go to Settings > Sandbox Lockdown to configure restrictions.

Option 2: Must-Use (MU) Plugin Installation (Tamper-Proof)

For environments where clients or demo users have administrator roles and you want to prevent deactivation:

1. Copy client-sandbox-lockdown.php directly into your site's wp-content/mu-plugins/ directory:

   mkdir -p wp-content/mu-plugins
   cp client-sandbox-lockdown.php wp-content/mu-plugins/

   WordPress automatically loads all single PHP files in mu-plugins/ with no activation step required.

---

⚙️ Configuration Methods

1. Visual Settings Page (Easiest)

Navigate to Settings > Sandbox Lockdown in the WordPress admin panel:

• Add target usernames (e.g., demo, client_preview, tester).
• Select target user roles (e.g., client_demo, subscriber).
• Select the menus and widgets you want to hide.
• Click Save Changes. You can revert anytime with Reset to Factory Defaults.

2. Define Target User in wp-config.php

You can lock the target username via constant in wp-config.php:

define( 'CLIENT_SANDBOX_LOCKDOWN_USER', 'client_preview' );

(When defined, this constant takes priority over the UI target username field).

3. Target Usernames or Roles via Developer Filter

Add this filter in a theme functions.php or companion mu-plugin:

// Target multiple usernames
add_filter( 'csl_target_users', function( $users ) {
    return array( 'demo', 'client_preview', 'reviewer' );
} );

// Target specific user roles
add_filter( 'csl_target_roles', function( $roles ) {
    return array( 'client_demo', 'sandbox_tester' );
} );

---

🪝 Developer Hooks & Filters Reference

All settings can be dynamically customized or overridden using standard WordPress filters:

Filter Hook	Description	Default / Source
csl_target_users	List of usernames subject to lockdown	UI setting or CLIENT_SANDBOX_LOCKDOWN_USER
csl_target_roles	List of user roles subject to lockdown	UI setting or array()
csl_removed_menus	Sidebar menu slugs/filenames to hide	UI settings or core defaults
csl_removed_submenus	Array of [ $parent, $submenu ] to hide	array( array( 'index.php', 'update-core.php' ) )
csl_removed_dashboard_widgets	Array of [ $widget_id, $context ] to remove	UI settings or core defaults
csl_removed_admin_bar_nodes	Top admin bar node IDs to remove	UI settings or core defaults
csl_blocked_page_keywords	URL query parameter substrings to block (?page=...)	UI setting (hostinger, elementor)
csl_blocked_core_files	Core admin files blocked with 403 response	UI settings (plugins.php, themes.php, etc.)

---

🛡️ Security Considerations

• Defense in Depth: In addition to hiding menus and widgets from the visual DOM, the plugin intercepts direct URL navigation attempts and halts unauthorized access with an HTTP 403 Forbidden response.
• Strict Permission Checks: The settings management page requires current_user_can('manage_options') and enforces WordPress security nonces on all form submissions.
• Target User Isolation: Users meeting lockdown criteria are completely blocked from seeing or accessing the Settings menu.

---

📋 Requirements

• WordPress: 5.8 or higher
• PHP: 7.4 or higher (fully compatible with PHP 8.0, 8.1, 8.2, and 8.3)

---

📄 License

This project is licensed under the GNU General Public License v2.0 or later (GPL-2.0-or-later). See the LICENSE file for full details.

---

🤝 Contributing

Contributions, issues, and feature requests are welcome! Feel free to open an issue or pull request on GitHub.