LayoutLock Pro

Safe Client Editing for WordPress & Elementor

LayoutLock Pro is a WordPress plugin foundation for agencies, freelancers, Elementor developers, and site owners who need to hand over websites to clients without giving those clients enough access to damage the layout, templates, global styles, plugins, themes, or technical admin settings.

The core promise is simple:

Give clients editing access without giving them the power to break the website.

What The Plugin Does

LayoutLock Pro creates a controlled editing environment for WordPress and Elementor websites. Client users can update safe content such as text, images, buttons, links, posts, pages, and media, while dangerous design and technical areas stay protected.

It is not a generic security plugin and it is not an Elementor widget pack. It is a client-safe editing and layout protection system built for professional site handoff workflows.

Target Users

• WordPress freelancers
• Web design agencies
• Elementor developers
• Maintenance agencies managing client websites
• University or organization website administrators
• Business owners who need limited editor access

Current Version

Version: 1.0.0
Author: Abe Prangishvili
Plugin slug: layoutlock-pro
Text domain: layoutlock-pro
License: GPL-2.0-or-later
Requires WordPress: 6.2+
Requires PHP: 8.0+

Key Features

Client Mode

Client Mode is the main protection switch. When enabled, LayoutLock Pro limits dangerous WordPress admin screens and activates safe editing behavior for restricted users.

Features:

• One-click Client Mode enable/disable.
• Optional wp-config lock with LAYOUTLOCK_FORCE_CLIENT_MODE.
• Admin bar status indicator for trusted admins.
• Client-friendly dashboard widget.
• Restricted users see a simplified editing experience.

Role Presets And Capabilities

The plugin uses custom capabilities instead of relying only on role names.

Included capabilities:

• layoutlock_manage_settings
• layoutlock_manage_roles
• layoutlock_view_logs
• layoutlock_restore_snapshots
• layoutlock_manage_white_label
• layoutlock_safe_edit

Included role presets:

• Agency Admin
• Designer
• Client Editor
• Content Editor
• Reviewer

WordPress Admin Guard

LayoutLock Pro protects sensitive WordPress admin areas for restricted users.

Protected areas include:

• Plugins
• Plugin installation
• Plugin editor
• Themes
• Theme installation
• Theme editor
• Appearance customization
• Tools
• Settings
• Updates
• Site health
• Elementor settings
• Optional WooCommerce and SEO plugin settings

The plugin does not only hide menu items. It also blocks direct URL access to protected admin pages.

Elementor Protection

LayoutLock Pro includes an Elementor compatibility layer that works defensively and does not fatal if Elementor is inactive.

Current Elementor protections include:

• Safe editing notice inside the Elementor editor.
• Client-side blocking for common destructive actions.
• Optional hiding of Advanced tab controls.
• Optional hiding of Style tab controls.
• Drag/reorder lock behavior for restricted users.
• Template access protection for Elementor library documents.
• Snapshot creation before Elementor saves.
• Elementor edit activity logging.

Important: deeper server-side Elementor control validation is planned for the commercial Pro roadmap. The current implementation is a production-oriented foundation, but Elementor API-level enforcement should be expanded before treating all visual controls as fully tamper-proof.

Snapshots And Restore

LayoutLock Pro can create snapshots before protected edits.

Snapshot data includes:

• WordPress post title/content/excerpt/status
• Elementor _elementor_data
• Elementor _elementor_css
• Elementor _elementor_page_settings

Snapshot features:

• Automatic snapshots before WordPress post updates.
• Automatic snapshots before Elementor saves.
• Snapshot throttling to avoid excessive writes.
• Maximum snapshots per page.
• Snapshot retention settings.
• Admin restore action with nonce and capability checks.

Activity Logging

The plugin records important activity in a custom database table.

Logged events include:

• Client Mode enabled or disabled
• Role preset changes
• Restricted page access attempts
• Elementor page edits
• Snapshot creation
• Snapshot restore
• Settings changes
• White-label setting changes
• Settings import events

Log fields include:

• User ID
• Object ID
• Object type
• Action
• Details
• IP address
• User agent
• Timestamp

White Label Mode

Agency-focused white-label settings include:

• Custom plugin display name
• Agency logo attachment ID
• Client dashboard title
• Client dashboard welcome text
• Hide branding from clients
• Custom footer text
• Custom accent color

Settings Export And Import

Agencies can export plugin settings as JSON and import them into another site. This is useful for standardizing client handoff settings across multiple websites.

Safe Uninstall

By default, uninstall does not delete plugin data.

Data is removed only if the administrator explicitly enables full data removal in settings.

When full removal is enabled, uninstall removes:

• LayoutLock settings
• Role preset options
• White-label options
• Client Mode state
• Logs table
• Snapshots table
• LayoutLock custom roles and capabilities

Database Tables

The plugin creates two custom tables on activation.

wp_layoutlock_logs

Stores important user and protection events.

Columns:

• id
• user_id
• object_id
• object_type
• action
• details
• ip_address
• user_agent
• created_at

wp_layoutlock_snapshots

Stores protected post and Elementor snapshot data.

Columns:

• id
• post_id
• user_id
• snapshot_type
• snapshot_data
• created_at

Plugin Structure

layoutlock-pro.php
uninstall.php
README.md
includes/
  Admin/
  Core/
  Elementor/
  Integrations/
  Logs/
  Roles/
  Security/
  Settings/
  Snapshots/
assets/
  css/
  js/
templates/
  admin/
languages/

Main Classes

• LayoutLockPro\Core\Plugin
• LayoutLockPro\Core\Activator
• LayoutLockPro\Core\Deactivator
• LayoutLockPro\Core\Autoloader
• LayoutLockPro\Core\Capabilities
• LayoutLockPro\Core\Rest_Controller
• LayoutLockPro\Core\Ajax_Controller
• LayoutLockPro\Admin\Admin_Menu
• LayoutLockPro\Settings\Settings_Manager
• LayoutLockPro\Settings\White_Label_Manager
• LayoutLockPro\Roles\Role_Manager
• LayoutLockPro\Roles\Client_Mode
• LayoutLockPro\Security\Security_Manager
• LayoutLockPro\Security\Admin_Menu_Guard
• LayoutLockPro\Elementor\Elementor_Lock_Manager
• LayoutLockPro\Elementor\Elementor_Control_Filter
• LayoutLockPro\Logs\Activity_Logger
• LayoutLockPro\Snapshots\Snapshot_Manager
• LayoutLockPro\Integrations\Integration_Status

Installation

1. Download or clone this repository.
2. Copy the plugin folder to:

wp-content/plugins/layoutlock-pro

3. Activate LayoutLock Pro in WordPress admin.
4. Open LayoutLock in the WordPress admin menu.
5. Review:
   • Client Mode
   • Roles & Permissions
   • Admin Guard
   • Elementor Locks
   • Snapshots
   • White Label
   • Settings
6. Assign client-safe roles.
7. Enable Client Mode.

Force Client Mode

To force Client Mode from wp-config.php:

define( 'LAYOUTLOCK_FORCE_CLIENT_MODE', true );

When this constant is enabled, Client Mode cannot be disabled from the admin UI.

Security Notes

• Admin forms use nonce verification.
• AJAX actions use nonce verification.
• REST routes require manager capabilities.
• Admin actions check current_user_can().
• Input is sanitized with WordPress sanitization helpers.
• Output is escaped with WordPress escaping helpers.
• Restricted users are blocked by capability filtering and direct URL checks.
• Plugin/theme editing is disabled.
• Client roles cannot manage plugins, themes, updates, or core settings while Client Mode is active.
• Snapshot restore requires LayoutLock restore capability and edit_post permission.
• Data is retained on uninstall unless full data removal is explicitly enabled.

Known Security Limitation

The current Elementor protection layer includes strong UI-level restrictions and template access blocking, but complete Elementor tamper resistance requires deeper server-side validation of Elementor save payloads.

Before selling this as a fully hardened Pro product, add server-side Elementor payload validation that rejects unauthorized:

• Section deletion
• Widget deletion
• Element reorder
• Advanced tab changes
• Responsive control changes
• Custom CSS changes
• Global style changes
• Template and Theme Builder modifications
• Dangerous widget configuration changes

Roadmap

Phase 1: Minimum Sellable Version

• Plugin activation/deactivation
• Admin dashboard
• Client Mode switch
• Role presets
• Admin menu restrictions
• Direct URL blocking
• Basic Elementor protection
• Safe content editing concept
• Basic activity log
• Basic snapshots before Elementor save
• Settings export/import

Phase 2: Commercial Pro Version

• Server-side Elementor control restrictions
• Snapshot diff UI
• Advanced restore UI
• Client approval workflow
• Advanced activity log filters
• Email notifications
• Multisite support
• License system integration
• More optional integrations

Development Notes

This repository is structured as a commercial plugin foundation, not a toy demo. The code is modular, namespaced, and prepared for future licensing, deeper Elementor controls, multisite behavior, and agency workflow features.

License

GPL-2.0-or-later.