manifest / security / wp-plugin-installation-guard

WP Plugin Installation Guard

WordPress MU plugin for controlling ZIP uploads and plugin directory installations, with optional administrator email notifications.

by Shutnic[mz] · github.com/recediv/wp-plugin-installation-guard · website

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/recediv/wp-plugin-installation-guard/archive/refs/heads/main.zip

No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Readme github.com/recediv/wp-plugin-installation-guard ↗

An MU plugin that controls plugin ZIP uploads and installations from the WordPress plugin directory, with optional email notifications.

Default behavior is unchanged: installations and ZIP uploads follow normal WordPress permissions; notifications are off.

Installation

Requires PHP 8.1+.

Download wp-plugin-installation-guard.zip from Releases and extract its contents into wp-content/mu-plugins. Create this directory if it does not exist.

The plugin appears under Plugins → Must-Use automatically. No activation is needed. To update, extract the new archive into the same directory and replace the existing files.

MU plugins do not receive standard WordPress update notifications. Check Releases for new versions and update manually.

To uninstall, delete mu-plugins/wp-plugin-installation-guard.php first, then the mu-plugins/wp-plugin-installation-guard directory.

Code → Download ZIP contains source files. Use the archive from Releases for installation.

Configuration

Define these constants in wp-config.php before it loads wp-settings.php.

Constant	Default	Purpose
`ALLOW_PLUGIN_UPLOADS`	`true`	Allow installation and replacement through ZIP uploads
`ALLOW_PLUGIN_INSTALLS`	`true`	Allow installation from the plugin directory
`PLUGIN_GUARD_EMAILS`	`false`	Email when a logged-in user accesses the blocked ZIP upload handler
`PLUGIN_INSTALL_EMAILS`	`false`	Email after a successful installation or ZIP replacement

For example, block ZIP uploads and enable notifications about requests to the blocked upload handler:

define( 'ALLOW_PLUGIN_UPLOADS', false );
define( 'PLUGIN_GUARD_EMAILS', true );

Use true and false without quotes. The settings are independent and do not grant additional user permissions.

Regular updates remain available. Updates from ZIP files require ALLOW_PLUGIN_UPLOADS = true. If directory installations are blocked but ZIP uploads are allowed, use Plugins → Upload Plugin.

Enabled notifications are sent to the site administrator's email address. After a notification is sent successfully, repeated blocked ZIP requests of the same type from the same account do not trigger new emails for 15 minutes.

With PLUGIN_INSTALL_EMAILS enabled, each successful installation or ZIP replacement triggers a separate email. Regular updates do not trigger notifications.