WP Manifestindependent plugin directory
manifest / admin / msxmd-toolkit

MSXMD Toolkit

Modular WordPress admin styling, login branding, hardening and maintenance tools

by msXmd.com · github.com/shaheer-00/msxmd-toolkit

★ 1stars
0forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/shaheer-00/msxmd-toolkit/archive/refs/heads/main.zip
Readme github.com/shaheer-00/msxmd-toolkit ↗

Modular administration styling, login branding, hardening and maintenance tools for WordPress 6.5+ (PHP 7.4+).

Install

  1. In wp-admin go to Plugins → Add New → Upload Plugin.
  2. Upload msxmd-toolkit.zip and activate.
  3. Open MSXMD Toolkit in the admin menu. Every feature starts disabled — enable only what you need, per tab.

Tabs

Tab What it does
Overview Status summary and scope notes.
Login Branded login screen: palette, logo, background image, footer text/link, optional trusted custom CSS/JS.
Admin Design Dark-tech dashboard reskin scoped to a plugin body class. Optional favicon, admin footer text, trusted custom CSS/JS.
Security Disable XML-RPC, remove version markers, failed-login rate limiting, generic credential errors, REST/author enumeration blocks, file-editor disable, conservative security headers.
Performance Emoji/oEmbed/head cleanup, self-ping removal, revision limit, Heartbeat control, optional local asset version stripping (off by default, usually not a speed win).
Tools One-click maintenance: remove stuck .maintenance file, delete expired transients, clear database-tracked transients, soft rewrite flush, aged-trash daily cron.
Add-ons Register compatible add-ons via the msxmd_toolkit_addons filter; checkboxes enable registered add-ons only. Never downloads or executes uploaded code.

Recovery constants

Define these in wp-config.php (or wp-config-local.php) if a design or module locks you out:

define( 'MSXMD_TOOLKIT_DISABLE_CUSTOM_CODE', true ); // ignore saved custom CSS/JS
define( 'MSXMD_TOOLKIT_DISABLE_RATE_LIMIT', true );  // ignore saved login limits

Custom code policy

Custom CSS/JS fields are trusted-admin executable code, not sanitized prose: only users with unfiltered_html and manage_options can change or enable them, values are size/character limited, and they are emitted through WordPress inline style/script APIs. Keep them for your own trusted code; do not paste code from untrusted sources.

Add-on API example

add_filter( 'msxmd_toolkit_addons', function ( $addons ) {
    $addons['my-addon'] = array(
        'name'        => 'My Add-on',
        'min_version' => '1.0.0',
        'init'        => function () {
            // your add-on bootstrap (runs on WordPress `init`, priority 20)
        },
    );
    return $addons;
} );

Notes

  • Admin styling suppresses the known legacy msxmd-admin / msxmd-adminbar theme handles while enabled (no theme files are modified). Deactivating the plugin restores core admin styling.
  • The plugin ships no frontend CSS, does not touch the block-editor canvas, and does not recolor third-party app interiors (e.g. Elementor).
  • Rate limiting uses the server-observed IP; transients are best-effort.
  • Uninstall removes cron and the plugin's transients always; settings are deleted only if "Remove toolkit settings on uninstall" is enabled in Tools.

License

GPL-2.0-or-later. See LICENSE.