Install
Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.
Install straight from GitHub with WP-CLI:
wp plugin install https://github.com/shaheer-00/msxmd-toolkit/releases/download/v1.0.0/msxmd-toolkit.zipModular administration styling, login branding, hardening and maintenance tools for WordPress 6.5+ (PHP 7.4+).
Install
- In wp-admin go to Plugins → Add New → Upload Plugin.
- Upload
msxmd-toolkit.zipand activate. - Open MSXMD Toolkit in the admin menu. Every feature starts disabled — enable only what you need, per tab.
Tabs
| Tab | What it does |
|---|---|
| Overview | Status summary and scope notes. |
| Login | Branded login screen: palette, logo, background image, footer text/link, optional trusted custom CSS/JS. |
| Admin Design | Dark-tech dashboard reskin scoped to a plugin body class. Optional favicon, admin footer text, trusted custom CSS/JS. |
| Security | Disable XML-RPC, remove version markers, failed-login rate limiting, generic credential errors, REST/author enumeration blocks, file-editor disable, conservative security headers. |
| Performance | Emoji/oEmbed/head cleanup, self-ping removal, revision limit, Heartbeat control, optional local asset version stripping (off by default, usually not a speed win). |
| Tools | One-click maintenance: remove stuck .maintenance file, delete expired transients, clear database-tracked transients, soft rewrite flush, aged-trash daily cron. |
| Add-ons | Register compatible add-ons via the msxmd_toolkit_addons filter; checkboxes enable registered add-ons only. Never downloads or executes uploaded code. |
Recovery constants
Define these in wp-config.php (or wp-config-local.php) if a design or
module locks you out:
define( 'MSXMD_TOOLKIT_DISABLE_CUSTOM_CODE', true ); // ignore saved custom CSS/JS
define( 'MSXMD_TOOLKIT_DISABLE_RATE_LIMIT', true ); // ignore saved login limitsCustom code policy
Custom CSS/JS fields are trusted-admin executable code, not sanitized
prose: only users with unfiltered_html and manage_options can change
or enable them, values are size/character limited, and they are emitted
through WordPress inline style/script APIs. Keep them for your own trusted
code; do not paste code from untrusted sources.
Add-on API example
add_filter( 'msxmd_toolkit_addons', function ( $addons ) {
$addons['my-addon'] = array(
'name' => 'My Add-on',
'min_version' => '1.0.0',
'init' => function () {
// your add-on bootstrap (runs on WordPress `init`, priority 20)
},
);
return $addons;
} );Notes
- Admin styling suppresses the known legacy
msxmd-admin/msxmd-adminbartheme handles while enabled (no theme files are modified). Deactivating the plugin restores core admin styling. - The plugin ships no frontend CSS, does not touch the block-editor canvas, and does not recolor third-party app interiors (e.g. Elementor).
- Rate limiting uses the server-observed IP; transients are best-effort.
- Uninstall removes cron and the plugin's transients always; settings are deleted only if "Remove toolkit settings on uninstall" is enabled in Tools.
License
GPL-2.0-or-later. See LICENSE.
Releases
1 release. Each count is every asset in that release; expand a row for the breakdown.