Disable Install Plugins releases

Version: 0.1.1

Disable Install Plugins is a small WordPress must-use plugin for sites where plugin files are managed through version control, deployment tooling, or another controlled process.

It removes selected plugin-management controls from wp-admin and blocks their direct browser actions. It deliberately does not interfere with WP-CLI, cron, automatic update execution, Composer, deployment tools, or other non-admin processes.

Requirements

• WordPress 7.0 or later.
• PHP 8.2 or later.
• Installation as a must-use plugin is recommended.

Default Behaviour

Out of the box, users cannot use wp-admin to:

• Open the Add Plugin screen or install/upload a plugin.
• Permanently delete an installed plugin.

The activate/deactivate controls and automatic-update setting controls remain available by default. Either can be restricted through a constant or filter.

Manual plugin updates are not restricted. The automatic-update option controls only whether users can enable or disable automatic updates in wp-admin; scheduled automatic updates continue to run according to the saved WordPress configuration.

Configuration

Define constants in wp-config.php before WordPress loads must-use plugins:

define( 'TEMPERED_DIP_DISABLE_INSTALL', true );
define( 'TEMPERED_DIP_DISABLE_DELETE', true );
define( 'TEMPERED_DIP_DISABLE_ACTIVATE', false );
define( 'TEMPERED_DIP_DISABLE_AUTO_UPDATES', false );

Each setting also has a filter, which runs after the corresponding constant:

add_filter( 'tempered_disable_install_plugins_disable_install', '__return_true' );
add_filter( 'tempered_disable_install_plugins_disable_delete', '__return_true' );
add_filter( 'tempered_disable_install_plugins_disable_activate', '__return_true' );
add_filter( 'tempered_disable_install_plugins_disable_auto_updates', '__return_true' );

Returning false leaves that wp-admin operation available under WordPress' normal capability checks.

Capabilities

Every restriction has a separate exception capability:

The plugin does not add these capabilities to any role, including Administrator. Add only the required capability with another plugin or WP-CLI. For example:

wp cap add administrator dip_install_plugins

The exception capability is an additional policy gate, not a replacement for WordPress' own capabilities. A user must have both the relevant WordPress core capability and the exception capability to use a restricted operation.

Capability names can be changed with the dynamic tempered_disable_install_plugins_{$operation}_capability filter, where the operation is install, delete, activate, or auto_updates.

Installation

Conventional Plugin

The release ZIP is a standard WordPress plugin package:

1. Go to Plugins > Add Plugin > Upload Plugin.
2. Upload the release ZIP and choose Install Now.
3. Activate Disable Install Plugins.

Must-Use Plugin

To install the same release as a must-use plugin:

1. Extract the disable-install-plugins/ directory into wp-content/mu-plugins/.
2. Copy wp-content/mu-plugins/disable-install-plugins/mu-plugin/disable-install-plugins.php to wp-content/mu-plugins/disable-install-plugins.php.
3. Confirm that Disable Install Plugins appears in the Must-Use section of the Plugins screen.

No activation step or admin settings screen is provided in must-use mode. The loader is deliberately nested under its own mu-plugin/ directory so WordPress does not detect it as a second conventional plugin.

Development

Install dependencies:

composer install

Run PHP syntax checks, WordPress Coding Standards, and unit tests:

composer check

Build and inspect a production release ZIP:

bash scripts/release-build.sh build-zip "$PWD" /tmp 0.1.1

Releases

Releases are driven by the Version: header in disable-install-plugins.php. To prepare one:

1. Update the plugin and MU loader version headers.
2. Add a matching release section to CHANGELOG.md.
3. Push the version change to main.

GitHub Actions creates a release only when the version changes or the matching release does not yet exist.

Security

Please report suspected vulnerabilities privately using the process in SECURITY.md.