Description
WLock lets a site administrator define an approved whitelist of plugin and theme slugs. Once enabled, any attempt to install something that isn’t on the list — whether searched for in the WordPress.org repository or uploaded as a .zip — is blocked with a clear on-screen explanation.
This is useful for:
- Agencies who manage client sites and want to prevent clients (or other admin-level users) from installing unapproved plugins/themes that cause support issues.
- Site owners who want a second line of defense against accidental installs of low-quality or conflicting plugins.
- Teams with multiple administrators who want to standardize which tools are allowed on a site.
What it does not do
- It does not affect activating, deactivating, deleting, or updating anything already installed — only fresh installs are restricted.
- It does not restrict installs made outside of wp-admin (WP-CLI, SFTP, etc.) — those bypass the WordPress installer entirely and are outside what any plugin can intercept.
- It is fully self-managed: whoever has the
manage_optionscapability on the site can enable/disable it and edit the whitelist at any time from Settings WLock, and can deactivate the plugin like any other.
Screenshots
Installation
- Upload the plugin files to
/wp-content/plugins/wlock, or install directly through the WordPress plugins screen. - Activate the plugin through the ‘Plugins’ screen in WordPress.
- Go to Settings WLock.
- Add the plugin/theme slugs you want to approve (one per line), then check “Block installation of anything not on the approved lists below” and save.
FAQ
-
How do I find a plugin’s slug?
-
It’s the folder name the plugin installs into under
wp-content/plugins/, which is also the last part of its WordPress.org URL. For example, Akismet installs towp-content/plugins/akismet, and its directory page ishttps://wordpress.org/plugins/akismet/— so its slug isakismet. -
Does this stop existing plugins/themes from being updated?
-
No. Updates to anything already installed are never blocked, only fresh installs.
-
Can a site admin bypass this?
-
Yes, deliberately. Anyone with the
manage_optionscapability can edit the whitelist or deactivate the plugin. WLock is a self-managed safeguard, not a hard lock against the site’s own administrators. -
Does this work with uploaded .zip installs, not just the WordPress.org search?
-
Yes. The check runs after a package is unpacked, regardless of whether it came from the repository or a direct upload.
-
Is this safe to use?
-
All settings are saved through WordPress’s own Settings API, which handles the nonce and capability checks for you, and every value is sanitized on save and escaped on output. Only users with the
manage_optionscapability can view or change the whitelist.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“WLock – Lock Your Site Against Unapproved Installs” is open source software. The following people have contributed to this plugin.
Contributors
Translate “WLock – Lock Your Site Against Unapproved Installs” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.0.0
- Initial release.