Description
One plugin to replace twenty. Free forever.
I was tired of my WordPress installs looking like a graveyard of single-purpose plugins — one for SEO, one for cache, one for SMTP, one for redirects, one for backups. Each one with its own dashboard, its own freemium dance. So I built Blaminhor Essentials — and I never sell your data.
Why this plugin exists:
- Every WordPress essential under one roof. SEO, cache, SMTP, backup, cookie banner, contact forms, anti-spam, redirections, broken links, duplicator, database optimizer, domain changer, fatal error recovery, favicon, HTTPS redirect, hide login, image sizes, maintenance mode, mute core emails, post types order, user role editor, classic editor, disable comments. Switch on what you use today; the rest stays out of your way until the day you need it.
- Your existing data comes with you. Switching does not mean starting over: built-in importers for Yoast, Rank Math, All in One SEO, WP Mail SMTP, Post SMTP, Easy WP SMTP, Redirection, Safe Redirect Manager, Custom Taxonomy Order, Favicon by RealFaviconGenerator, and the standalone User Role Editor. The dedicated plugins you’ve stacked one by one over the years, now in a single coherent toolkit.
- No tax for what you don’t use. Each module is independent: an inactive one loads no PHP, registers no hooks, enqueues no assets, runs no queries. You’re only paying — in memory and milliseconds — for the features you actually turned on.
- Rebuilt on modern PHP. Since version 2, every module has been re-engineered from the ground up to take full advantage of PHP 8 — strict types, enums and value objects — for tighter security and faster, leaner execution.
- Free. All features above are free. No tracking, no telemetry.
- Translated in 11 languages. English, French, German, Spanish, Italian, Portuguese (Brazil), Japanese, Russian, Turkish, Dutch, Indonesian.
- You can email me anytime.
hi+wp@blaminhor.com
Available Features — 23 modules:
Performance
- Cache & Performance — Page cache, asset optimization and lazy load, plus a Web Vitals dashboard and an auto-pilot that benchmarks each speed option on your own pages.
SEO & Links
- SEO/GEO — Meta titles and descriptions with SERP preview, XML sitemaps, per-type indexing control, and one-click import from Yoast, Rank Math or All in One SEO.
- Redirections — Simple or regex redirects (301, 302, 307, 410, 451) with hit counters, slug-change detection, and CSV / plugin import (Redirection, Safe Redirect Manager).
- Broken Links — Scan posts, pages and custom post types for dead internal and external links, with live results and one-click fixes.
Emails
- SMTP Mailer — Reliable delivery through 12+ providers (Brevo, SendGrid, Mailgun, AWS SES…) with automatic relay fallback, logging, and import from WP Mail SMTP, Post SMTP or Easy WP SMTP.
- Mute Core Emails — Silence WordPress automatic notifications (updates, new users, password changes, comments) individually.
Security & Maintenance
- Cookie Banner — Self-hosted consent banner that blocks tracking scripts and embeds until visitors agree, with GDPR/CCPA/LGPD presets, Consent Mode v2, and a 13-month consent log.
- Anti-Spam — Block spam bots on the comment, login, registration and password forms with a hidden honeypot trap, and encode the email addresses shown on your site so harvesters cannot read them — no CAPTCHA, no external service.
- Hide Login Page — Replace wp-login.php with a custom URL and block bots probing the default login.
- HTTPS Redirect — Force HTTPS site-wide with optional mixed-content fixing and an HSTS header.
- Fatal Error Recovery — Recover a crashed site from a secret URL by disabling the culprit plugin, with no FTP access.
- Maintenance — Show a Coming Soon (200) or Maintenance (503) page, with role and IP whitelisting.
- User Role Editor — Create, clone and edit roles and capabilities, with per-user overrides, JSON import/export and one-click import from the standalone User Role Editor plugin.
Database & Migration
- Backup & Restore — Scheduled backups of files and database as separate archives, with a safety backup and one-click undo before every restore.
- Database Optimizer — Clean revisions, transients, spam and orphaned data on a schedule, with an at-a-glance size and overhead overview.
- Domain Changer — Change your site domain and update every database reference, including serialized data, in one click.
Content & Media
- Calendar (Beta) — Publish events with recurrence, venues, organizers, calendar views, iCal import and RSVP, and run a full booking system for appointments and resource rentals with reminders and Stripe payments.
- Forms (Beta) — Accessible drag-and-drop contact forms with entries stored in the database, no-CAPTCHA spam protection, and GDPR controls.
- Content Duplicator — Clone any post, page or custom post type with all fields, taxonomies and child posts; supports every major page builder.
- Classic Editor & Widgets — Restore the classic editor and/or the classic widgets screen, independently.
- Image Sizes — Disable unused thumbnail sizes, register custom ones, and regenerate existing images.
- Favicon Generator — Generate every favicon format (PNG, Apple Touch, Android, Windows tiles) from a single square image, or import an existing set from Favicon by RealFaviconGenerator or the WordPress Site Icon.
- Post Types Order — Reorder posts, pages, custom post types and taxonomies with drag and drop, and import an existing term order from Custom Taxonomy Order.
- Disable Comments — Remove the comment system site-wide and hide it from the admin, reversibly.
WP-CLI Commands
Every module is fully configurable from the command line through the wp blaminhor ... namespace — useful for scripts, CI/CD, fixtures, and AI assistants like Claude Code or Cursor. The CLI delegates to the same validation pipeline as the admin UI, so settings stay consistent.
Discover the full command tree:
wp help blaminhor
wp help blaminhor <subcommand>
Lifecycle:
wp blaminhor info
wp blaminhor modules list [--active-only|--inactive-only] [--category=<slug>]
wp blaminhor modules activate <module-id>
wp blaminhor modules deactivate <module-id> [--yes]
A few examples per module (full reference: see the bundled llms.txt):
- SMTP:
wp blaminhor smtp add-relay --name=Gmail --host=smtp.gmail.com --port=587 --encryption=tls --from-email=hello@example.com,wp blaminhor smtp test --to=admin@example.com - Redirections:
wp blaminhor redirections add --source=/old --target=/new,wp blaminhor redirections list --search=/blog - SEO/GEO:
wp blaminhor seo set --sitemap-enabled=true --ai-block-chatgpt=true,wp blaminhor seo list-urls - Maintenance:
wp blaminhor maintenance enable --headline="Be right back",wp blaminhor maintenance disable - HTTPS Redirect:
wp blaminhor https-redirect enable --hsts=true - Database Optimizer:
wp blaminhor db-optimizer scan,wp blaminhor db-optimizer clean --tasks=revisions,spam_comments - Cache:
wp blaminhor cache purge,wp blaminhor cache status - Backup:
wp blaminhor backup list,wp blaminhor backup delete <prefix> --yes
All listing commands accept --format=table|json|csv|yaml|count|ids for scripting. Mutating commands require --user=<admin-login> for the capability check. Sensitive values (SMTP passwords, recovery keys) are never printed in cleartext.
The Backup module exposes list and delete only — creating and restoring a backup remain admin-only, where the stepped AJAX flow avoids PHP timeouts and the pre-restore safety net runs.
Screenshots
Installation
- Upload the
blaminhor-essentialsfolder to the/wp-content/plugins/directory. - Activate the plugin through the ‘Plugins’ menu in WordPress.
- Go to “Blaminhor Essentials” in the admin menu.
- Turn on the features you need.
FAQ
-
Will activating all features slow down my site?
-
No. Each module only loads its code when activated. Disabled modules have zero impact on performance — no PHP loaded, no hooks registered, no queries run.
-
Is it really free?
-
Yes, genuinely free. Every module and every feature ships in the single free download — no expiring trial, no ads in your dashboard, nothing held back for a paywall. I don’t track you and I don’t sell your data. If it saves you time, a kind review is all I ask.
-
What are the requirements?
-
WordPress 6.2 or newer and PHP 8.1 or newer. It runs fine on standard shared hosting: heavy jobs like backups and link scans are processed in small batches to avoid timeouts, and no background service or special server access is required.
-
Can I replace multiple plugins with this one?
-
Yes, that’s the main goal. Blaminhor Essentials can replace Redirection, Yoast/Rank Math, WP Mail SMTP, UpdraftPlus, Duplicate Post, User Role Editor, and many others.
-
Will it conflict with my existing SEO, cache or SMTP plugin?
-
Every module is off by default and independent, so installing the plugin changes nothing until you switch something on. The one thing to avoid is running two plugins that do the same job — two SEO plugins, or two page caches — since they can clash. The clean path is to import your data into the matching module, then deactivate the old plugin.
-
How do I migrate my data from other plugins?
-
Several modules include import features, so you don’t lose your existing setup:
– SEO: Import titles, descriptions and keywords from Yoast SEO, Rank Math or All in One SEO.
– SMTP: Import from WP Mail SMTP, Post SMTP or Easy WP SMTP.
– Redirections: Import from the Redirection plugin, Safe Redirect Manager or a CSV file.
– Post Types Order: Import your saved term order from Custom Taxonomy Order.
– Favicon: Import an existing favicon set from Favicon by RealFaviconGenerator, or from the WordPress Site Icon.
– User Role Editor: Import roles and custom capabilities from the standalone User Role Editor plugin, or from a JSON export. -
Does the plugin send my data to external servers?
-
No. Everything runs on your own server by default — no telemetry, no usage tracking. The only data that ever leaves your site is what you set up yourself: the SMTP module sends your emails through the relay you choose, the Cache module can run a Google PageSpeed audit when you click the button, and Fatal Error Recovery can email me the errors this plugin causes if you switch that option on. Nothing else.
-
What exactly is sent if I turn on error reports?
-
That option lives in Fatal Error Recovery Settings and is off until you tick it. Once on, an error raised inside a Blaminhor Essentials file is emailed to me so I can fix it; errors from other plugins or from your theme are never sent. A report contains the error message, the file and line inside the plugin, and the plugin, WordPress and PHP versions. File paths, email addresses, IP addresses and credentials are stripped out first, and your site address is never included — only a one-way identifier that cannot be traced back to your site. The same error is reported once per plugin version, five reports per version at most. Untick the option and everything stops immediately.
-
What happens to my settings if I deactivate or uninstall the plugin?
-
Your data is safe by default. Deactivating keeps every setting untouched, so you can switch the plugin back on right where you left off. Even deleting the plugin removes nothing unless you first turn on the “Delete all data on uninstall” option — and your posts, pages and media are never touched either way. If you do opt in, uninstalling cleans up the plugin’s own options, tables and files so nothing is left behind.
-
If I turn off a module, do I lose its data?
-
No. Turning a module off only stops it from running — your redirects, SEO meta, form entries and settings are all kept, so you can switch it back on later exactly as it was. Data is only removed if you delete the whole plugin with the “Delete all data on uninstall” option enabled.
-
Can I back up my entire site?
-
Yes. The Backup module creates separate archives for database, plugins, themes and uploads. You can schedule automatic backups (daily, weekly, monthly) and set retention limits.
-
What happens if a backup restore goes wrong?
-
The plugin automatically creates a safety backup before any restore. If something goes wrong, you can undo it with one click.
-
Does the SMTP module support multiple providers?
-
Yes. You can configure multiple relays with automatic fallback. If the primary one fails, it tries the next in your list.
-
Can I duplicate Elementor/Divi pages?
-
Yes. The Content Duplicator fully supports all major page builders, including Elementor, Divi, Beaver Builder, Brizy and Oxygen.
-
Can I control which user roles can access certain features?
-
Yes. For example, the Post Types Order module lets you choose which roles can reorder content (Administrator, Editor or Author), and the User Role Editor gives you fine-grained control over every capability.
-
What if my site crashes after a plugin update?
-
The Fatal Error Recovery module detects PHP fatal errors and gives you a secret recovery URL to deactivate the problematic plugin — no FTP access needed.
-
What languages is the plugin available in?
-
Eleven. English, French, German, Spanish, Italian, Brazilian Portuguese, Japanese, Russian and Turkish are fully translated; Dutch and Indonesian are partially translated, with anything untranslated falling back to English.
-
Does the plugin work with multisite?
-
Yes, on a per-site basis. Each site keeps its own settings, its own database tables and its own backups (Backup, Domain Changer and Database Optimizer store archives in a separate per-site folder), so sites stay fully isolated. Network activation, deactivation and uninstall apply cleanly to every site, and sites created later are set up automatically. Two notes: server-level browser cache and GZIP rules live in the shared root .htaccess and are managed by a network administrator (PHP page caching still applies on every site); and there is no central Network Admin screen yet, so you configure each site from its own dashboard.
-
How can I get support?
-
Email me at hi+wp@blaminhor.com or visit wp.blaminhor.com. You can also use the feedback form on the plugin dashboard.
Reviews
Contributors & Developers
“Blaminhor – All-in-One: Redirects, Favicon, User Roles & 20 More” is open source software. The following people have contributed to this plugin.
Contributors
“Blaminhor – All-in-One: Redirects, Favicon, User Roles & 20 More” has been translated into 3 locales. Thank you to the translators for their contributions.
Translate “Blaminhor – All-in-One: Redirects, Favicon, User Roles & 20 More” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
2.5.13
- Fixed: Backup – Backups no longer fail with a fatal error on hosts that cap PHP execution time; the run continues over as many passes as it needs.
- Fixed: Backup – Restoring a backup no longer fails outright on hosts that block changes to the PHP time limit.
- Fixed: Backup – A pre-update snapshot that cannot be completed is reported as failed instead of being kept as an unusable restore point.
- Fixed: Backup – Empty folders such as wp-content/upgrade are kept in split archives, so WordPress can still update itself after a restore.
- Fixed: Core – Uninstalling the plugin removes the dashboard notice preferences it had left behind in the database.
- Improved: Backup – Archives are sized from the time your host actually grants rather than a fixed size in megabytes, and scheduled backups resume where they stopped.
- Improved: Backup – Large databases are exported in a stream, so a big site no longer runs out of memory while its dump is built.
2.5.12
- Fixed: Backup – Creates the pre-update backup before WordPress core updates, whether the update is started from the dashboard, by automatic updates or from WP-CLI.
- Fixed: Backup – Reports a pre-update backup that could not be created, instead of letting the update run silently without a restore point.
- Fixed: Backup – Applies the “keep last N backups” limit to backups created from the admin screen, and never removes scheduled, uploaded or pre-restore backups.
- Fixed: Backup – Flags a scheduled, pre-update or WP-CLI backup that was interrupted mid-run, instead of offering it for restore.
2.5.11
- Fixed: Core – Prevents a fatal error on activation on sites running PHP 8.1.
- Fixed: SEO/GEO – Imported title and description variables from Yoast, Rank Math and All in One SEO now render correctly instead of showing their raw code in the page title.
- Fixed: Cache & Performance – The cache stack status badge now reads correctly in translated languages.
- Improved: SEO/GEO – The importer also brings over site-wide defaults (title templates, separator, search-results visibility), not just per-page settings.
2.5.10
- Added: Fatal Error Recovery – Optionally reports the errors this plugin causes to its developer, so they get fixed without you writing in. Off by default and anonymous.
- Added: Fatal Error Recovery – Keeps a dated history of the distinct fatal errors caught over the last 90 days, and lets you clear it in one click.
- Added: Fatal Error Recovery – Reports a plugin crash in one click, with a ready-made report stripped of paths, emails, IPs and credentials that you review before sending.
- Improved: Fatal Error Recovery – Error dates now say how long ago the error happened, so you can tell at a glance whether an incident is current.
- Improved: Fatal Error Recovery – The last detected error now reads as a single readable line instead of a wall of stack trace.
- Fixed: Hide Login Page – Prevents a fatal error on requests whose URL carries no path, such as those forwarded by some proxies and CDNs.
- Fixed: Cache & Performance – Prevents a fatal error when a CDN or font URL carries no path.
- Fixed: Fatal Error Recovery – Keeps recovery access working when the key file exists but cannot be read.
2.5.9
- Fixed: Core – Save stays enabled after you only delete items in a settings screen, such as removing an appointment time slot or closing a booking day.
2.5.8
- Fixed: Redirections 301 – Prevents a rare fatal error on front-end requests carrying a malformed URL.
2.5.7
- Fixed: Calendar – The WP-CLI resource list command reports each resource’s real stock instead of always 0.
- Fixed: Calendar – The booking recap date follows the site language instead of the visitor’s browser language.
2.5.6
- Added: Backup – Create and restore backups from WP-CLI (wp blaminhor backup create / restore) for scripted, scheduled or CI backups.
- Added: Calendar – Reschedule an appointment, correct its contact details, set its video link or create a rental reservation, all from WP-CLI.
- Added: User Role Editor – WP-CLI commands export and import roles as JSON and grant a capability to a role or user, honoring the multisite super-admin guard.
- Added: Cache & Performance – A WP-CLI preload command rebuilds the sitemap queue and warms the cache on demand.
- Added: SEO/GEO – A WP-CLI import command copies SEO meta from Yoast, Rank Math or All in One SEO, with a dry-run that counts posts first.
- Added: Redirections 301 – WP-CLI commands list the logged 404s and turn any 404 entry into a 301 redirection.
- Added: Anti-Spam – WP-CLI commands show block stats, list or clear the journal and unblock an IP.
- Added: Calendar – Manage appointments from the Month view: click a day to book, or an appointment to view, edit, reschedule or cancel it.
- Added: Calendar – Edit a booked appointment’s name, email, phone and notes in place, without cancelling and recreating it.
- Added: Calendar – Reservation emails for bookable resources are now editable (confirmation, reminder, waitlist, cancellation, approval), each with its own on/off switch.
- Added: Calendar – Give each service its own note (what to bring, how to prepare) shown in its emails via the {service_note} tag.
- Added: Calendar – A “Next appointment” button jumps the Month, Week or Day view to the period holding your next upcoming booking.
- Added: Calendar – Create a rental reservation by hand (taken by phone or in person), confirmed right away with availability re-checked so it never overbooks.
- Added: SEO/GEO – A dismissible notice warns when another SEO plugin (Yoast, Rank Math, AIOSEO, SEOPress, The SEO Framework) is active, to avoid duplicate meta and sitemaps.
- Added: SMTP Mailer – Email logging separates the delivery log (recipient, subject, status) from a new “Store email content” option, off by default, kept for review and resend.
- Added: SMTP Mailer – Sites that already logged emails get a notice that message content is no longer stored unless they opt in, so a working resend is never lost silently.
- Fixed: Cache & Performance – The preloader refuses private or reserved addresses, so a crafted preload or sitemap URL can no longer probe internal services.
- Fixed: Forms – CSV exports of form entries neutralize spreadsheet formula injection, so a value typed into a public form can’t run as a formula on open.
- Fixed: Cookie Banner – The consent log CSV export is protected against spreadsheet formula injection.
- Fixed: Calendar – RSVP and booking CSV exports are protected against spreadsheet formula injection.
- Fixed: User Role Editor – On multisite, a non super-admin site administrator can no longer grant network-level capabilities through the role or user editor.
- Fixed: Fatal Error Recovery – The recovery screen reads the recovery key and HTTPS Redirect status correctly, so the “Disable HTTPS Redirect” button works in a redirect loop.
- Fixed: Fatal Error Recovery – The on-disk recovery key file now stores only a hash, so the secret can’t be read by downloading the file.
- Fixed: HTTPS Redirect – Requests behind a TLS-terminating reverse proxy are recognized as secure, avoiding a redirect loop that could lock the site.
- Fixed: Maintenance – While a maintenance or coming-soon mode is active, the REST API returns 503 instead of serving full site content over /wp-json.
- Fixed: Calendar – The venue map popup shows the venue title as plain text, so a title containing markup can’t run on the public event page.
- Fixed: Core – Uninstalling with “delete all data” removes three leftover options and the recovery key file, so nothing is left behind.
- Fixed: Core – Dialogs no longer close when a text selection started inside a field is released outside the window.
- Fixed: Calendar – The nature filter (Appointments, Events, Rentals) stays applied when navigating between periods instead of resetting to All.
- Translations: Core – Updated translations for the 8 active languages (French, German, Spanish, Italian, Portuguese, Japanese, Russian, Turkish).
2.5.5
- Improved: Calendar – Each service is a clearly separated card with per-field labels; its options collapse under one row with real on/off toggles and an active-options count.
- Improved: Calendar – The online-meeting option shows only for services that can take place online, and its off choice reads “No video link” instead of contradicting the location.
- Improved: Calendar – Appointment, event and bookable settings follow a natural setup flow, with plainer wording throughout.
- Improved: Calendar – Availability settings are visible at a glance instead of hidden behind collapsible panels.
- Improved: Calendar – Start times offer a simple back-to-back or denser-grid choice with a live example, and spacing accounts for the break between appointments.
2.5.4
- Added: Calendar – Show a map of the venue on the event page (OpenStreetMap, no API key), with a drop-a-pin picker and address geocoding when editing a venue.
- Added: Calendar – Clients can book a recurring series of appointments (same weekly or fortnightly slot) in one go, and cancel the whole series themselves.
- Added: Calendar – Events can sell several ticket tiers (each with its own price and quota) and accept promo codes (percentage or fixed amount) on paid sign-ups.
- Added: Calendar – Manage the calendar from WP-CLI: sign-ups, appointments, resources and promo codes, plus reminders, occurrence rebuild, venue geocoding and iCal/TEC import.
- Added: Forms – Manage forms and stored entries from WP-CLI: list, export to CSV, mark, delete, GDPR purge, per-form stats and re-send a notification.
- Improved: Calendar – The “Back” link in the booking widget follows the configured hover colour like the other slots and buttons.
2.5.3
- Added: Calendar – Events can close sign-ups a set number of hours before they start, so you have a head count in time.
- Added: Calendar – Events can require your approval: sign-ups come in as requests that hold their seat until you approve or decline them.
- Added: Calendar – Bookables can offer a waitlist when out of stock for the chosen dates, and alert people the moment those dates free up.
- Added: Calendar – Custom date and time formats for the calendar, slots and emails (or follow your site’s own formats).
- Improved: Calendar – Settings are reorganised so each scheduling type (appointments, events, bookables) has its own self-contained tab navigated by a section menu; shared options stay in a Settings tab.
- Improved: Calendar – Each email now lives in the tab of the type it belongs to; the separate Emails tab is gone.
2.5.2
- Fixed: Calendar – Adds breathing room below the “Next availability” button so it no longer touches the day-of-week row on empty weeks.
- Fixed: Calendar – Evens out the spacing around the consent checkbox on the booking form so it matches the rest of the form.
- Improved: Calendar – Clarifies the booking and sign-up consent wording so it plainly states that details are stored to process the request.
- Improved: Calendar – The client self-service space (passwordless reschedule and cancel, no account) is now on by default on new sites.
- Improved: Calendar – Streamlines the settings tabs so the sections that need a decision stay open and secondary ones start collapsed.
2.5.1
- Added: Forms – Strict CAPTCHA mode rejects submissions when the verification provider can’t be reached.
- Added: HTTPS Redirect – Optional HSTS toggles for includeSubDomains and preload, off by default with a clear warning.
- Fixed: Fatal Error Recovery – The recovery key is stored outside the public web root so it can’t be read on some server setups.
- Fixed: Fatal Error Recovery – The toolbar shortcut no longer exposes the recovery key on the front end.
- Fixed: HTTPS Redirect – Redirects always target your site’s canonical address.
- Fixed: Maintenance – The visitor IP allowlist can no longer be bypassed with a spoofed header.
- Fixed: Calendar – Public booking, RSVP and resource forms are rate-limited per visitor to prevent automated flooding.
- Fixed: Calendar – A duplicated payment return can no longer create a booking twice or trigger a false refund.
- Fixed: Calendar – Booking emails and the booking widget labels now display in your site language instead of falling back to English.
- Fixed: Calendar – Email and widget text left at its default no longer stays frozen in one language; it follows your site language and updates when you switch it.
- Fixed: Calendar – Self-cancellation links in confirmation emails now expire after 45 days.
- Fixed: Broken Links – The scanner can’t be tricked into probing internal addresses and verifies SSL like the rest of WordPress.
- Fixed: SEO/GEO – Inline meta edits keep full JSON-LD and multi-line schema descriptions intact.
- Fixed: SEO/GEO – Prevented a possible fatal error when a custom post type has been removed.
- Fixed: Database Optimizer – The autoload opt-out list is preserved when saving settings.
- Fixed: Mute Core Emails – Removed a PHP warning when recovery-mode emails are muted.
- Fixed: Post Types Order – Reordering now refreshes the cached content order on object-cache sites.
- Fixed: SMTP Mailer – Password-reset links are masked in email logs and a warning flags plain-text body storage.
- Fixed: SMTP Mailer – A failing fallback relay no longer recurses into a timeout.
- Fixed: User Role Editor – Capability changes enforce a per-user permission check.
- Fixed: Content Duplicator – Bulk duplication checks edit permission on each item.
- Fixed: Backup – Large backup uploads no longer risk exhausting server memory.
- Fixed: Hide Login Page – External (SSO) login redirects are preserved, and a warning flags a login slug that clashes with an existing page.
- Improved: Redirections – The list loads far faster on large redirection sets, and regex patterns that could hang the site are blocked and auto-disabled.
- Improved: Forms – A failed webhook delivery is retried once after five minutes so a transient outage no longer loses a lead.
- Improved: Forms – Allowed upload file types are now configurable, with archives and plain text excluded by default.
- Improved: SMTP Mailer – The connection test now works with relays that don’t require authentication.
- Improved: Cookie Banner – Consent records validate the IAB TC string format before storage.
- Improved: Calendar – In specific-dates availability, you can paste copied hours straight onto another date in the list, not only via the calendar.
- Improved: Calendar – The client self-service space turns on with a single switch and a built-in address — no page to create or shortcode to place, with your own page still an option.
2.5.0
- New module: Calendar (Beta) – A complete scheduling suite for events, appointments and rentals, all in one screen:
- Events with recurrence, venues, organizers, RSVP, calendar views and iCal feed subscriptions.
- Online appointment booking from your weekly availability: reminders, waitlists, approvals and optional Stripe payments.
- Resource rentals (rooms, equipment, tables…) by date range, with stock control and optional Stripe payments.
- Client self-service pages, fully customizable emails, and public and private calendar subscriptions.
- Added: Backup – SFTP backups can authenticate with an SSH key instead of a password: paste your own private key, or generate a key pair and copy the public key to your server.
- Fixed: Cache & Performance – The dashboard no longer falsely warns that the page cache is broken when a loopback request is blocked or another cache plugin is active.
- Fixed: Database Optimizer – Creating a backup now shows a progress spinner and confirms completion with the file name and size, instead of leaving the button stuck.
- Fixed: Core – On the dashboard, the module detail popover no longer covers the module directly below it, so every module in the list stays reachable.
- Fixed: Core – Picking a colour or typing in a settings field now reveals Save immediately, instead of only after you click away from the field.
- Improved: Core – Dashboard alerts now explain what is wrong and what to do the moment you hover them, and each link opens the exact settings page that fixes it.
- Improved: Core – Inline link-style actions (remove, add, in-page links) now use the brand colour, with delete actions in red, instead of the default WordPress blue.
- Improved: Core – Secondary text, status badges and inline link actions now meet WCAG 2.1 AA colour contrast for better readability.
- Improved: Core – A floating Save bar with an unsaved-changes count appears the moment you edit a setting and follows you as you scroll, so you can save without scrolling back up.
Older versions (2.4.0 and earlier) are archived in changelog.txt shipped with the plugin.