Title: Togra Admin Enhancer
Author: Togra Studio
Published: September 13, 2026
Last modified: September 13, 2026
---
Search plugins
# Togra Admin Enhancer
By [Togra Studio](https://profiles.wordpress.org/tograstudio/)
[Download](https://downloads.wordpress.org/plugin/togra-admin-enhancer.1.0.0.zip)
* [Details](https://wordpress.org/plugins/togra-admin-enhancer/#description)
* [Reviews](https://wordpress.org/plugins/togra-admin-enhancer/#reviews)
* [Installation](https://wordpress.org/plugins/togra-admin-enhancer/#installation)
* [Development](https://wordpress.org/plugins/togra-admin-enhancer/#developers)
[Support](https://wordpress.org/support/plugin/togra-admin-enhancer/)
## Description
Togra Admin Enhancer collects the small changes most sites end up making — disabling
comments, hiding the login URL, trimming the dashboard, dropping a tracking tag
into the page head — into a single settings screen.
Each switch shows what your site does right now and what will change if you turn
it on, so you can see the consequence before saving. Every feature ships switched
off; enable only what you need.
#### Content & Editing
* Disable comments across every post type
* Replace the block editor with the classic editor
* Allow SVG uploads, sanitised on upload
* Allow AVIF uploads
* Duplicate posts, pages and custom post types
* Order content by menu order instead of date
* Point a post’s links at an external URL
#### Login & Branding
* Serve the login page from a slug of your choosing, with wp-login.php and wp-admin
answering as 404
* Choose where blocked visitors land
* Restrict sign-in to username only, email only, or both
* Show your site identity and a custom logo on the login page
* Restyle the login form as a modern card, in three styles and your own colours
* Add a login/logout link to your nav menus
* Last Login and Registration Date columns on the Users screen
* Disable a user account instead of deleting it
* Redirect after login and after logout
#### Temporary Logins
Hand a developer, a support agent or a client their own way in, without creating
a password or sharing yours.
* Create an account with a role and an expiry between one hour and one month
* Share the link it produces; opening it signs the holder in
* The account stops working on its own when the time is up
* Change the role or reset the expiry later, or revoke it on the spot
* See how many times each link has been used, and when
* Temporary accounts can reach the site while maintenance mode or the site password
is on, so you can hand out a link to a site that is not public yet
Temporary accounts cannot sign in with a password, cannot reset one, and cannot
add users, delete users, or open the plugin and theme editors — so one cannot quietly
outlive its expiry date.
#### Cleanup & Security
* Remove emoji scripts and Dashicons from the front-end
* Disable XML-RPC and RSS feeds
* Limit each author to their own media uploads
* Trim the admin bar, or hide it entirely on the front-end
* Hide admin notices, empty the dashboard widgets
* Widen the admin menu, sort it alphabetically, stop submenus flying out on hover
* Custom taxonomy filters and polished list tables
* Replace a media file while keeping its ID and URL
* Open external links, or chosen menu items, in a new tab
* Maintenance mode with a countdown to the moment you plan to be back
#### Advanced
* Password-protect the whole site
* Redirect 404s to the home page
* Limit failed login attempts
* Disable the REST API for anonymous requests, oEmbed, and author archives
* Turn off the admin heartbeat and post revisions
* Switch off emojis, Dashicons, embeds, XML-RPC and feed links together, in one
go
* Restrict uploads to images
* Stop the site sending any email, for staging copies
* Give a user more than one role
* Preview the dashboard as another role
* System summary and image sizes panels
#### Header and Footer Code
* Insert code into the document head, after the opening body tag, or before the
closing body tag
#### Import / Export
* Save every setting to a JSON file, and restore it on this site or another one
* Keep a log of sensitive actions, with a timestamp on each; the last 100 are kept
and shown on the same screen
The exported file deliberately leaves out the site password, so it is safe to store
beside your other configuration files.
#### Users & Updates
* Export users to CSV, filtered by role
* Publish posts that missed their scheduled time
## Screenshots
[[
[[
[[
[[
[[
[[
[[
[[
[[
[[
[[
[[
[[
[[
[[
## Installation
1. Upload the plugin folder to `/wp-content/plugins/`, or install it through Plugins
> Add New.
2. Activate the plugin through the Plugins screen.
3. Open **Togra Enhancer** in the admin menu and switch on the features you want.
4. Press Save Settings.
Two features add their own screen once switched on: Temporary Logins appears under
Togra Enhancer, and Export Users appears under Tools.
If you change the login URL slug, note the new address before saving. Once it is
on, wp-admin no longer offers a login page.
## FAQ
### Does the plugin run on the front-end?
Yes, when a front-end feature is switched on. Maintenance mode, header/footer code,
the custom login URL and the external-link handling all run on the public site.
Everything else is admin-only, and every feature is off until you enable it.
### Who can add header and footer code?
Only users who hold `unfiltered_html`, the capability WordPress itself requires
before someone may save raw markup. On a single site that means administrators;
on multisite, only network administrators. The settings screen additionally requires`
manage_options`.
Whatever you put there is printed on the public site exactly as you typed it, which
is the point of the field, so treat it as you would any code you add to your theme.
### How safe is a temporary login link?
The link carries a 64-character token generated from PHP’s cryptographic random
source, so guessing one is not realistic. It is still a live credential: anyone
holding the link is signed in as that account, so send it the way you would send
a password.
The token is consumed on arrival and the browser is redirected immediately, which
keeps it out of the address bar, the browser history and the Referer header of the
next request. An invalid token is ignored silently — the page loads as if nothing
was passed — so the URL cannot be used to probe for valid ones.
### What can a temporary account do?
Whatever its role allows, minus the things that would let it outlive its expiry
date. It cannot sign in with a password, reset a password, create a user, delete
a user, or open the plugin and theme editors. Choose the lowest role that still
lets the person do the job; Editor is usually enough.
### What happens when a temporary login expires?
The account stops working immediately. If someone is signed in with it at the time,
they are logged out on their next page load. The account stays in your users list
so you can see it and extend it if you want; revoking deletes it outright.
### Does the plugin interfere with WordPress updates?
No. It does not bundle an update checker, does not contact any server of its own,
and does not touch how WordPress decides what to update or when. Updates behave
exactly as they would with the plugin deactivated.
### What is written to the activity log?
The actions worth being able to account for later: settings imported, the audit
log cleared, a temporary login created, changed or revoked. Each entry records what
happened, who did it and when. The last 100 are kept and older ones drop off, so
the log cannot grow without limit. It lives in a single option and is removed when
you uninstall the plugin.
### Is the settings export safe to share?
Yes. It carries your switches and text fields, but not the site password: that is
stored as a hash and is left out of the file, so an export cannot hand anyone the
way past your password protection. Importing a file never changes the site password
either — it is only ever set by typing it in.
### Does it change my database?
Settings live in a single option. Some features also store post meta or user meta:
an external permalink, a menu item’s new-tab flag, a disabled-account flag, a replaced
media file, and the last login timestamp. Temporary logins create real user accounts,
marked with their own meta. Uninstalling the plugin removes all of it, including
any temporary accounts still present.
### What happens if I forget my custom login URL?
Rename or delete the plugin folder over FTP or your host’s file manager. WordPress
deactivates the plugin and wp-login.php works again.
### Can I use it on multisite?
The plugin activates per site and each site keeps its own settings. It has not been
tested as a network-wide activation.
### How are SVG uploads made safe?
Every SVG is cleaned before it is stored, and again after WordPress attaches it.
The cleaning runs `enshrined/svg-sanitize` 1.0.0, which is bundled with this plugin
under the GPL, followed by a second pass of the plugin’s own checks.
That second pass is deliberate. Several plugins bundle the same library under the
same class name, so on a site running more than one of them the copy that answers
first is not necessarily this one, and its version and settings may differ. The
plugin’s own checks therefore run over the result either way: scripts, event handlers
and `javascript:` URLs are removed, references have to stay inside the document
rather than fetch something remote, and `url()` values are checked in attributes
and inside `