{"id":341613,"date":"2026-07-24T12:44:17","date_gmt":"2026-07-24T12:44:17","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/whohasaccess\/"},"modified":"2026-07-24T12:43:41","modified_gmt":"2026-07-24T12:43:41","slug":"destino-access-audit","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/destino-access-audit\/","author":18781170,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.4.0","stable_tag":"1.4.0","tested":"7.0.2","requires":"5.6","requires_php":"7.4","requires_plugins":null,"header_name":"Destino Access Audit","header_author":"Destino Exterior","header_description":"Security audit dashboard: lists the site's active Application Passwords (with AJAX revoke and CSV export) and shows the connection status of the installed remote management tools (UpdraftPlus\/UpdraftCentral, MainWP Child, ManageWP Worker, InfiniteWP Client).","assets_banners_color":"","last_updated":"2026-07-24 12:43:41","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/destinoexterior.com","header_author_uri":"","rating":0,"author_block_rating":0,"active_installs":20,"downloads":67,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.4.0":{"tag":"1.4.0","author":"destinoexterior","date":"2026-07-24 12:43:41"}},"upgrade_notice":{"1.4.0":"<p>Renamed from &quot;WhoHasAccess&quot; to &quot;Destino Access Audit&quot; (slug and text domain changed). No public version was ever released under the old name. Bundled translation files were removed; WordPress.org now manages translations for this plugin.<\/p>"},"ratings":[],"assets_icons":{"icon.svg":{"filename":"icon.svg","revision":3621331,"resolution":false,"location":"assets","locale":false}},"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.4.0"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"Application Passwords table, with Revoke and CSV export.","2":"Administrator Users list.","3":"UpdraftPlus \/ UpdraftCentral connection status.","4":"MainWP Child connection status."}},"plugin_section":[],"plugin_tags":[8097,8533,41925,600,151816],"plugin_category":[54],"plugin_contributors":[273160],"plugin_business_model":[],"class_list":["post-341613","plugin","type-plugin","status-publish","hentry","plugin_tags-application-passwords","plugin_tags-audit","plugin_tags-mainwp","plugin_tags-security","plugin_tags-updraftplus","plugin_category-security-and-spam-protection","plugin_contributors-destinoexterior","plugin_committers-destinoexterior"],"banners":[],"icons":{"svg":"https:\/\/ps.w.org\/destino-access-audit\/assets\/icon.svg?rev=3621331","icon":"https:\/\/ps.w.org\/destino-access-audit\/assets\/icon.svg?rev=3621331","icon_2x":false,"generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>Destino Access Audit adds a single admin page (<strong>Tools \u2192 Destino Access Audit<\/strong>) that centralizes the answer to one question: <em>who, and what, currently has access to this site?<\/em><\/p>\n\n<p>The page is read-only audit information except for one deliberate action \u2014 revoking an Application Password \u2014 which delegates entirely to WordPress core's own API. Destino Access Audit never creates, modifies, or stores any remote-management connection itself.<\/p>\n\n<p><strong>What it shows<\/strong><\/p>\n\n<ul>\n<li><strong>Application Passwords<\/strong> \u2014 every active Application Password on the site (all users), with creation date, last used date, last IP, and a one-click <strong>Revoke<\/strong> button (AJAX, no page reload) plus a <strong>CSV export<\/strong>.<\/li>\n<li><strong>Administrator Users<\/strong> \u2014 a plain list of every user with the <code>administrator<\/code> role, with a direct link to edit each one. Useful for spotting an admin account you don't recognize.<\/li>\n<li><strong>UpdraftPlus \/ UpdraftCentral<\/strong> \u2014 whether UpdraftPlus is installed\/active, a direct link to its settings screen, whether it is connected to an UpdraftCentral dashboard (including <em>which<\/em> WordPress user made that connection), and whether UpdraftPlus's own password-protected \"Lock Settings\" feature is currently hiding that screen.<\/li>\n<li><strong>MainWP Child<\/strong> \u2014 whether MainWP Child is installed\/active, a direct link to its settings screen, whether it is paired with a MainWP Dashboard, and <em>which<\/em> WordPress user established that pairing.<\/li>\n<li><strong>ManageWP Worker<\/strong> \u2014 installed\/active status. ManageWP Worker pairs with its dashboard through an OpenSSL key exchange with no locally readable \"connected\" flag, so this block documents that limitation instead of guessing.<\/li>\n<li><strong>InfiniteWP Client<\/strong> \u2014 installed\/active status, with the same honest limitation note as ManageWP Worker.<\/li>\n<\/ul>\n\n<p><strong>Security notes<\/strong><\/p>\n\n<ul>\n<li>Every write action (revoking a key) is protected by a nonce, a <code>manage_options<\/code> capability check, and a second capability check (<code>edit_user<\/code>) specific to the user who owns the key.<\/li>\n<li>The CSV export is generated server-side and neutralizes fields that could be interpreted as spreadsheet formulas (CSV\/Excel formula injection).<\/li>\n<li>The dashboard itself requires the <code>manage_options<\/code> capability to view.<\/li>\n<\/ul>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>destino-access-audit<\/code> folder to <code>\/wp-content\/plugins\/<\/code>, or install the plugin zip through <strong>Plugins \u2192 Add New \u2192 Upload Plugin<\/strong>.<\/li>\n<li>Activate the plugin through the <strong>Plugins<\/strong> menu in WordPress.<\/li>\n<li>Go to <strong>Tools \u2192 Destino Access Audit<\/strong>, or use the <strong>Settings<\/strong> link on the plugin's row on the Plugins page.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20this%20plugin%20modify%20or%20create%20any%20remote%20connections%3F\"><h3>Does this plugin modify or create any remote connections?<\/h3><\/dt>\n<dd><p>No. It is read-only with respect to UpdraftCentral, MainWP, ManageWP, and InfiniteWP. The only write action anywhere in the plugin is revoking an Application Password, which calls WordPress core's own <code>WP_Application_Passwords::delete_application_password()<\/code>.<\/p><\/dd>\n<dt id=\"why%20don%27t%20managewp%20worker%20and%20infinitewp%20client%20show%20a%20%22connected%22%20status%3F\"><h3>Why don't ManageWP Worker and InfiniteWP Client show a \"Connected\" status?<\/h3><\/dt>\n<dd><p>Both plugins pair with their remote dashboard using an OpenSSL key exchange rather than a locally readable option or user meta. There is no reliable local signal to read, so instead of guessing (and risking a false positive or negative in a security tool) Destino Access Audit shows an honest \"Not determinable\" badge and points you to the plugin's own connection-management screen.<\/p><\/dd>\n<dt id=\"does%20the%20plugin%20store%20any%20data%20of%20its%20own%3F\"><h3>Does the plugin store any data of its own?<\/h3><\/dt>\n<dd><p>No. It has no settings, no database tables, and no options. It only reads data already stored by WordPress core and by the other plugins it reports on.<\/p><\/dd>\n<dt id=\"does%20deactivating%20or%20deleting%20destino%20access%20audit%20affect%20application%20passwords%20or%20any%20remote%20connection%3F\"><h3>Does deactivating or deleting Destino Access Audit affect Application Passwords or any remote connection?<\/h3><\/dt>\n<dd><p>No. Destino Access Audit never owns that data; it only displays it.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.4.0<\/h4>\n\n<ul>\n<li>Renamed the plugin from \"WhoHasAccess\" to \"Destino Access Audit\" at the request of the WordPress.org Plugin Review Team, who flagged \"WhoHasAccess\" as a likely existing project\/trademark name. No public version was ever released under the old name.<\/li>\n<li>Moved the admin page from its own top-level menu item into Tools \u2192 Destino Access Audit, so it stops competing for space in the main admin menu.<\/li>\n<li>Added a \"Settings\" link to the plugin's row on the Plugins page, next to Deactivate.<\/li>\n<li>MainWP Child: added a direct link to its settings screen.<\/li>\n<li>UpdraftPlus: added a direct link to its settings screen, plus a badge reporting whether UpdraftPlus's own \"Lock Settings\" feature (Advanced Tools tab) is currently hiding that screen behind a password, with instructions on how to review or remove that lock. Destino Access Audit only reports this status \u2014 it never reads, writes, or removes the lock itself.<\/li>\n<li>Fixed all findings from the official Plugin Check tool: escaping false-positives, the discouraged <code>load_plugin_textdomain()<\/code> warning, and a short description over the 150-character limit.<\/li>\n<li>Removed the bundled <code>languages\/<\/code> folder and the <code>load_plugin_textdomain()<\/code> call: WordPress.org plugins must not ship their own <code>.po<\/code>\/<code>.mo<\/code> files, since translate.wordpress.org generates and serves them automatically once the text domain matches the plugin slug.<\/li>\n<li>Replaced the escaping-related <code>phpcs:ignore<\/code> comments with an actual fix (wrapping the affected output in <code>wp_kses_post()<\/code>), following a second Plugin Review pass.<\/li>\n<\/ul>\n\n<h4>1.3.0<\/h4>\n\n<ul>\n<li>MainWP Child: now shows which WordPress user established the connection to the MainWP Dashboard (read from the <code>mainwp_child_connected_admin<\/code> option), with a link to that user's profile \u2014 mirroring what the UpdraftCentral block already did.<\/li>\n<li>New \"Administrator Users\" section: a separate list of every user with the <code>administrator<\/code> role on the site, with a direct edit link for each.<\/li>\n<li>Moved the bundled translations into the <code>languages\/<\/code> folder, matching the <code>Domain Path<\/code> header (they were previously left in the plugin root, where local\/non-WordPress.org installs could not load them).<\/li>\n<li>Added this readme.txt.<\/li>\n<\/ul>\n\n<h4>1.2.0<\/h4>\n\n<ul>\n<li>Renamed the plugin from \"Who Control\" to \"WhoHasAccess\" (class, text domain, menu slug, asset handles, nonce\/AJAX action names, and CSS classes all updated to match).<\/li>\n<li>Translated all code and user-facing strings to English, in preparation for the WordPress.org plugin directory.<\/li>\n<li>Added a <code>languages\/<\/code> folder with a <code>whohasaccess.pot<\/code> template and a Spanish (es_ES) translation.<\/li>\n<\/ul>\n\n<h4>1.1.0<\/h4>\n\n<ul>\n<li>AJAX revoke for Application Passwords, without leaving the page.<\/li>\n<li>New read-only blocks for ManageWP Worker and InfiniteWP Client.<\/li>\n<li>CSV export (UTF-8 with BOM) of the Application Passwords table.<\/li>\n<li>Hardening: nonces on every write\/delete action, sanitization of <code>$_POST<\/code>\/<code>$_GET<\/code>, an extra per-user capability check before revoking.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial version: Application Passwords (read-only), UpdraftPlus\/UpdraftCentral, MainWP Child.<\/li>\n<\/ul>","raw_excerpt":"Audit who has access to your site: Application Passwords, admin accounts, and connected remote management tools in one dashboard.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/341613","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=341613"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/destinoexterior"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=341613"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=341613"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=341613"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=341613"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=341613"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=341613"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}