The integrity section becomes a read-only report; file restore, backups and extra file deletion have been removed.<\/p>","4.2":"
Renaming and compliance changes requested by the plugin review team.<\/p>","4.1":"
Documentation and clearer warnings. No change in behaviour.<\/p>","3.9":"
Compliance fixes for the plugin directory review. No change in behaviour.<\/p>","3.6":"
Recommended security update: fixes a stored XSS in the diff viewer and hardens several destructive operations.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3654130,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3654130,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3654130,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3654130,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["5.2"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"Core integrity: analysis result plus modified and extra files.","2":"Profiling: last measurement and history charts.","3":"WPO: plugins, autoloaded options, WP-Cron, cache and versions.","4":"AI bot blocking: per-bot selection."}},"plugin_section":[],"plugin_tags":[264107,173015,247,23044,600],"plugin_category":[54],"plugin_contributors":[276440],"plugin_business_model":[],"class_list":["post-347917","plugin","type-plugin","status-publish","hentry","plugin_tags-ai-bots","plugin_tags-integrity","plugin_tags-performance","plugin_tags-profiling","plugin_tags-security","plugin_category-security-and-spam-protection","plugin_contributors-ricardomorales","plugin_committers-ricardomorales"],"banners":{"banner":"https:\/\/ps.w.org\/sysadmin-total-suite\/assets\/banner-772x250.png?rev=3654130","banner_2x":"https:\/\/ps.w.org\/sysadmin-total-suite\/assets\/banner-1544x500.png?rev=3654130","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/sysadmin-total-suite\/assets\/icon-128x128.png?rev=3654130","icon_2x":"https:\/\/ps.w.org\/sysadmin-total-suite\/assets\/icon-256x256.png?rev=3654130","generated":false},"screenshots":[],"raw_content":"\n
This plugin brings together several maintenance tools for WordPress in one admin panel:<\/p>\n\n
Every action requires administrator capabilities and is protected with nonces. The plugin does not write to or delete anything inside the WordPress core directories. The operations that do change something (deleting a user, clearing expired transients, removing orphaned cron tasks, blocking a bot) act on the database and always ask for confirmation first.<\/p>\n\n
This plugin connects to WordPress.org services in order to verify and restore the core:<\/p>\n\n
https:\/\/api.wordpress.org\/core\/checksums\/1.0\/<\/code>): queried when you run the integrity analysis, to obtain the official checksums for your version and locale. The WordPress version and the site locale are sent.<\/li>\n- WordPress.org downloads (
https:\/\/downloads.wordpress.org\/<\/code> and the localized sites https:\/\/*.wordpress.org\/<\/code>): the official ZIP package for your version is downloaded only when you ask to see the differences (diff) or to restore a core file. The version and locale are sent to build the package URL.<\/li>\n<\/ol>\n\nNo personal data is sent and no other third-party service is contacted. These services are provided by the WordPress Foundation; see https:\/\/wordpress.org\/about\/privacy\/ for details.<\/p>\n\n
The official package is used only<\/strong> as the reference copy of the core, exactly as WordPress itself does when it reinstalls or updates the core. No code is fetched from any third-party server, nothing is executed from the download, and the extracted content is only ever written back to the same core path it came from.<\/p>\n\n\n\n- Upload the plugin folder to
\/wp-content\/plugins\/<\/code> or install it from your WordPress dashboard.<\/li>\n- Activate the plugin through the Plugins menu.<\/li>\n
- Open the plugin menu and its sections: Integrity, Profiling, Check users, WPO and AI bot blocking.<\/li>\n<\/ol>\n\n
Optional: to measure the SQL query time in the Profiling section, add define('SAVEQUERIES', true);<\/code> to wp-config.php<\/code>. Leaving it permanently enabled in production is not recommended because of its overhead.<\/p>\n\n\n\nDoes the plugin modify any file?<\/h3><\/dt>\nNo. It does not write to or delete any file inside wp-admin<\/code>, wp-includes<\/code> or the site root. The integrity section is a read-only report: it tells you which core files differ from the official ones and can show you the diff, but repairing them is left to WordPress itself through Dashboard > Updates > Reinstall now.<\/p>\n\nThe only thing the plugin writes is the cached copy of the official package, stored in its own folder inside the uploads directory (resolved at runtime with wp_upload_dir()<\/code>), protected against direct access and removed when you purge the cache or uninstall the plugin.<\/p><\/dd>\nDoes the plugin allow arbitrary code to be inserted or executed?<\/h3><\/dt>\nNo. It contains no PHP or JavaScript editor, no file manager, no upload form and no field where code can be entered. It never calls eval()<\/code>, base64_decode()<\/code>, exec()<\/code> or any dynamic include, and it does not generate or execute code.<\/p><\/dd>\nWhy does the plugin download a ZIP from WordPress.org?<\/h3><\/dt>\nTo show a real diff, the original file is needed. The plugin downloads the official package for your exact version and locale from WordPress.org \u2014 the same source WordPress itself uses \u2014 and reads the single file being compared straight out of it. Nothing from the download is executed and nothing is written outside the uploads cache.<\/p><\/dd>\n
Does it require any PHP extension?<\/h3><\/dt>\nYes, the ZipArchive extension is needed to show differences and to restore core files from the official package.<\/p><\/dd>\n
Why does MySQL show as N\/A in the Profiling section?<\/h3><\/dt>\nThe query time is only available when the SAVEQUERIES<\/code> constant is enabled. The number of queries and the remaining timings are shown regardless.<\/p><\/dd>\nA core file is reported as modified but I have not touched anything<\/h3><\/dt>\nSome sites run the international WordPress package while their locale is set to another language. In that case a few files (for example wp-includes\/version.php<\/code>, which carries $wp_local_package<\/code> in translated packages) differ from the localized checksums without anything being wrong. The plugin compares against the international package as well before reporting a file, so this no longer produces a false positive.<\/p><\/dd>\nThe page cache shows as not enabled, but I use LiteSpeed<\/h3><\/dt>\nLiteSpeed caches at server level and does not use WP_CACHE<\/code> or advanced-cache.php<\/code>. The plugin detects that case and shows its real status; you can confirm it with the x-litespeed-cache: hit<\/code> response header.<\/p><\/dd>\nIs User-Agent blocking foolproof?<\/h3><\/dt>\nNo. The User-Agent can be spoofed, which is why the 403 blocking complements, but does not replace, the robots.txt opt-out.<\/p><\/dd>\n\n<\/dl>\n\n\n
5.2<\/h4>\n\n\n- Fixed a false positive: a site running the international WordPress package while using a translated locale reported core files such as wp-includes\/version.php as modified. Files are now also compared against the international package before being flagged.<\/li>\n<\/ul>\n\n
5.1<\/h4>\n\n\n- Prefixed the variables used by the admin views so that static analysis no longer reports them as unprefixed globals.<\/li>\n<\/ul>\n\n
5.0<\/h4>\n\n\n- The integrity section is now a read-only report. Following the plugin review team's feedback, the plugin no longer writes to or deletes anything inside the WordPress core directories: restoring files, restoring from a backup, the backup manager and the removal of extra files have all been removed.<\/li>\n
- When core issues are found, the plugin now links to Dashboard > Updates > Reinstall now, which is WordPress's own repair mechanism.<\/li>\n<\/ul>\n\n
4.2<\/h4>\n\n\n- Renamed the plugin and prefixed every function, global, constant, option, transient, AJAX action and nonce with a unique plugin prefix.<\/li>\n
- All inline scripts moved to enqueued files, with data passed through wp_localize_script().<\/li>\n
- Updated the bundled Chart.js library to the latest stable release.<\/li>\n
- Removed the load_plugin_textdomain() call and the bundled translation files: translations are handled by translate.wordpress.org.<\/li>\n
- The top level admin menu no longer uses a prominent position.<\/li>\n<\/ul>\n\n
4.1<\/h4>\n\n\n- Documented in detail how the official package is used and which files can be written or deleted, and added a clearer warning when restoring from a backup: a backup reproduces the file as it was, so it does not guarantee clean content the way the official package does.<\/li>\n<\/ul>\n\n
4.0<\/h4>\n\n\n- Remaining Plugin Check fixes and renamed the plugin so that its name and slug no longer contain restricted terms.<\/li>\n<\/ul>\n\n
3.9<\/h4>\n\n\n- Compliance with the Plugin Check tool: translator comments for every string with placeholders, output escaping, WordPress filesystem API instead of direct calls, prepared LIKE wildcards,
wp_safe_redirect()<\/code> and sanitized server variables.<\/li>\n- Removed a pointless database query that was only used to time itself.<\/li>\n
- The readme is now written in English, as required by the plugin directory.<\/li>\n<\/ul>\n\n
3.8<\/h4>\n\n\n- New backup manager in the Integrity section: lists backups with their date and time, restores individual files from a backup and deletes backups individually, per batch or all at once.<\/li>\n
- Backups saved by earlier versions in the site root are detected too, with a warning that this location is web-accessible.<\/li>\n<\/ul>\n\n
3.7<\/h4>\n\n\n- Fixed: the Profiling \"Run test\" button did not record measurements, because the signed URL was generated with
esc_js()<\/code>, which turns the ampersand into an HTML entity and broke the query string, so the nonce never reached the server.<\/li>\n<\/ul>\n\n3.6<\/h4>\n\n\n- Security (important): the diff viewer no longer renders the analyzed file content as HTML. Previously, a tampered core file containing JavaScript could execute it in the admin panel when clicking \"Show changes\" (stored XSS).<\/li>\n
- Backups use a randomized folder name and a neutralized extension; the ZIP cache is protected against direct access.<\/li>\n
- The profiling test now requires a nonce and capabilities: any visitor could previously force database writes while bypassing the page cache.<\/li>\n
- Path validation now runs after normalization; cron tasks are backed up before removal; user deletion uses the
delete_user<\/code> meta capability.<\/li>\n- Hidden and configuration files in the site root are no longer flagged as extra, avoiding accidental deletion of
.user.ini<\/code>, ads.txt<\/code>, search engine verification files and similar.<\/li>\n- Robustness: the official ZIP is opened once per request and limits are raised for long operations.<\/li>\n<\/ul>\n\n
3.5<\/h4>\n\n\n- Hardened path resolution, restore and diff limited to core paths, and backups moved to the uploads folder with access protection.<\/li>\n
- Fixed: restoring files reported as missing always failed.<\/li>\n
- Added
uninstall.php<\/code> to clean options, transients and cache on uninstall.<\/li>\n<\/ul>\n\n3.4<\/h4>\n\n\n- Prepared for the plugin directory: readme, headers and Chart.js bundled locally instead of loaded from a CDN. Internationalization with English as the base language and a Spanish translation included.<\/li>\n<\/ul>\n\n
3.0 - 3.3<\/h4>\n\n\n- AI bot blocking with an Allow\/Block toggle per bot.<\/li>\n
- Redesigned interface as a modern control panel.<\/li>\n
- Renamed the Tunning section to WPO.<\/li>\n<\/ul>\n\n
2.0 - 2.9<\/h4>\n\n\n- New sections: Check users, WPO (performance, wp_options, WP-Cron, cache) and AI bot blocking.<\/li>\n
- Optional backup when restoring; deletion of extra files.<\/li>\n<\/ul>\n\n
1.6 - 1.9<\/h4>\n\n\n- Integrity limited to the real core; locale alignment in diff and restore; nonce and interface fixes.<\/li>\n<\/ul>","raw_excerpt":"Core integrity checks, load-time profiling, user review, performance diagnostics and AI bot blocking in a single admin panel.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/347917","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=347917"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/ricardomorales"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=347917"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=347917"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=347917"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=347917"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=347917"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=347917"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}