WP Webmaster is a kind of swiss army knife that gathers essential functions and settings for standard wordpress instances and limits the number of installed plugins noticeably. In my webdesigners and administrators life I often miss small functions like SMTP or SVG support, but don't want to bloat my plugin list for every little purpose. So I built a plugin with convient settings page and default configuration file for a secure, privacy focused webmastering. Feel free to use, fork and rearrange.
Customize email headers like name and email address for all outgoing messages. These settings can be overwritten by other plugins. Block notfications sent to the main admin, when plugins, themes or the core is updated.
Send all emails via SMTP. Encryption like SSL or TLS is mandatory. Allow self-signed certificates for debugging only. Attention: server errors are shown in the frontend code directly!
Prevent individual defined categories from beeing displayed as blog posts at the frontend, beautify Contact Form 7 with popup messages and protect media files form download via context menu.
Setup a custom design for the login page. Choose your own logo above the login form and use credits in the footer beneath. Further styles are found in the assets folder of this plugin.
Clean the backend of unnecessary entries in the admin bar and in the admin menu. Hide sensitive settings and update information from all users except the main admin.
Creates a individual widget at the admins dashboard for messages to other editors. Furthermore brand the admin backend with a personal footer.
Allows admins to upload SVG images and corrects the incorrect display in the media library and frontend. Overrides the upload path for files set in the media settings.
Enable AWS S3 third party compatibility. Overwrites the default AWS endpoint for compatibility with providers like IONOS or OVHcloud. Human Made Plugin S3 Uploads required.
Lockdown brute force attacks, disable login with usernames which can be read plain at the authors archives or restrict admin creation to admins only even though editors are setup to create users too.
Mask email addresses and phone numbers for spam protection by encoding them with ASCII codes. Extend YouTube links with no-cookie-request and disable Google Fonts.
Inject code snippets sitewide into the header or footer and clean the code from unnecessary HTML for performance or security reasons, e.g. disable xmlrpc.php unless you require it for remote publishing or the Jetpack plugin.
Options for developing purposes. Not recommended for productive environments.
Security: AES-256-CBC key for storing smtp-pw now derived from wp_salt('auth')
- Derive SMTP encryption key per install instead of using a hardcoded constant
- DB-Dump and Repo is not enough anymore for hacking password
- Rotating the WP salts in wp-config.php now invalidates the stored SMTP password
- Admin has to re-enter it then
- New ciphertexts carry a "v2:" prefix
- Legacy values are decrypted with the old key as a
- password and the admin has to re-enter it. transparent fallback
- Legacy values are re-encrypted on admin_init via wpw_migrate_smtp_entrance()
- Security: Self-Post-Forms get wp_nonce_field() check_admin_referer() against CSRF
- Bugfix: Deleting of log files now working in all setups of existing logs
- Bugfix: Better error logs in crypter.php and clean return with false
- Update: Execution time for delivering deprecated in smtp settings
- Coding standards when unblocking IPs
- Bugfix: Output buffering in privacy function not compatible with WP 6.9
- Feature: Define the mail address, where fatal errors are sent to
- Feature: Allow privacy policy page edits for editors
- Feature: Implement JavaScript for disabling context menus with download options for audio elements
- Little code cleaning
- Feature: Implement JavaScript popups for the Contact Form 7 reponse output
- Feature: Prevent individual defined categories from being displayed as blog posts at the frontend.
- Fix: Merging default, config, and current settings with error handling when option is not in the database
- Feature: Login lockdown for brute force attacks by blocking IPs for 24 hours after 3 failed login attempts
- Log blocked ips to a seperate file
- Function to unblock all blocked IPs
- Feature: Log email actions in separate file
- Advanced output of email errors via alert for debugging purposes
- Feature: Test mail for email and smtp settings
- Feature: Inject code snippets e.g. for tracking
- Limit injection to not logged in users only
- Little code cleaning
- Initial Public Release
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any latter version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.