=== WellTend Site and Admin Toolkit ===
Contributors: quangthien27
Tags: admin, disable comments, duplicate post, login, security
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Switch off what you do not need and tidy your WordPress admin, one safe switch at a time. Pairs with WellTend Snapshots for one-click undo.

== Description ==

WellTend Site and Admin Toolkit is a collection of small, focused switches for your WordPress admin and site. Each one does a single job, starts **off**, can be undone, and explains itself in plain language. It is part of AllWPCare, a family of free plugins for taking care of WordPress sites.

Everything lives on one screen under **WellTend > Toolkit**:

* **Search first.** Press `/` and type. It finds modules by name, description, keywords and even option labels, forgives typos, and highlights what matched.
* **Categories with counts**, plus "Enabled" and "Recently changed" views.
* **Saves as you go.** Toggles save instantly and show an **Undo** button. Fields where a half-typed value must never go live (text, web addresses, passwords) have their own Save button and warn you about unsaved changes.
* **Risky switches ask first.** They show what can go wrong and how to get back in, and a snapshot is taken before the change.
* **Link to any module.** Every module has a link (`#module-id`) you can share or put in your notes.

= Modules in this version =

* **Disable XML-RPC**: close the XML-RPC endpoint that attackers probe.
* **Hide WordPress Version**: remove the generator tag and version numbers from your pages.
* **Disable Plugin & Theme Editor**: nobody can edit code from the dashboard.
* **Block REST User Enumeration**: stop strangers listing your usernames.
* **Security Headers**: send a few safe response headers.
* **Disable Emojis**: stop loading the emoji script and styles.
* **Disable Embeds (oEmbed)**: stop other sites embedding yours.
* **Heartbeat Control**: slow down or stop the WordPress heartbeat.
* **Limit Post Revisions**: keep the database small.
* **Disable Comments**: for everything, or only some content types.
* **Admin Cleanup**: hide dashboard widgets, admin-bar items and the Help tab you never use.

More modules arrive in updates. They all follow the same rules.

= Safe by design =

* Only WordPress filters and actions are used. The plugin never edits `wp-config.php` or `.htaccess` and never defines core constants.
* Switching a module off, or deactivating the plugin, removes its effect. Your saved settings are kept unless you choose "Delete all Toolkit data" in Settings before deleting the plugin.
* If a module ever locks you out: `wp awc toolkit disable <module-id>` with WP-CLI, or add `define( 'AWC_DISABLE_MODULES', true );` to `wp-config.php` to switch modules off until you remove the line.
* Only administrators can change anything. Passwords and keys you enter are never sent back to the browser.
* No tracking. The plugin contacts no outside service on its own; the one module that talks to WordPress.org is listed under External services.

= Works with WellTend Snapshots =

When the free **WellTend Snapshots** plugin is active, every Toolkit module becomes part of its snapshots, exports and comparisons. Risky changes take a snapshot first, so you can restore the previous state with one click. Passwords and keys are never exported.

= WP-CLI =

`wp awc toolkit list|enable|disable|get|set|reset|undo`

== Frequently Asked Questions ==

= Does it change my site as soon as I activate it? =

No. Every module is off until you switch it on.

= How do I undo a change? =

Press **Undo** in the message that appears after a change, or open the module and choose "Undo last change". With WellTend Snapshots you can also restore a snapshot.

= Will it edit wp-config.php? =

Never. For example the code editor is disabled with a capability filter, not with the `DISALLOW_FILE_EDIT` constant.

= What happens to my settings when I delete the plugin? =

They stay in your database, so a reinstall picks up where you left off. Turn on "Delete all Toolkit data" in the Settings tab before deleting if you want everything removed.

= Does it work on multisite? =

It works per site when activated on a sub-site. There are no network-admin features in this version.

== External services ==

The **Plugins and Themes Rollback** module (off until you switch it on) connects to WordPress.org, and only when you use its screen:

* To list the versions you can go back to, it asks the WordPress.org Plugins or Themes API (api.wordpress.org) about that one plugin or theme. It sends the plugin's or theme's slug. Like every request WordPress makes, it also sends your WordPress version and site address in the user agent.
* When you choose a version, it downloads that version's zip file from downloads.wordpress.org. Nothing else is installed, and no other address is ever used.

No other module makes outside requests.

This service is provided by the WordPress Foundation through WordPress.org. Terms and guidelines: https://wordpress.org/about/license/ Privacy policy: https://wordpress.org/about/privacy/

== Screenshots ==

1. The Modules screen with search, categories and counts.
2. Searching across names, descriptions and option labels.
3. Options of a module, with an Undo message after a change.

== Changelog ==

= 0.1.0 =
* First release: the modules listed above, the Modules screen, REST API and WP-CLI commands.
