For developers · WellTend Site and Admin Toolkit docs

WellTend Site and Admin Toolkit by AllWPCare uses the namespace AllWPCare\AdminSiteToolkit, the prefix awc_ast_, the REST namespace awc-ast/v1 and the text domain welltend-site-and-admin-toolkit. It needs PHP 7.4 and WordPress 6.4 or newer.

How settings are stored#

One option per module, plus a few small helpers. Everything is prefixed awc_ast_.

Option	Autoloaded	Content
`awc_ast_module_{id}`	yes	`{ enabled: bool, option_key: value, ... }`. Absent until the module was first saved.
`awc_ast_enabled`	yes	A cached list of enabled module ids. What is on is decided by the per-module options (read from the autoloaded options, no query, no module file loaded), so two saves at the same moment cannot lose a module. The list is repaired on every save.
`awc_ast_undo_{id}`	no	The state before the last change, plus a ring of the last three earlier states kept before changes to risky modules. A second undo is a redo.
`awc_ast_changed`	no	Which module changed last and who changed it, for the "Recently changed" view.
`awc_ast_settings`	no	Plugin settings. `delete_data` decides whether uninstall removes everything.
`awc_ast_failures`	no	The last start-up failure per module. A module that throws while starting is skipped and listed here.

Because each module is its own option, a snapshot or a diff names the module, and one module can never corrupt another. Every save carries a revision hash. If two browser tabs change the same module, the second one gets a conflict instead of silently overwriting.

WellTend Snapshots provider ids#

When WellTend Snapshots is active, the Toolkit adds one provider per module through the awc_scm_providers filter. The id is toolkit.{module id}, for example toolkit.disable_xmlrpc, and the label is "Toolkit:" followed by the module name.

The schema labels every option, so a comparison reads "Revisions to keep per post (0 = none) changed from 5 to 10" and not a raw key.
Options of type credential are declared as secret keys. They are redacted from snapshots and exports and never leave the site.
Restoring a provider goes through the same save path as the dashboard, so lifecycle hooks run: restoring a snapshot that had a module off really switches it off.

REST API#

All routes are under /wp-json/awc-ast/v1/ and need an administrator and a REST nonce.

Route	Method	Purpose
`/modules`	GET	Every module with its current state. Credentials are blanked.
`/modules/{id}`	GET, POST	Read or change one module. A POST carries the `revision` it was based on.
`/modules/{id}/reset`	POST	Defaults for the options. The module stays on or off.
`/modules/{id}/undo`	POST	Undo the last change, or redo it.
`/import-scm`	POST	Carry over modules switched on in Site Config Manager 0.3 (now WellTend Snapshots).
`/settings`	GET, POST	Plugin settings.

Hooks#

Hook	Kind	Purpose
`awc_ast_modules`	filter	Add module objects (extend `AllWPCare\AdminSiteToolkit\Modules\Module`).
`awc_ast_categories`	filter	Add or change categories.
`awc_ast_module_saved`	action	`( $id, $new, $old, $source, $checkpoint )` after any saved change from the dashboard, WP-CLI or WellTend Snapshots.
`awc_ast_scm_active`	filter	Override whether the WellTend Snapshots integration counts as active.
`awc_ast_post_duplicated`	action	After Content Duplication creates a copy.
`awc_ast_duplicate_skipped_meta`	filter	Meta keys not copied by Content Duplication.
`awc_ast_media_replaced`	action	After Media Replacement swaps a file.
`awc_ast_rollback_done`	action	After a plugin or theme rollback.
`awc_ast_maintenance_ajax_actions`, `awc_ast_password_protection_ajax_actions`	filter	AJAX actions that stay open while the site is gated.
`awc_ast_skip_404_redirect`	filter	Return true to leave a request alone in Redirect 404 to Homepage.
`awc_ast_order_limit`	filter	How many items Content Order loads (default 2000).
`awc_ast_user_roles_changed`, `awc_ast_view_as_changed`, `awc_ast_account_toggled`, `awc_ast_contact_received`	action	Events from the modules of the same names.

Adding a module#

A module is one PHP file at includes/Modules/{Category}/{StudlyId}.php. The registry finds it by the file name, so nothing else is registered: the id disable_feeds is the class DisableFeeds in includes/Modules/Disable/DisableFeeds.php.

DisableFeeds.php

final class DisableFeeds extends Module {	protected function definition(): array {		return array(			'id'          => 'disable_feeds',			'name'        => __( 'Disable Feeds', 'welltend-site-and-admin-toolkit' ),			'category'    => 'disable',			'description' => __( 'One owner-readable sentence.', 'welltend-site-and-admin-toolkit' ),			'risk'        => 'normal',			'options'     => array(),		);	}	public function boot( array $settings ): void {		// Runs on init priority 1 while the module is on. Add filters and actions only.	}}

The rules every module follows:

boot() only adds hooks. No database writes, and no current_user_can(): the user is not set up yet, so check inside the hooks.
on_disable() removes everything that is not a plain hook: rewrite rules, scheduled events, transients. It must be safe to run twice.
on_uninstall() deletes post meta, user meta, tables and uploaded files, but only when "Delete data on uninstall" is on.
A risky module also gives confirm (what will happen) and recovery (how to get back).
Option types are validated: bool, int, select, multiselect, roles, post_types, string, text, url, email, code, html, data, repeater and credential. Toggles and choices save instantly; text, code, URL and credential fields have their own Save.

The plugin README in the repository has the full lifecycle table and option schema.