Modules overview

A module is one small, single-purpose switch, such as "Disable emojis" or "Limit login attempts". Each module has an id (for example disable_emojis) that you use on the command line and that appears in the snapshots of WellTend Snapshots.

The full, searchable list is on the plugin page.

The eight groups#

Every module follows the same rules#

• It is off until you switch it on.
• It saves as you click, with an Undo message.
• It uses WordPress filters and hooks only. It never edits wp-config.php or .htaccess, and never defines WordPress constants at run time.
• Switching it off, or uninstalling the plugin, fully reverses it.
• Every setting is checked for the right type and range before it is saved, and only administrators can change anything.

Extra safeguards#

Some modules are marked Extra safeguards in the list. They can lock someone out, gate the whole site, send mail or write files, so they ask you to confirm, take a safety copy first, and have a recovery path. They are: change login URL, SVG upload, view admin as role, plugin and theme rollback, limit login attempts, email delivery, contact form, password protection, maintenance mode, disable all updates, header/body/footer code, media replacement, image upload control, admin menu organizer and multiple user roles.

Read Safety and undo for what each safeguard does.

Every module by group#

Ids are what you type in WP-CLI and what appears in WellTend Snapshots as toolkit.{id}. Modules marked "extra safeguards" are explained in Risky modules and recovery.

Content and media (10)#

• Auto-Publish Missed Scheduled Posts (auto_publish_missed_schedule): Publishes scheduled posts that WordPress missed ("Missed schedule") because its scheduler did not run.
• AVIF Upload (avif_upload): Allows AVIF images in the Media Library, including their size and a preview. This version of WordPress already allows AVIF; the module adds a check that each file really is an AVIF. Your server can also create smaller sizes of AVIF images.
• Content Duplication (content_duplication): Adds a one-click Duplicate link to posts, pages and public content types. The copy is saved as a draft, and the original is never changed.
• Content Order (content_order): Drag pages and other content into any order you like. The admin list follows it, and so does any theme that sorts by "menu order".
• External Permalinks (external_permalinks): Make a page or post link straight to another web address instead of its own page. Adds a box to the editor where you paste the address.
• Media Files Visibility Control (media_visibility_control): Editors and authors only see the media they uploaded themselves; administrators still see everything. The files stay reachable by their web address.
• Media Replacement (extra safeguards) (media_replacement): Replace a file in the Media Library with a new one while keeping its ID, address, title and date, so no links break. The old file is kept for 7 days so you can undo.
• Menu Links in New Tab (menu_items_new_tab): Makes menu links that open in a new tab safe, and can open every custom menu link to another website in a new tab. (WordPress already has the "Open link in a new tab" box on each menu item.)
• Open External Links in New Tab (external_links_new_tab): Every link in your post content that points to another website opens in a new tab.
• SVG Upload (extra safeguards) (svg_upload): Lets the roles you choose upload SVG images. Every SVG is cleaned of scripts and outside links before it is saved, and a file that cannot be cleaned is refused.

Admin interface (10)#

• Admin Cleanup (admin_cleanup): Hides the dashboard widgets, admin-bar items and Help tab you do not use, so the admin feels calmer.
• Admin Menu Organizer (extra safeguards) (admin_menu_organizer): Reorder the admin menu by dragging, rename items and tuck away the ones you do not use, for everyone or for chosen roles.
• Admin Screen Tweaks (admin_ui_tweaks): Small admin-screen niceties: the media grid loads more files as you scroll, and active plugins are listed first.
• Custom Admin Footer Text (admin_footer_text): Replace "Thank you for creating with WordPress" and the version number at the bottom of the admin with your own text.
• Enhance List Tables (enhance_list_tables): Adds helpful columns (picture, excerpt, last modified, ID, file size) to your lists and removes the ones you never use.
• Hide Admin Bar (hide_admin_bar): Hides the black toolbar on the public site for the people (roles) you choose.
• Hide Admin Notices (hide_admin_notices): Collects the noisy plugin and update notices into one tidy panel that opens from the toolbar.
• Navigation Menu Duplicator (nav_menu_duplicator): Adds a "Duplicate menu" button to Appearance > Menus that copies a whole menu with all its items.
• Show Custom Taxonomy Filters (custom_taxonomy_filters): Adds a dropdown to your Posts, Pages and custom content lists so you can filter by your custom categories.
• Wider Admin Menu (wider_admin_menu): Makes the left-hand admin menu wider so long item names stay on one line.

Log in, log out and users (9)#

• Change Login URL (extra safeguards) (change_login_url): Moves the login page from /wp-login.php to a secret address of your choice, so bots that hit the default address get nothing. Write the new address down: if you lose it, use the recovery steps shown in the confirmation.
• Disable User Account (disable_user_account): Blocks a person from logging in without deleting them, so their posts and author name stay. Use the Disable link under their name in the Users list, the box on their profile, or the bulk action. They are signed out at once.
• Last Login Column (last_login_column): Remembers when each person last logged in and shows it in the Users list. Only logins from now on are recorded. It stores one date per person; delete-on-uninstall removes them.
• Log In/Out Menu (login_logout_menu): Adds "Log In", "Log Out" and a smart "Log In / Log Out" link you can drop into any menu (Appearance > Menus). Visitors only see the one that applies to them. If you use a page cache, make it keep logged-in visitors apart.
• Login ID Type (login_id_type): Makes people log in with their username only, or with their email address only, instead of either one.
• Redirect After Login (redirect_after_login): Sends the roles you choose to a page of your own site right after they log in, for example members to a welcome page instead of the dashboard.
• Redirect After Logout (redirect_after_logout): Sends the roles you choose to a page of your own site right after they log out, for example back to the home page instead of the login screen.
• Registration Date Column (registration_date_column): Adds a "Registered" date and time column to the Users screen, so you can see when each person joined and sort by it.
• Site Identity on Login Page (login_site_identity): Replaces the WordPress logo on the login screen with your site icon (set in Appearance > Customize > Site Identity) and makes it link to your own home page.

Custom code (6)#

• Custom Admin CSS (custom_admin_css): Add your own CSS to every screen of the WordPress dashboard.
• Custom Body Class (custom_body_class): Add your own CSS classes to the body tag of individual pages and posts, so you can style one page on its own.
• Custom Frontend CSS (custom_frontend_css): Add your own CSS to the public site, after your theme's styles.
• Manage ads.txt and app-ads.txt (ads_txt): Edit your ads.txt and app-ads.txt files from the dashboard, without touching the server.
• Manage robots.txt (robots_txt): Edit the robots.txt file that tells search engines what they may visit, from the dashboard.

Disable components (11)#

• Disable All Updates (extra safeguards) (disable_updates): Turns off WordPress, plugin and theme update checks, automatic updates, update notices and update emails. Pick only the parts you need.
• Disable Author Archives (disable_author_archives): A /author/name/ page shows "not found", author links disappear and authors leave the sitemap. This also stops ?author=1 from revealing usernames.
• Disable Comments (disable_comments): Turns comments and pings off for the content types you choose and hides the comment screens when they are off everywhere. Existing comments are kept.
• Disable Embeds (oEmbed) (disable_oembed): Stops other sites embedding yours and stops your site discovering embeds from arbitrary links.
• Disable Emojis (disable_emojis): Stops WordPress loading its emoji script and styles on every page. Emoji still show, using your visitors' own system emoji.
• Disable Feeds (disable_feeds): Turns off all RSS, Atom and RDF feeds and removes the feed links from your page headers. Your XML sitemap keeps working.
• Disable Gutenberg (disable_gutenberg): Switch the block editor off for the content types you choose and use the classic editor instead. Existing content is not changed.
• Disable Plugin & Theme Editor (disable_file_editor): Nobody can edit plugin or theme code from the dashboard, not even administrators.
• Disable REST API (disable_rest_api): Only logged-in people can use the REST API (wp-json), and the links that advertise it are removed from your pages. Applications that sign in keep working.
• Disable Smaller Components (disable_minor_components): A checklist of small WordPress extras you can switch off: header tags, Dashicons for visitors, jQuery Migrate, lazy loading, application passwords and password emails.
• Hide WordPress Version (hide_wp_version): Removes the generator tag and the WordPress version from script and style addresses so attackers cannot read it.

Security (7)#

• Block REST User Enumeration (block_rest_user_enumeration): Visitors who are not logged in can no longer list usernames through /wp-json/wp/v2/users.
• Disable XML-RPC (disable_xmlrpc): Turns off the XML-RPC endpoint, trackbacks and pingbacks that attackers probe.
• Email Address Obfuscator (email_obfuscator): Adds the shortcode [obfuscate email="you@example.com"] that shows an email address to people but hides it from spam harvesters. If you switch the module off, the shortcode shows up as plain text in your pages.
• Limit Login Attempts (extra safeguards) (limit_login_attempts): Locks an address out for 15 minutes after a few wrong passwords, and for a day after repeated lockouts. Your own address is never locked out while you set this up. Shared networks (offices, mobile data) share one address, so keep the limits generous.
• Obfuscate Author Slugs (obfuscate_author_slugs): Replaces usernames in author page addresses (/author/name/) with random-looking codes, and does the same in the public users list of the REST API, so visitors and bots cannot read login names from your site. The old /author/name/ addresses stop working.
• Password Policy (password_policy): Sets a minimum length and character rules for every new password: when someone registers, resets a password, or changes it in their profile. Existing passwords keep working until they are changed.
• Security Headers (security_headers): Sends X-Content-Type-Options, Referrer-Policy and X-Frame-Options with every page.

Speed and optimization (3)#

• Heartbeat Control (heartbeat_control): Slows down or switches off the background "heartbeat" requests WordPress sends, to lower server load.
• Image Upload Control (extra safeguards) (image_upload_control): Shrinks oversized photos as they are uploaded and turns BMP and non-transparent PNG files into JPG to save disk space. The original upload is replaced.
• Limit Post Revisions (limit_revisions): Keeps only the latest few revisions of each post so the database stays small.

Utilities (9)#

• Display System Summary (system_summary): Adds web server, PHP, database and server address to the "At a Glance" box on the Dashboard. Only administrators see it.
• Image Sizes Panel (image_sizes_panel): Shows every generated size of an image, with direct links and dimensions, when you edit it in the Media Library.
• Maintenance Mode (extra safeguards) (maintenance_mode): Shows visitors a friendly "we'll be back soon" page while you work. People who can edit posts still see the real site. Search engines are told to come back later, so your rankings are safe.
• Multiple User Roles (extra safeguards) (multiple_user_roles): Lets you give one person several roles at once from the Edit User and Add New User screens (for example Editor and Shop manager).
• Password Protection (extra safeguards) (password_protection): Hide the whole site behind one shared password. Good for a staging copy or a private preview. Logged-in administrators walk straight in.
• Plugins and Themes Rollback (extra safeguards) (plugins_themes_rollback): Go back to an earlier version of a plugin or theme when an update broke something (or move to a later one) from one screen, with a log of what was changed. Only for plugins and themes from WordPress.org.
• Redirect 404 to Homepage (redirect_404_home): Sends visitors who land on a "page not found" address to your home page instead.
• Search Engines Visibility Status (search_visibility_status): Shows a bright warning in the toolbar while your site asks search engines not to list it. Easy to forget after a launch.
• View Admin as Role (extra safeguards) (view_admin_as_role): Lets you see the dashboard and your site exactly as an Editor, Author, Customer or any other role would, then switch back with one click. Your own account is never changed.