=== AdminEase - All-in-One Admin Toolkit: Security & Performance ===
Contributors: precisionwp
Tags: admin, security, performance, updates, maintenance
Requires at least: 5.3
Tested up to: 7.1
Stable tag: 2.6.0
Requires PHP: 7.4
WC tested up to: 11.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html
Text Domain: adminease
Domain Path: /languages

Fix a slow WordPress admin, harden security, and control 60+ settings from one dashboard - no code required.

== Description ==

**AdminEase** is an all-in-one WordPress admin toolkit that helps you manage updates, strengthen security, improve performance and streamline site maintenance without touching code. AdminEase makes everyday site management faster, safer, and easier from a clean, user friendly dashboard.

Is your WordPress admin slow? AdminEase fixes the most common causes and locks down security without touching code.

- **Fixes the slowdowns**: Tackles low memory limits, database bloat, and WP-Cron overload, the most common causes of a sluggish admin.
- **Locks down security**: Harden your site against common attacks with a click, nothing to configure.
- **One dashboard, 60+ settings**: Toggle features on or off anytime, with nothing to break if you change your mind.

= Key Benefits =

- **No Coding Required**: User-friendly interface for all skill levels
- **Enhanced Security**: Protect your site from common vulnerabilities
- **Better Performance**: Optimize WordPress for speed and efficiency
- **Complete Control**: Toggle features on/off anytime without risk
- **Time Saver**: Manage dozens of settings from one dashboard
- **Right to Left Ready**: Full RTL support

== Features ==

= Updates and Notifications =
- **Auto Update Core**: Enable/disable automatic WordPress core updates.
- **Auto Update Plugins**: Enable/disable automatic plugin updates.
- **Auto Update Themes**: Enable/disable automatic theme updates.
- **Auto Update Translations**: Enable/disable automatic translation updates.
- **Update Notification Emails**: Receive emails when core, themes, or plugins are auto-updated.
- **New User Admin Notification Email**: Notify admin on a new user registration.
- **User Password Change Admin Notification Email**: Notify admin when a user changes their password.
- **Comment Admin Notification Email**: Notify admin on new comments.
- **Disable Admin Notices**: Hide admin notices from plugins and themes.
- **Disable recovery mode email notification**: Prevent WordPress from sending recovery mode emails.
- **Customize recovery mode recipient email**: Set a custom email address to receive recovery mode notifications.

= Email =
- **Send Email Through SMTP**: Send your site's email through a real mailbox instead of the web server, so password resets, order confirmations, and contact form messages reach the inbox instead of spam. Includes a test button that reports exactly what your mail server said.

= Security =
- **Disable File Edit**: Prevent editing theme/plugin files from the admin panel.
- **Disable File Mods**: Prevent all file modifications in WordPress, including installing, updating, and deleting plugins and themes.
- **Disable XML-RPC**: Block XML-RPC access to reduce attack surface, with an IP allowlist in [AdminEase Pro](https://precisionwp.net/product/adminease/).
- **Disable REST API**: Block REST API access, with an IP allowlist in [AdminEase Pro](https://precisionwp.net/product/adminease/), plus the option to allow all HTTP requests to wordpress.org, including plugin/theme updates, version checks, and other API communications.
- **Disable Embeds**: Stop automatic embedding of external content.
- **Hide WordPress Version**: Remove version info from source code and feeds.
- **Password Protect Site**: Protect your entire website with a password, featuring customizable themes, role-based bypasses, IP whitelisting, device remembering, and auto-disable scheduling.
- **Block Access to .htaccess/.htpasswd**: Protect sensitive server files.
- **Disable Pingbacks**: Prevent XML-RPC pingback abuse.
- **Block Author Scans**: Prevent username enumeration.
- **Block Directory Browsing**: Stop public directory listing.
- **Disable Script Concatenation (Admin)**: Prevent certain DoS attacks in admin.
- **Block Specific Countries (GeoIP)**: Restrict site access by country.
- **Block Specific Bots**: Control which bots can access your site
- **CORS Headers**: Enable Cross-Origin Resource Sharing to allow trusted websites to access your site's resources safely.
- **Hide PHP Version**: Remove X-Powered-By header to hide PHP version information from headers.

= Performance =
- **Memory & Execution Limits**: Raise your site's memory and PHP execution time limits to stop "out of memory" and timeout errors.
- **Autosave Interval**: Customize how often WordPress auto-saves your work.
- **Reliable Cron**: Replace WP-Cron with a real server cron job, so scheduled tasks run on time instead of waiting on site traffic.
- **Disable Emojis**: Stop loading emoji scripts and styles you don't need.
- **Heartbeat Control**: Stop the background admin polling that runs every 15 to 60 seconds for every logged-in user, or just slow it down, while keeping autosave and post locking in the editor.

= Posts =
- **Empty Trash Days**: Set the number of days to keep deleted posts in trash.
- **Post Revisions**: Limit or disable post revisions to save database space.
- **Disable Gutenberg Editor**: Disable the block editor and revert to the classic editor.
- **Drag and Drop Ordering Posts**: Rearrange posts via drag-and-drop.
- **Disable Comments**: Disable comments site-wide with a single toggle.
- **Bulk Delete Posts**: Delete posts in bulk from the admin panel.
- **Posts Metadata Box**: Adds a meta box to posts for easy management of custom fields.

= Taxonomies =
- **Drag and Drop Ordering Taxonomies**: Rearrange taxonomies via drag-and-drop.
- **Improved Taxonomy Meta Box**: Enable lazy loading for taxonomy terms to improve performance.
- **Taxonomy Switcher**: Switch taxonomy terms between taxonomies in a single click.
- **Taxonomy Term Metadata Box**: Adds a meta box to taxonomy terms for easy management of custom fields.
- **Bulk Delete Terms**: Delete taxonomy terms in bulk from the admin panel, with an optional filter for empty terms only or a name search, and an option to delete child terms along with their parent.

= Users =
- **Disable User Registration**: Block all new user registrations.
- **Force Strong Passwords**: Enforce password complexity rules (length, case, numbers, symbols).
- **Auto-Logout User**: Auto-logout users after inactivity (customizable per role and time).
- **Hide Admin Bar**: Hide the admin bar for specific users.
- **Redirect After Login/Logout**: Customize where users go after logging in or out
- **Users Metadata Box**: Adds a meta box to users for easy management of custom fields.
- **Last Login Tracking**: Tracks when users log in, displays the information in the users table, and shows it on their profile pages.

= Debug =
- **WP Debug**: Enable WordPress debug mode.
- **WP Debug Log**: Log errors to a file.
- **WP Debug Display**: Show/hide errors on the site.
- **Debug Log Viewer**: View the debug log directly from the admin panel.
- **Maintenance Mode**: Prevent all users from accessing the site but not the admin area.
- **Network Viewer**: See every incoming request to your site in real time to spot suspicious activity and traffic spikes.
- **Email Log**: Every email your site sends, logged with recipient, subject, and delivery status, so you can debug missing emails and SMTP problems.
- **Cron Viewer**: See every scheduled task, find orphaned jobs left behind by deleted plugins, and run, pause, or resume any job on demand. On WooCommerce stores you also see the Scheduled Actions, and can run or cancel the ones still waiting.
- **Outgoing HTTP Request Log**: See every call your site makes to an outside server, with the destination, the response code, how long it took and which plugin or theme started it, so you can find what is really slowing the site down.

= Media =
- **Upload Max File Size**: Set maximum upload file size.
- **Allow SVG Uploads**: Enable SVG file uploads with security checks.
- **Allow Custom File Extension Uploads**: Enable additional file types beyond WordPress defaults
- **Media Infinite Scrolling**: Enable infinite scrolling for the media library.
- **Disable Big Image Threshold**: Disable the threshold for displaying large images in the media library.
- **Disable Generated Image Sizes**: Choose which of the image sizes registered by your theme and plugins WordPress should stop creating on upload, so a single image no longer fills the uploads folder with copies you never use.

= Plugins =
- **Display Active Plugins First**: Reorders the Plugins list to show active plugins at the top, separated from inactive plugins by a visual divider.
- **Enable Plugin Download**: Adds a Download link to each plugin row, allowing admins to download any installed plugin as a .zip file directly from the admin panel. Requires PHP ZipArchive extension.

= Notes =
- **Sticky Notes**: Leave post-it notes anywhere in the admin. A note stays on the screen you wrote it on and drops a marker you can drag wherever you like. One panel holds the lot: the notes on the screen you are on, or every note in the site with a link back to where each one belongs, plus a search box. Notes are marked as done rather than deleted, and they are never removed when the plugin is uninstalled. Free notes are personal and administrators only. Sharing notes with your team, assigning them to a person, due dates and reminders, checklists, attaching a note to a specific post, product or order, and letting other roles write notes are available in [AdminEase Pro](https://precisionwp.net/product/adminease/).

= Tools =
- **Export / Import Settings**: Save all your AdminEase settings to a file you can keep as a backup, and load it back on this site or on another one.

== Installation ==

= Automatic Installation =
1. Log in to your WordPress admin panel
2. Go to Plugins > Add New
3. Search for "AdminEase"
4. Click "Install Now" and then "Activate"
5. Navigate to the AdminEase menu to configure your settings

= Manual Installation =
1. Download the plugin zip file
2. Log in to your WordPress admin panel
3. Go to Plugins > Add New > Upload Plugin
4. Choose the downloaded zip file and click "Install Now"
5. Activate the plugin
6. Navigate to the AdminEase menu to configure your settings

= After Activation =
1. Go to the AdminEase menu in your WordPress admin
2. Explore the organized tabs (Updates, Security, Performance, etc.)
3. Enable the features you need
4. Save your settings

**Important:** We recommend testing on a staging site first and always maintain backups before making configuration changes.

== Important Disclaimer ==

This plugin modifies core WordPress functionality and behaviors. While we strive to maintain compatibility and stability:

* The plugin's features may work differently or not at all depending on your server configuration, hosting environment, and installed plugins
* Some features may be restricted on certain hosting providers or server setups
* We strongly recommend testing the plugin in a staging environment before using it on a production site
* Always maintain regular backups of your website before making any changes

== Server Compatibility Notice ==

Different server configurations may affect the plugin's functionality:

* Shared hosting environments might have restrictions that prevent certain features from working
* Some features may require specific PHP extensions or server modules
* Server-level email configurations might affect notification control features

= Nginx and other servers that do not read .htaccess =

Several features are normally delivered as .htaccess rules, which Apache and LiteSpeed (in Apache-compatibility mode) read, but Nginx, LiteSpeed in native mode, and IIS do not.

On those servers AdminEase automatically enforces the following in PHP instead, so they work the same way with nothing to configure:

* Disable XML-RPC
* Block Specific Countries
* Block Specific Bots

The settings screen tells you which method is in use on your server. Features that change PHP or WordPress configuration rather than blocking requests (memory limit, upload size, file-editor lockdown, and similar) are unaffected either way.

The same applies to the backup copies AdminEase keeps of your wp-config.php and .htaccess files. They are stored in a folder with a long random name, which keeps them out of reach on every server, instead of relying on a rule file that only some servers read.

Block Specific Countries additionally need a geolocation source: either Cloudflare in front of your site or the GeoIP module on the server. If neither is available, the feature reports itself as unsupported rather than appearing to work.

If you experience any issues, please check with your hosting provider about server limitations.

== Frequently Asked Questions ==

= Why is my WordPress admin so slow, and how does AdminEase fix it? =
The most common causes are a low PHP memory limit, a bloated database from unlimited post revisions, WP-Cron running on every admin page load, and a single poorly optimized plugin hammering admin-ajax.php. AdminEase fixes the first three directly from Performance and Posts settings (memory limit, post revision caps, disabling WP-Cron in favor of a real server cron), and its Network Viewer helps you spot the fourth by logging AJAX request volume by plugin path.

= Do I need to know how to code to use AdminEase? =
No coding knowledge is required. All features are accessible via an intuitive dashboard interface. Toggle features on or off with a click.

= Will AdminEase slow down my site? =
No, AdminEase is designed with performance in mind. It's lightweight and you can enable only the features you need. Many features actually help improve your site's performance.

= Can I undo changes made by AdminEase? =
Yes, you can toggle features on or off at any time. The plugin safely manages configuration changes and maintains backups of critical files.

= Is AdminEase compatible with other plugins? =
AdminEase is designed to work with most WordPress plugins and themes. However, since it modifies core WordPress behavior, conflicts may occasionally occur. We recommend testing on a staging site first.

= The Password Protect Site form keeps reappearing after I enter the correct password. Why? =
This almost always means a CDN or page cache (commonly Cloudflare with a "Cache Everything" rule) is serving a cached copy of the password page, so WordPress never sees that you logged in. AdminEase automatically adds a one-shot cache-busting parameter on login to work around this. For a fully reliable, leak-proof setup behind Cloudflare, also add a **Cache Rule** in the Cloudflare dashboard - *When* `http.cookie contains "adminease_pps_auth_"` *Then* **Bypass cache** - and purge the cache once. If only some pages are protected, make sure your "Cache Everything" rule respects origin cache headers or excludes the protected URLs.

= What happens if I deactivate or delete the plugin? =
When you deactivate AdminEase, it safely restores your WordPress configuration to its previous state. All changes are reversed automatically.

= Does AdminEase work on WordPress Multisite? =
Basic compatibility is available, but some features may not work as expected on Multisite installations. Full Multisite support is planned for future releases.

= Where can I get support? =
For support, please visit our [support forum](https://wordpress.org/support/plugin/adminease/). We monitor the forums regularly and are happy to help.

= Is there a Pro version? =

Yes. [AdminEase Pro](https://precisionwp.net/product/adminease/) is an add-on that runs alongside the free plugin, from the same dashboard. It needs the free plugin installed and active.

**Security**:

- Block access by country using GeoIP with an allowlist for your own IP addresses and for search engine bots.
- Disable XML-RPC with its own IP allowlist.
- Disable the REST API with its own IP allowlist plus a list of REST routes that must keep working while the rest of the API stays blocked.

**Posts and taxonomies**:

- Choose which post types the block editor is switched off for.
- Which post types get drag-and-drop ordering.
- Which taxonomies get drag-and-drop ordering.
- Lazy loading for the taxonomy meta box for sites with a large number of terms.

**Users**:

- Log users out after a period of inactivity, with the timeout set per role.

**Settings and appearance**:

- A dark monospace "Terminal" theme for the free plugin's Maintenance Mode page.

= Where can I get support? =

For support, please visit our [support page](https://precisionwp.net/my-account/support/) or contact us through the plugin's support forum.

**Support Resources:**

- [Documentation](https://precisionwp.net/docs/adminease/installing-adminease-on-your-wordpress-site/)
- [Tutorials](https://precisionwp.net/tutorials/)
- [Support Forum](https://wordpress.org/support/plugin/adminease/)
- [PrecisionWP Website](https://precisionwp.net/)
- [Adminease Pro](https://precisionwp.net/product/adminease/)

Unlock all Pro features with AdminEase Pro.

== Screenshots ==

1. Dashboard
2. Updates & Notifications
3. Email
4. Security
5. Performance
6. Posts
7. Taxonomies
8. Users
9. Debug
10. Media
11. Plugins
12. Notes
13. Tools

== Changelog ==

= 2.6.0 =

- Added: An AdminEase page in Network Admin for Multisite, where you can give new sites the settings of an existing site.
- Added: Turning off core updates can now leave security and maintenance updates on, so only major versions are stopped.
- Added: A warning on the Dashboard and Updates screens when Disallow file modifications has stopped automatic updates.
- Added: Disable self pingbacks, a separate switch that stops your site pinging itself.
- Added: Choose which content types Disable Comments applies to, including products, and optionally remove the Comments screens.
- Added: Turn off RSS feeds, or just comment feeds.
- Added: Close comments on every post while keeping the ones already left.
- Added: Safe mode, so you can see your site without AdminEase's cleanup switches for an hour.
- Added: Turn off pages you do not use, like author pages, date archives and search.
- Added: Safe and Check labels on the Posts switches, and a Reset all settings button under Tools.
- Added: Stop the password strength meter loading on the front end.
- Added: A Delete old revisions button that trims revisions down to your limit, for the post types you choose.
- Added: Warnings under settings that can break an active plugin, like Jetpack or WooCommerce.
- Added: An Audit Log under Users that shows who changed what: settings, users and their roles, plugins, themes and posts.
- Fixed: On a Multisite network, settings that change files every site shares can now only be changed by a super admin on the main site.
- Fixed: WP Debug switches itself off when the debug log grows too large.
- Fixed: Importing settings now works on Windows servers, checks them the same way saving does, and they take effect straight away. Settings with values that do not fit, like text in a number box, are now refused.
- Fixed: Turning off core updates no longer stops plugin, theme and translation updates.
- Fixed: Small bugs in Disable Gutenberg, Disable Comments, Disable Generated Image Sizes and Disable pingbacks. Posts no longer look unstyled to logged-in editors, and Disable pingbacks no longer changes your Discussion settings.
- Fixed: Disable pingbacks now also closes pingbacks on older posts and stops your site sending them.
- Fixed: Log tables no longer show a double border.
- Tweak: Clearer descriptions for Disallow file modifications, Disable pingbacks, Disable comments and Post revisions.

= 2.5.0 =

- Added: The Cron Viewer now shows WooCommerce's Scheduled Actions in their own tab, so you can see what is waiting, what ran and what failed, and run or cancel a waiting action without leaving AdminEase.
- Added: AdminEase is now fully translated into Spanish.
- Added: Clean up the page head. Under Performance you can now stop your public pages from loading styles and scripts many sites never use, such as global styles, block styles, icons for visitors, jQuery Migrate and the comment reply script. Some of these can change how your site looks or stop a feature working, so each one comes with a warning.
- Added: Heartbeat Control can now be set separately for the dashboard, the post editor and the front end, each one normal, slowed down or off. Slowing it down now works in the block editor too.
- Added: Help for Disable WP Cron. Under Performance, the switch now shows the exact line to add to your server's cron jobs, with a copy button, and warns you if scheduled tasks are running more than an hour late.
- Added: Disable Embeds now has two switches, one to stop other sites embedding your posts and one to keep pasted YouTube, X and similar links as plain links in your posts and widgets.
- Added: Hide the REST API route list. A new switch under Security hides the list of all API addresses at /wp-json/ from visitors who are not logged in, so they cannot see which plugins you use.
- Added: Turn off application passwords. A new switch under Users stops apps from logging in to your site with application passwords and removes them from user profiles. Anything that logs in this way, such as the WordPress mobile app or Jetpack, stops working, so leave it off if you use them.
- Added: A search box on every tab to find a setting by name and jump straight to it.
- Added: The Dashboard now shows how many settings are turned on in each tab and lists anything that needs your attention.
- Fixed: Block author scans now works on every server, not only Apache, and is harder to get around. Visitors can no longer list your users through the API or look them up with ?author=.
- Fixed: Turning off the recovery mode email no longer risks a second error when your site is already crashing.
- Fixed: Disable new user admin notification email now works. Before, you kept getting the email.
- Fixed: Turning off update emails no longer hides the emails that say an update failed.
- Fixed: Turning off the password change email for admins no longer adds a failed email to the Email Log.
- Fixed: Disable Embeds no longer turns off the check that keeps embedded content from other sites safe, and no longer breaks link previews in the editor.
- Fixed: Disable XML-RPC now also blocks XML-RPC on Apache sites where the server ignores the block AdminEase adds.
- Fixed: Disable REST API is now harder to get around, and it no longer locks editors out of the block editor and media library.
- Fixed: Password Protect Site now also hides your sitemaps and feeds, and tells search engines not to index the protected site or list it in results. New settings ask search engines not to crawl it at all while it is protected, and can keep your content from being read through the REST API too.
- Tweak: Settings are grouped more clearly. Sending email through SMTP now has its own Email tab, Disable WP Cron and Autosave Interval are under Background Activity in Performance, and Disable Emojis is under Page Head.
- Tweak: The Cron Viewer looks and works better on phones.
- Tweak: The AdminEase Pro list on the Dashboard now matches what Pro adds.
- Updated: Translation template.

= 2.4.1 =

- Fixed: The AdminEase boxes on the post, category, tag and user edit screens lost their styling and showed as plain unformatted text. They look like part of the WordPress screen again.

[See the full changelog for older versions](https://plugins.svn.wordpress.org/adminease/trunk/changelog.txt).