=== Blaminhor Essentials – Redirects, Broken Links, Favicon, Maintenance, Classic Editor & 21 More ===
Contributors: blaminhor
Tags: all-in-one, cookie-banner, broken-links, hide-login, maintenance-mode
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 2.7.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

26 WordPress essentials in one plugin. No weight for what you disable, every feature free, no upsell, no tracking.

== Description ==

**One plugin to replace twenty. Free forever.**

I was tired of my WordPress installs looking like a graveyard of single-purpose plugins — one for SEO, one for cache, one for SMTP, one for redirects, one for backups. Each one with its own dashboard, its own freemium dance. So I built Blaminhor Essentials — and I never sell your data.

**Why this plugin exists:**

*   **Every WordPress essential under one roof.** SEO, cache, SMTP, backup, cookie banner, contact forms, calendar, anti-spam, login security, downloads, redirections, broken links, duplicator, database optimizer, domain changer, fatal error recovery, favicon, HTTPS redirect, hide login, image sizes, maintenance mode, mute core emails, post types order, user role editor, classic editor, disable comments. Switch on what you use today; the rest stays out of your way until the day you need it.
*   **Your existing data comes with you.** Switching does not mean starting over: built-in importers for Yoast, Rank Math, All in One SEO, WP Mail SMTP, Post SMTP, Easy WP SMTP, Redirection, Safe Redirect Manager, Custom Taxonomy Order, Favicon by RealFaviconGenerator, and the standalone User Role Editor. The dedicated plugins you've stacked one by one over the years, now in a single coherent toolkit.
*   **No tax for what you don't use.** Each module is independent: an inactive one loads no PHP, registers no hooks, enqueues no assets, runs no queries. You're only paying — in memory and milliseconds — for the features you actually turned on.
*   **Rebuilt on modern PHP.** Since version 2, every module has been re-engineered from the ground up to take full advantage of PHP 8 — strict types, enums and value objects — for tighter security and faster, leaner execution.
*   **Free.** All features above are free. No tracking, no telemetry.
*   **Translated in 11 languages.** English, French, German, Spanish, Italian, Portuguese (Brazil), Japanese, Russian, Turkish, Dutch, Indonesian.
*   **You can email me anytime.** `hi+wp@blaminhor.com`

**Available Features — 26 modules:**

= Performance =
*   **Cache & Performance** — Page cache, asset optimization and lazy load, plus a Web Vitals dashboard and an auto-pilot that benchmarks each speed option on your own pages.

= SEO & Links =
*   **SEO/GEO** — Meta titles and descriptions with SERP preview, XML sitemaps, per-type indexing control, and one-click import from Yoast, Rank Math or All in One SEO.
*   **Redirections** — Simple or regex redirects (301, 302, 307, 410, 451) with hit counters, slug-change detection, and CSV / plugin import (Redirection, Safe Redirect Manager).
*   **Broken Links** — Scan posts, pages and custom post types for dead internal and external links, with live results and one-click fixes.

= Emails =
*   **SMTP Mailer** — Reliable delivery through 12+ providers (Brevo, SendGrid, Mailgun, AWS SES…) with automatic relay fallback, logging, and import from WP Mail SMTP, Post SMTP or Easy WP SMTP.
*   **Mute Core Emails** — Silence WordPress automatic notifications (updates, new users, password changes, comments) individually.

= Security & Maintenance =
*   **Cookie Banner** — Self-hosted consent banner that blocks tracking scripts and embeds until visitors agree, with GDPR/CCPA/LGPD presets, Consent Mode v2, and a 13-month consent log.
*   **Anti-Spam** — Block spam bots on the comment, login, registration and password forms with a hidden honeypot trap, and encode the email addresses shown on your site so harvesters cannot read them — no CAPTCHA, no external service.
*   **Login Security** (Beta) — Lock out brute-force attempts on every sign-in route (login form, XML-RPC, REST API, application passwords) before the password is checked, add two-factor authentication (authenticator app, security key or passkey, emailed code, single-use backup codes) with trusted browsers, alert on sign-ins from unfamiliar devices, enforce a password policy per role, and keep a journal of every attempt with addresses stored hashed. Entirely local, no external service.
*   **Hide Login Page** — Replace wp-login.php with a custom URL and block bots probing the default login.
*   **HTTPS Redirect** — Force HTTPS site-wide with optional mixed-content fixing and an HSTS header.
*   **Fatal Error Recovery** — Recover a crashed site from a secret URL by disabling the culprit plugin, with no FTP access.
*   **Maintenance** — Show a Coming Soon (200) or Maintenance (503) page, with role and IP whitelisting.
*   **User Role Editor** — Create, clone and edit roles and capabilities, with per-user overrides, JSON import/export and one-click import from the standalone User Role Editor plugin.

= Database & Migration =
*   **Backup & Restore** — Scheduled backups of files and database as separate archives, with a safety backup and one-click undo before every restore.
*   **Database Optimizer** — Clean revisions, transients, spam and orphaned data on a schedule, with an at-a-glance size and overhead overview.
*   **Domain Changer** — Change your site domain and update every database reference, including serialized data, in one click.

= Content & Media =
*   **Calendar** (Beta) — Publish events with recurrence, venues, organizers, calendar views, iCal import and RSVP, and run a full booking system for appointments and resource rentals with reminders and Stripe payments.
*   **Forms** (Beta) — Accessible drag-and-drop contact forms with entries stored in the database, no-CAPTCHA spam protection, and GDPR controls.
*   **Downloads** (Beta) — Count how many times each media library file is downloaded, and how many distinct people downloaded it, without recreating your files as anything else. Make documents save instead of opening in a tab, restrict a file to signed-in visitors, chosen roles or a password, and optionally route direct file requests through the counted link so links already shared are covered too. Robots, link previews and repeat clicks are filtered out, and no visitor address is ever stored.
*   **Content Duplicator** — Clone any post, page or custom post type with all fields, taxonomies and child posts; supports every major page builder.
*   **Classic Editor & Widgets** — Restore the classic editor and/or the classic widgets screen, independently.
*   **Image Sizes** — Disable unused thumbnail sizes, register custom ones, and regenerate existing images.
*   **Favicon Generator** — Generate every favicon format (PNG, Apple Touch, Android, Windows tiles) from a single square image, or import an existing set from Favicon by RealFaviconGenerator or the WordPress Site Icon.
*   **Post Types Order** — Reorder posts, pages, custom post types and taxonomies with drag and drop, and import an existing term order from Custom Taxonomy Order.
*   **Disable Comments** — Remove the comment system site-wide and hide it from the admin, reversibly.

== Installation ==

1. Upload the `blaminhor-essentials` folder to the `/wp-content/plugins/` directory.
2. Activate the plugin through the 'Plugins' menu in WordPress.
3. Go to "Blaminhor Essentials" in the admin menu.
4. Turn on the features you need.

== WP-CLI Commands ==

Every module is fully configurable from the command line through the `wp blaminhor ...` namespace — useful for scripts, CI/CD, fixtures, and AI assistants like Claude Code or Cursor. The CLI delegates to the same validation pipeline as the admin UI, so settings stay consistent.

Discover the full command tree:

`wp help blaminhor`
`wp help blaminhor <subcommand>`

Lifecycle:

`wp blaminhor info`
`wp blaminhor modules list [--active-only|--inactive-only] [--category=<slug>]`
`wp blaminhor modules activate <module-id>`
`wp blaminhor modules deactivate <module-id> [--yes]`

A few examples per module (full reference: see the bundled `llms.txt`):

* SMTP: `wp blaminhor smtp add-relay --name=Gmail --host=smtp.gmail.com --port=587 --encryption=tls --from-email=hello@example.com`, `wp blaminhor smtp test --to=admin@example.com`
* Redirections: `wp blaminhor redirections add --source=/old --target=/new`, `wp blaminhor redirections list --search=/blog`
* SEO/GEO: `wp blaminhor seo set --sitemap-enabled=true --ai-block-chatgpt=true`, `wp blaminhor seo list-urls`
* Maintenance: `wp blaminhor maintenance enable --headline="Be right back"`, `wp blaminhor maintenance disable`
* HTTPS Redirect: `wp blaminhor https-redirect enable --hsts=true`
* Database Optimizer: `wp blaminhor db-optimizer scan`, `wp blaminhor db-optimizer clean --tasks=revisions,spam_comments`
* Login Security: `wp blaminhor login-security unlock 203.0.113.7`, `wp blaminhor login-security reset-2fa admin`
* Cache: `wp blaminhor cache purge`, `wp blaminhor cache status`
* Backup: `wp blaminhor backup list`, `wp blaminhor backup delete <prefix> --yes`

All listing commands accept `--format=table|json|csv|yaml|count|ids` for scripting. Mutating commands require `--user=<admin-login>` for the capability check. Sensitive values (SMTP passwords, recovery keys) are never printed in cleartext.

The Backup module exposes `list` and `delete` only — creating and restoring a backup remain admin-only, where the stepped AJAX flow avoids PHP timeouts and the pre-restore safety net runs.

== Frequently Asked Questions ==

= Will activating all features slow down my site? =
No. Each module only loads its code when activated. Disabled modules have zero impact on performance — no PHP loaded, no hooks registered, no queries run.

= Is it really free? =
Yes, genuinely free. Every module and every feature ships in the single free download — no expiring trial, no ads in your dashboard, nothing held back for a paywall. I don't track you and I don't sell your data. If it saves you time, a kind review is all I ask.

= What are the requirements? =
WordPress 6.2 or newer and PHP 8.1 or newer. It runs fine on standard shared hosting: heavy jobs like backups and link scans are processed in small batches to avoid timeouts, and no background service or special server access is required.

= Can I replace multiple plugins with this one? =
Yes, that's the main goal. Blaminhor Essentials can replace Redirection, Yoast/Rank Math, WP Mail SMTP, UpdraftPlus, Duplicate Post, User Role Editor, Limit Login Attempts, WP 2FA, and many others.

= Will it conflict with my existing SEO, cache or SMTP plugin? =
Every module is off by default and independent, so installing the plugin changes nothing until you switch something on. The one thing to avoid is running two plugins that do the same job — two SEO plugins, or two page caches — since they can clash. The clean path is to import your data into the matching module, then deactivate the old plugin.

= How do I migrate my data from other plugins? =
Several modules include import features, so you don't lose your existing setup:
- **SEO**: Import titles, descriptions and keywords from Yoast SEO, Rank Math or All in One SEO.
- **SMTP**: Import from WP Mail SMTP, Post SMTP or Easy WP SMTP.
- **Redirections**: Import from the Redirection plugin, Safe Redirect Manager or a CSV file.
- **Post Types Order**: Import your saved term order from Custom Taxonomy Order.
- **Favicon**: Import an existing favicon set from Favicon by RealFaviconGenerator, or from the WordPress Site Icon.
- **User Role Editor**: Import roles and custom capabilities from the standalone User Role Editor plugin, or from a JSON export.

= Does the plugin send my data to external servers? =
No. Everything runs on your own server by default — no telemetry, no usage tracking. The only data that ever leaves your site is what you set up yourself: the SMTP module sends your emails through the relay you choose, the Cache module can run a Google PageSpeed audit when you click the button, and Fatal Error Recovery can email me the errors this plugin causes if you switch that option on. Nothing else.

= What exactly is sent if I turn on error reports? =
That option lives in Fatal Error Recovery → Settings and is off until you tick it. Once on, an error raised inside a Blaminhor Essentials file is emailed to me so I can fix it; errors from other plugins or from your theme are never sent. A report contains the error message, the file and line inside the plugin, and the plugin, WordPress and PHP versions. File paths, email addresses, IP addresses and credentials are stripped out first, and your site address is never included — only a one-way identifier that cannot be traced back to your site. The same error is reported once per plugin version, five reports per version at most. Untick the option and everything stops immediately.

= What happens to my settings if I deactivate or uninstall the plugin? =
Your data is safe by default. Deactivating keeps every setting untouched, so you can switch the plugin back on right where you left off. Even deleting the plugin removes nothing unless you first turn on the "Delete all data on uninstall" option — and your posts, pages and media are never touched either way. If you do opt in, uninstalling cleans up the plugin's own options, tables and files so nothing is left behind.

= If I turn off a module, do I lose its data? =
No. Turning a module off only stops it from running — your redirects, SEO meta, form entries and settings are all kept, so you can switch it back on later exactly as it was. Data is only removed if you delete the whole plugin with the "Delete all data on uninstall" option enabled.

= Can I back up my entire site? =
Yes. The Backup module creates separate archives for database, plugins, themes and uploads. You can schedule automatic backups (daily, weekly, monthly) and set retention limits.

= What happens if a backup restore goes wrong? =
The plugin automatically creates a safety backup before any restore. If something goes wrong, you can undo it with one click.

= Does the SMTP module support multiple providers? =
Yes. You can configure multiple relays with automatic fallback. If the primary one fails, it tries the next in your list.

= Can I duplicate Elementor/Divi pages? =
Yes. The Content Duplicator fully supports all major page builders, including Elementor, Divi, Beaver Builder, Brizy and Oxygen.

= Can I control which user roles can access certain features? =
Yes. For example, the Post Types Order module lets you choose which roles can reorder content (Administrator, Editor or Author), and the User Role Editor gives you fine-grained control over every capability.

= What if my site crashes after a plugin update? =
The Fatal Error Recovery module detects PHP fatal errors and gives you a secret recovery URL to deactivate the problematic plugin — no FTP access needed.

= What languages is the plugin available in? =
Eleven. English, French, German, Spanish, Italian, Brazilian Portuguese, Japanese, Russian and Turkish are fully translated; Dutch and Indonesian are partially translated, with anything untranslated falling back to English.

= Does the plugin work with multisite? =
Yes, on a per-site basis. Each site keeps its own settings, its own database tables and its own backups (Backup, Domain Changer and Database Optimizer store archives in a separate per-site folder), so sites stay fully isolated. Network activation, deactivation and uninstall apply cleanly to every site, and sites created later are set up automatically. Two notes: server-level browser cache and GZIP rules live in the shared root .htaccess and are managed by a network administrator (PHP page caching still applies on every site); and there is no central Network Admin screen yet, so you configure each site from its own dashboard.

= How can I get support? =
Email me at hi+wp@blaminhor.com or visit [wp.blaminhor.com](https://wp.blaminhor.com/). You can also use the feedback form on the plugin dashboard.

== Screenshots ==

1. Modular dashboard – Enable only the modules you need, organised by category with instant activation.
2. Cache & Performance – Overview of your whole cache stack, with an auto-pilot that tests each speed option on your real pages.
3. SEO/GEO – Manage meta titles and descriptions for all your content from one place, with at-a-glance optimisation status.
4. SMTP Mailer – Send through several relays with automatic fallback when one provider fails.
5. Backup & Restore – Choose exactly what to back up: database, plugins, themes and uploads.
6. Database Optimizer – See your database size and overhead, then clean and optimise in one click.
7. Fatal Error Recovery – Recover a crashed site from a secret recovery URL, with no FTP access.
8. Image Sizes – Review every registered thumbnail size and disable the ones you do not use.
9. User Role Editor – Edit capabilities per role, search, and add or clone roles.
10. Cookie Banner – GDPR consent banner with jurisdiction presets, layout and appearance controls.

== Changelog ==

= 2.7.2 =
* Fixed: Maintenance - Administrators keep access to the front-end while maintenance or coming-soon mode is on, as the Access tab states.

= 2.7.1 =
* Fixed: Backup & Restore - Downloading a large backup no longer fails at the very end, and the saved archive opens correctly.
* Improved: Backup & Restore - Backup downloads can be paused and resumed, and one that starts before your session ends finishes on its own.
* Fixed: Content Duplicator - The "Original title" option now works: it was listed in the settings but never applied, so the title was always copied.
* Added: Core - WP-CLI now covers every module, from download counters and link scans to database backups, consent exports and per-file access rules.
* Fixed: Core - WP-CLI no longer clears settings it was not asked to touch, among them the off-site backup destination, certificate expiry monitoring and delivery-failure alerts.
* Fixed: Core - WP-CLI commands that stopped with an error now work, including single-URL checks, item reordering and favicon generation.

= 2.7.0 =
* New module: Downloads (Beta) - Know what actually gets downloaded from your media library, and decide who can:
    - Total and unique download counts per file, with robots, link previews and repeat clicks filtered out, and no visitor address ever stored.
    - Documents save to disk instead of opening in a browser tab.
    - Any file restricted to signed-in visitors, to chosen roles, or behind a password.
    - Direct file requests routed through the counted link, so links already shared stay covered.
* Added: Login Security - Copies the authenticator key and the backup codes to the clipboard in one click.
* Improved: Login Security - Opens on Statistics so recent sign-in activity comes first, with settings next.
* Improved: Login Security - The two-factor tab now shows whether your own account is protected and links straight to where you set it up.
* Fixed: Core - Saving settings from a tab now returns to that tab instead of the first one, and reloading the page no longer asks to resend the form.
* Fixed: Core - The "Settings saved" confirmation is no longer lost when saving Broken Links, Database Optimizer, User Role Editor or Cookie Banner settings.
* Fixed: Anti-Spam - Saving from the email protection tab no longer sends you back to the first tab.
* Fixed: Login Security - Turning off a two-factor method now hides it from the profile screen as described, and it can no longer be set up once disabled.
* Fixed: Login Security - The sign-in challenge no longer overlaps the trust-this-browser checkbox with the confirmation button.

= 2.6.0 =
* New module: Login Security (Beta) - Everything that guards the front door, on your own site with no external service:
    - Brute-force throttling across the login form, XML-RPC, the REST API and application passwords.
    - Two-factor sign-in: authenticator app, security key or passkey, emailed code and single-use backup codes, with trusted browsers.
    - A password policy and sign-in alerts, plus a privacy-friendly journal of every attempt with hashed addresses.
    - WP-CLI unlock and second-factor reset, an IP allowlist and a wp-config.php switch so you can never lock yourself out.
* Improved: Core - Confirms compatibility with WordPress 7.1, including the always-iframed post editor, client-side media processing and the persistent editor toolbar.
* Improved: Hide Login Page - Points to the Login Security module for brute-force throttling, two-factor authentication and a sign-in journal.

Older versions (2.5.14 and earlier) are archived in `changelog.txt` shipped with the plugin.


== Upgrade Notice ==

= 2.7.2 =
Restores front-end access for administrators while maintenance or coming-soon mode is on: previewing your site no longer shows the maintenance page instead of your content.

= 2.7.1 =
Fixes large backup downloads, and stops WP-CLI from clearing settings it was not asked to touch — including the off-site backup destination, certificate expiry monitoring and delivery-failure alerts. Adds WP-CLI coverage across every module.

= 2.7.0 =
New Downloads module (Beta): count total and unique downloads for your media files, force them to save instead of opening, and restrict any file to signed-in visitors, chosen roles or a password. Plus tab-navigation and two-factor fixes across the plugin.

= 2.6.0 =
New Login Security module (Beta): brute-force throttling across every login route, two-factor sign-in (authenticator app, passkey, email or backup codes), a password policy, sign-in alerts and a privacy-friendly journal — all on your own site, no external service.

= 2.5.14 =
Patch with security fixes: backups and database exports move to a folder that cannot be guessed from a URL, form webhooks can no longer reach private network addresses, and SVG uploads are always refused. Also fixes restores on hosts that cap PHP execution time.

= 2.5.13 =
Patch: backups no longer die with a fatal error on hosts that cap PHP execution time — a run now continues over several passes and picks up where it stopped. Also fixes restores failing on those same hosts, and cuts memory use when exporting a large database.

= 2.5.12 =
Patch: the pre-update backup was never created before WordPress core updates — it now is, whatever starts the update. The retention limit also applies to backups made from the admin screen, and an interrupted backup is flagged instead of being offered for restore.

= 2.5.11 =
Patch: fixes a fatal error on activation under PHP 8.1, makes imported Yoast, Rank Math and All in One SEO title/description variables render properly, and carries site-wide SEO defaults over during import. Safe maintenance update.

= 2.5.10 =
Fatal Error Recovery gains a 90-day history of the crashes it caught, dates them in plain language, and can prepare a redacted crash report in one click. It can also report this plugin's own errors to me automatically, if you switch that option on. Fixes fatal errors on URLs without a path.

= 2.5.9 =
Patch: fixes the Save button staying disabled when your only change in a settings screen is deleting something — like removing a booking time slot or closing an open day in the calendar.

= 2.5.8 =
Patch: fixes a rare fatal error that could take down the front end when a request arrived with a malformed URL while 301 redirections were active.

= 2.5.7 =
Patch: the WP-CLI resource list now reports each resource's real stock, and the appointment date in the booking recap follows the site's language rather than the visitor's browser. Safe maintenance update.

= 2.5.6 =
Security hardening across several modules (SSRF, CSV export safety, multisite capability guard, recovery-key protection), a full WP-CLI command suite, and calendar improvements. Recommended for all sites.

= 2.5.5 =
The booking calendar's service editor is clearer: each service is its own card with proper on/off toggles, and the online-meeting option only appears — and reads sensibly — for services that can take place online.

= 2.5.4 =
Patch: venues can show a map on the event page, clients can book a recurring series of appointments, events can sell multiple ticket tiers with promo codes, and both Forms and the Calendar are now fully manageable from WP-CLI.

= 2.5.3 =
Calendar settings are reorganised into one tab per scheduling type (appointments, events, bookables) with a section menu, and you gain event sign-up approval, a bookable waitlist, and a sign-up cutoff before events.

= 2.5.2 =
Patch: the client self-service space (reschedule and cancel, no account) is now on by default on new sites, the booking-form consent wording is clearer, and the Calendar settings tabs are tidier — key options stay visible while secondary ones tuck away.

= 2.5.1 =
Patch release: security and reliability hardening across modules (Fatal Error Recovery, Maintenance, SMTP, User Role Editor, Backup, Calendar), plus Calendar emails and labels that follow your site language and rate-limited public forms.

= 2.5.0 =
New Calendar module (Beta): publish events with RSVP and run a full online booking system — appointments, resource rentals, reminders and Stripe payments. Plus SFTP backups via SSH key and a clearer, more accessible dashboard. Recommended.

