=== Clicks Admin Toolkit ===
Contributors: sykologicist
Tags: admin enhancements, duplicate post, svg upload, disable xmlrpc, limit login attempts
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

139+ toggleable WordPress admin modules for security, speed, SEO, SMTP, WooCommerce, and UX. One plugin. Zero overhead.

== Description ==

**Clicks Admin Toolkit packs 139+ toggleable modules into a single high-speed dashboard — replacing 20 to 30 plugins with zero performance overhead.**

Every module is 100% free with zero upsells, zero locked features, and zero nag banners.

= The Problem Solved =

Standard WordPress sites install dozens of single-purpose plugins for post cloning, SVG uploads, SMTP mail, login throttling, emoji removal, maintenance mode, redirects, and WooCommerce tweaks — slowing wp-admin with bloated scripts and background queries.

Clicks Admin Toolkit replaces them all with one lightweight suite that stores all settings in a single autoloaded database row.

= High-Performance Architecture =

* **Zero Overhead**: Inactive modules are never loaded; zero hooks registered.
* **Single Database Row**: All 139+ module states live in `sasuite_settings`, costing one query during bootstrap.
* **Native APIs**: Built on WordPress Settings, Media Library, Transients, and WP_Filesystem.

= 7 Executive Dashboard Widgets =

1. **File Integrity Radar**: Monitors core, themes, and plugins against SHA-256 hashes.
2. **Brute-Force & Login Radar**: Displays throttled IPs and failed login attempts.
3. **Outbound Mail Deliverability**: Tracks sent vs failed emails and SMTP connectivity health.
4. **Admin Activity Stream**: Audit trail of post edits, role changes, and plugin toggles.
5. **Broken Links Sentinel**: Summarizes 404 links and broken external hyperlinks.
6. **Database Health Inspector**: Overview of database overhead with 1-click cleanup.
7. **REST API Traffic Monitor**: Live counter of REST requests and blocked scrapers.

= 1-Click Starter Preset Packs =

* **Agency Starter**: Cleans wp-admin, suppresses update nags, enables duplicate post, and clean filenames.
* **Maximum Security Shield**: REST rate limiting, comment honeypot, user enum blocking, and XML-RPC disabling.
* **Speed & Core Web Vitals**: Strips emojis and query strings; throttles Heartbeat; enables lazy-loading.
* **High-Converting Store Pack**: Direct checkout, sticky buy bar, free shipping progress bar, and order notes.

= Complete Breakdown of All 139+ Modules by Category =

**📂 Content & Media (22 Modules)**

* **Duplicate Post / Page / CPT**: 1-click clone posts, pages, or CPTs into draft.
* **Safe SVG Uploads & Sanitizer**: XML-sanitized SVG uploads preventing XXE and XSS.
* **Media File In-Place Replacement**: Replace media files preserving attachment IDs and URLs.
* **Media Categories & Taxonomies**: Adds categories and tags to the Media Library.
* **Restrict Media to Own Uploads**: Authors only see their own uploaded media.
* **Drag & Drop Post Reordering**: Reorder posts, pages, and CPTs via drag-and-drop.
* **Enable Page Excerpts**: Native excerpt support on standard WordPress pages.
* **External Links in New Tab**: Adds target="_blank" and rel="noopener" to outbound links.
* **Auto Image Alt & Title Fallback**: Fills empty image alt/title tags from titles.
* **Clean Image Filename Sanitizer**: Converts upload filenames into clean lowercase SEO slugs.
* **Editorial Publishing Calendar**: Visual calendar for drafts, scheduled, and published posts.
* **Bulk Image WebP Compressor**: Lossless compression with automatic WebP conversion on upload.
* **Broken Link Checker & Crawler**: Link crawler with 1-click broken link fixes.
* **301/302 Redirect Manager & 404 Log**: Slug change redirects and 404 error logs.
* **Enhanced Password Protected Pages**: Branded layout for password-protected post pages.
* **Disable Gutenberg Per Post Type**: Selectively restores Classic Editor per post type.
* **Lightweight Social Share Buttons**: SVG share buttons for X, Facebook, WhatsApp.
* **Reading Time Estimator**: Displays calculated reading duration badge on articles.
* **Custom Post Statuses**: Custom workflow statuses like In Review or Approved.
* **Media EXIF & GPS Metadata Stripper**: Strips camera metadata and GPS coordinates on upload.
* **Automatic Image Watermarking**: Applies PNG watermark logos to uploaded media.
* **Smart 404 Auto-Redirect**: Redirects 404s to closest matching published slug.

**📂 Admin UI & Menus (11 Modules)**

* **Admin Menu Organizer**: Rename, reorder, or hide admin menu items.
* **Admin Toolbar Cleaner**: Strips WP logo, comments, updates, and greeting.
* **Custom Admin Favicon**: Dedicated wp-admin favicon via WordPress Media Library.
* **Custom Admin Columns**: Add Post ID, Featured Image, and Slug columns.
* **Show Last Modified Date & Author**: Displays last modified timestamp and editor in tables.
* **Sticky List Table Headers**: Pins column headers while scrolling long tables.
* **Wider Admin List Tables**: Expands admin tables to full widescreen width.
* **Admin Footer Customizer**: Customize or hide admin footer copyright text.
* **Admin Dark Mode**: High-contrast dark theme across WordPress backend.
* **Custom Admin Bar Quick Links**: Add custom shortcuts and support links to toolbar.
* **Admin Bookmark & Favorites Sidebar**: Pin favorite admin pages with star icons.

**📂 Dashboard & Notice Control (11 Modules)**

* **Admin Notice Drawer**: Collapses plugin notices into a slide-out tray.
* **Disable Notices by Role**: Suppress plugin banners for non-administrator roles.
* **Disable Gutenberg Fullscreen**: Keeps admin sidebar visible when editing blocks.
* **Disable Default Dashboard Widgets**: Turn off Welcome Panel, Quick Draft, and Events.
* **Custom Dashboard Welcome Widget**: Branded rich-text welcome notices for client onboarding.
* **Highlight Duplicate Titles**: Warning badges when posts share identical titles.
* **Disable Block Directory Search**: Stops Block Editor from querying WordPress.org blocks.
* **Admin Quick Search (Ctrl+K)**: Instant spotlight search to jump to settings.
* **Disable Update Nag for Non-Admins**: Hides core update notices from non-administrators.
* **Quick Frontend/Backend Switcher**: 1-click button to jump between view and edit.
* **Custom Broadcast Notice Creator**: Broadcast targeted admin announcements by role.

**📂 Login, 2FA & Access Control (14 Modules)**

* **Custom Secret Login URL**: Move wp-login.php to custom slug to block bots.
* **Custom Login Page Styler**: Brand login screen with custom logo and colors.
* **Limit Login Attempts & IP Lockout**: Throttles failed attempts and blocks abusive IPs.
* **Email-Only or Username-Only Login**: Restrict login identifiers to prevent credential guessing.
* **Role-Based Login Redirects**: Custom landing URLs for users after login.
* **Role-Based Logout Redirects**: Custom landing URLs for users upon logout.
* **Two-Factor Authentication (2FA TOTP)**: RFC 6238 TOTP 2FA for Authenticator apps.
* **Emergency 2FA Recovery Codes**: Single-use backup keys for 2FA account recovery.
* **Hide Login Screen Links**: Hides password reset and back to blog links.
* **Auto-Logout Idle Sessions**: Automatically terminates inactive user sessions after timeout.
* **Login Cloudflare Turnstile & reCAPTCHA**: Bot protection on login and registration forms.
* **One-Time Magic Login Links**: Cryptographic single-use links for client login.
* **Login Lockout Countdown**: Live countdown timer on wp-login.php during lockout.
* **Session Timeout Warning Modal**: Inactivity warning modal with stay logged in button.

**📂 Security & Hardening (15 Modules)**

* **Disable XML-RPC**: Blocks xmlrpc.php against brute-force attacks and DDoS.
* **Hide WordPress Version**: Removes version generator tags from head and scripts.
* **Disable File Editor**: Enforces DISALLOW_FILE_EDIT to block file editing.
* **Anti-Spam Comment Honeypot**: Invisible honeypot catches spam bots without CAPTCHAs.
* **Block Author Enumeration**: Blocks /?author=N scans and user enumeration scans.
* **Restrict REST API**: Locks down REST API endpoints to authenticated users.
* **Admin Login Alert from New IP**: Email alerts when admin logs in from new IP.
* **Obscure Login Errors**: Replaces login errors with generic credentials notice.
* **Disable Self-Pingbacks**: Stops WordPress from sending self-pingback requests.
* **Disable Application Passwords**: Prevents application password generation for non-admins.
* **Content Security Policy (CSP) Manager**: GUI builder for CSP and security headers.
* **File Change & Integrity Monitor**: Scans core, theme, and plugin files for modifications.
* **Right-Click & Copy Protection**: Disables text selection, right-click, and copy shortcuts.
* **REST API Rate Limiter**: Throttles abusive REST requests returning HTTP 429.
* **Disposable Burner Email Blocker**: Blocks registrations and checkouts from burner emails.

**📂 Speed & Performance (11 Modules)**

* **Disable Emojis & DNS Prefetch**: Removes core emoji scripts and DNS prefetch calls.
* **Heartbeat API Controller**: Throttles background Heartbeat AJAX from 15s to 120s.
* **Limit Post Revisions**: Caps revision count per post type to save database space.
* **Autosave Interval Controller**: Extends autosave interval to slash server write load.
* **Clean Up <head> Junk**: Removes RSD, WLW manifest, shortlinks, and generator tags.
* **Disable RSS / Atom Feeds**: Disables RSS feeds with homepage redirect if unused.
* **Defer JavaScript**: Defers non-essential scripts for higher PageSpeed scores.
* **Remove Query Strings**: Strips ?ver= query strings to improve CDN caching.
* **Disable Frontend Dashicons**: Prevents dashicons.min.css from loading for visitors.
* **Disable Legacy jQuery Migrate**: Removes unnecessary legacy jQuery script on modern themes.
* **Native Lazy Loading Engine**: Injects native loading="lazy" on images and iframes.

**📂 WooCommerce Enhancements (19 Modules)**

* **Disable Marketplace Nags**: Strips marketplace suggestions, inbox tips, and promo banners.
* **Show Product Thumbnail & SKU**: Displays thumbnails and SKUs in Orders list table.
* **Direct Checkout (Skip Cart)**: Redirects Add to Cart directly to Checkout.
* **Auto-Complete Virtual Orders**: Automatically marks virtual and downloadable orders Completed.
* **Hide Shipping When Free Available**: Hides paid shipping rates once free shipping applies.
* **Custom "Add to Cart" Text**: Customize button text globally or by product type.
* **One-Click Empty Cart Button**: Adds clear cart action button on Cart page.
* **Delete Expired Coupons & Transients**: 1-click purge for expired promo coupons and carts.
* **Custom Currency Symbol & Position**: Custom currency symbol display and positioning.
* **Custom Thank You Redirection**: Redirect buyers to custom landing pages post-purchase.
* **WooCommerce Quick Order Notes**: Inline modal to view and add private order notes.
* **Low Stock Alert System**: Automated email alerts when inventory falls below threshold.
* **Minimum Order Amount Enforcer**: Blocks checkout if cart subtotal is below minimum.
* **Sticky Mobile "Buy Now" Bar**: Fixed bottom checkout bar on mobile product pages.
* **GeoIP Multi-Currency Switcher**: Auto-detects customer currency with live exchange rates.
* **Free Shipping Progress Bar**: Progress bar showing amount needed for free shipping.
* **Slide-Out Cart Drawer**: AJAX mini-cart drawer opening on Add to Cart.
* **WooCommerce Test Order Generator**: Generate mock test orders with customer data.
* **Custom Order Statuses**: Registers custom workflow statuses like Awaiting Pickup or Shipped.

**📂 User Management & Roles (10 Modules)**

* **User Last Login Tracker**: Displays last login timestamp and IP in Users table.
* **Force Password Change on Next Login**: Requires users to reset password on login.
* **Disable New User Admin Emails**: Stops admin notifications from high-volume user signups.
* **Hide Admin Bar by Role**: Removes admin toolbar on frontend for specific roles.
* **Restrict /wp-admin/ by Role**: Redirects non-admin roles away from wp-admin to account.
* **Secure 1-Click User Switcher**: Switch between user accounts with HMAC SHA-256 tokens.
* **Enforce Display Name Format**: Sets public display names to full names, hiding usernames.
* **Terminate All Active Sessions**: 1-click logout for all sessions across any account.
* **Prevent Password Reset by Role**: Disables password resets for restricted membership roles.
* **Default Registration Role Override**: Enforces specific default roles for new user signups.

**📂 Email & SMTP Delivery (11 Modules)**

* **Built-in SMTP Mailer**: Custom SMTP host, port, SSL/TLS, and authentication.
* **From Name & Email Override**: Enforces sender name and email on outgoing emails.
* **Outbound Email Logger**: Logs every wp_mail() call with recipients and subject.
* **Live SMTP Test Sender**: 1-click diagnostic email sender with real-time feedback.
* **HTML Email Wrapper Template**: Wraps notifications in a responsive HTML layout.
* **Disable Auto-Update Emails**: Suppresses core, theme, and plugin update notifications.
* **Disable Comment Moderation Emails**: Stops comment notification emails sent to administrators.
* **Alert on Profile/Email Change**: Security alerts when user profile email addresses change.
* **BCC Admin on System Emails**: Blind-copy administrator on system notifications.
* **Custom Email Header Logo**: Injects brand logo into outgoing email headers via Media.
* **Granular Email Suppression**: Selectively suppress specific system emails without code.

**📂 Utilities & Maintenance (15 Modules)**

* **Maintenance & Coming Soon Mode**: Maintenance screen with HTTP 503 headers and whitelist.
* **Site Master Password Gate**: Protects entire website behind a password with session expiry.
* **System Health Inspector**: Server overview: PHP memory, MySQL version, upload limits.
* **1-Click Database Optimizer**: Cleans expired transients, spam comments, and trash.
* **Safe Database Search & Replace**: Safe serialized string replacement with dry-run preview.
* **Admin Activity Audit Log**: Tracks admin actions: plugin toggles and settings changes.
* **Floating Scroll to Top Button**: Customizable back-to-top button on frontend and admin.
* **Clear Cache Toolbar Button**: Instant transient and object cache purge button in toolbar.
* **HTTP 503 Maintenance Header**: Sends proper Service Unavailable header during maintenance.
* **Settings JSON Export & Import**: 1-click backup and migration of module configurations.
* **Scheduled Database Cleanup (Cron)**: Automated background maintenance for transients and trash.
* **Cookie Consent & GDPR Banner**: Accessible GDPR/CCPA cookie notice banner.
* **Multisite Network Sync**: Synchronize module settings across network sites in 1-click.
* **Plugin Auto-Rollback**: Automated failsafe against fatal errors caused by updates.
* **1-Click Database Backup**: Compressed SQL database backups with optional email delivery.

= Enterprise-Grade Security =

* **HMAC SHA-256 Tokens** for secure user switching.
* **DOMDocument XML Sanitizer** with LIBXML_NONET for safe SVG uploads.
* **WP_Filesystem API** for all disk operations — no eval() or move_uploaded_file().
* **Strict Nonces & Permissions** on every AJAX action and setting save.
* **Complete Output Escaping** across every rendered admin view.

= Who Is This Plugin For? =

* **Agencies & Freelancers**: Configure once, export JSON presets, and deploy across client sites in seconds.
* **WooCommerce Stores**: Direct checkout, mobile sticky buy bars, free shipping bars, and cart drawers.
* **Publishers & Creators**: Organize media taxonomies, replace images in-place, and plan with an editorial calendar.
* **Security & Speed Seekers**: 2FA TOTP, rename login URL, throttle REST abuse, and eliminate script bloat.

= 100% Free & Open Source =

GPLv2 licensed. No Pro version, no locked features, and no trial periods.

= Built by Clicks =

Clicks Admin Toolkit is maintained by **Rayhan Bajwa** ([@rayhan.bajwa](https://instagram.com/rayhan.bajwa)) and **[Clicks](https://clicks.com.pk)**.

* **Website:** [clicks.com.pk](https://clicks.com.pk)
* **Plugin Page:** [clicks.com.pk/clicks-admin-toolkit](https://clicks.com.pk/clicks-admin-toolkit)

== External services ==

This plugin conditionally connects to third-party services only if explicitly enabled:

1. **Cloudflare Turnstile** (Optional — Login CAPTCHA module)
* **Domain:** `https://challenges.cloudflare.com`
* **Purpose:** Bot and abuse protection on login and registration forms.
* **Data sent:** Verification token, client IP address, site key.
* **Terms of Service:** https://www.cloudflare.com/terms/
* **Privacy Policy:** https://www.cloudflare.com/privacypolicy/

2. **Google reCAPTCHA** (Optional — Login CAPTCHA module)
* **Domain:** `https://www.google.com`
* **Purpose:** Spam and bot protection on login and registration forms.
* **Data sent:** Interaction response token, client IP address, site key.
* **Terms of Service:** https://policies.google.com/terms
* **Privacy Policy:** https://policies.google.com/privacy

== Installation ==

1. Upload the `clicks-admin-toolkit` folder to the `/wp-content/plugins/` directory, or install directly via **Plugins > Add New > Upload Plugin**.
2. Activate the plugin through the **Plugins** screen in WordPress.
3. Navigate to **Clicks Admin Toolkit** in your WordPress admin sidebar.
4. Toggle any of the 139+ modules ON, configure its options in the slide-out drawer, and click **Save Changes**.
5. Use **Ctrl+K** or the search bar to instantly find any tool.

== Frequently Asked Questions ==

= How many modules does Clicks Admin Toolkit include? =
Clicks Admin Toolkit includes 139+ individually toggleable modules across 10 categories: Content & Media (22), Admin UI & Menus (11), Dashboard & Notices (11), Login, 2FA & Access (14), Security & Hardening (15), Performance & Cleaner (11), WooCommerce Polish (19), User Roles & Control (10), Email & Notifications (11), and Utilities & Maintenance (15).

= Does activating dozens of modules slow down my site? =
No! The plugin uses a zero-overhead conditional loader. Disabled modules are never loaded into PHP memory — their files are never included and their hooks are never registered. All settings are stored in a single autoloaded database row, so enabling 1 module or 139 modules costs the exact same: one lightweight database query.

= Is it compatible with WooCommerce? =
Yes! Category 7 includes 19 dedicated WooCommerce modules (GeoIP multi-currency switcher, slide-out cart drawer, sticky buy bar, free shipping progress bar, direct checkout, custom order statuses, quick order notes, etc.). These modules only run when WooCommerce is active.

= Can I export my configuration and import it on another site? =
Yes! Use the built-in Settings Export & Import modal or 1-Click Starter Presets to copy your entire configuration as a JSON string and import it onto any WordPress site running Clicks Admin Toolkit.

= Does this plugin run arbitrary PHP code or use eval()? =
No. In strict compliance with WordPress.org security policies, this plugin does not use eval(), exec(), shell_exec(), move_uploaded_file(), or arbitrary code evaluation.

= Is PHP 8.x and WordPress 7.x supported? =
Yes! Fully tested and verified on PHP 7.4 through 8.3+ and WordPress 6.0 through 7.1+.

= What happens if I deactivate the plugin? =
All behaviors cleanly revert to WordPress defaults. No core files, tables, or posts are modified. Your settings remain safely preserved in the database if you reactivate later.

= Is there a paid or Pro version? =
No. All 139+ modules are 100% free and fully unlocked with zero restrictions, zero upsells, and zero advertisements.

== Screenshots ==

1. **Modular Dashboard with 139+ Tools** — All modules organized across 10 tabbed categories with instant toggle switches and configuration drawers.
2. **Native Media Library Configuration Drawers** — Slide-out option panels with WordPress Media Library pickers, color inputs, and live previews.
3. **Admin Notice Drawer & Bell Tray** — Floating notification bell that captures all third-party plugin nags and banners into a clean slide-out tray.
4. **Maintenance Mode & Site Password Gates** — Stylish frontend access screens with custom branding, HTTP 503 headers, and master password protection.
5. **Database Optimizer & Transient Cleaner** — One-click AJAX cleanup for expired transients, spam comments, trashed posts, and orphaned metadata.
6. **Built-in SMTP Mailer & Live Test Sender** — Complete outbound email configuration with SSL/TLS encryption and instant diagnostic test emails.

== Changelog ==

= 1.1.0 =
* Major expansion: Added 39 new production-grade modules, expanding the toolkit to 139+ tools.
* Added 7 Executive Dashboard Widgets on wp-admin: File Change Monitor, Login Radar, Outbound Mail Deliverability, Activity Stream, Broken Link Checker, Database Health Inspector, and REST Rate Limiter.
* Added 1-Click Starter Preset Packs: Agency Starter, Maximum Security Shield, Speed & Core Web Vitals, and High-Converting Store Pack.
* Added GeoIP Multi-Currency Switcher with live exchange rate sync and customizable currency flags.
* Added WooCommerce Conversions suite: Slide-Out Cart Drawer, Sticky Buy Now Bar, Free Shipping Progress Bar, Custom Order Statuses, and Quick Order Notes.
* Added Advanced Security modules: REST API Rate Limiter, File Integrity & Change Monitor, Disposable Email Blocker, Content Security Policy (CSP) Manager, and Session Timeout Inactivity Modal.
* Added Content & Workflow tools: Editorial Publishing Calendar, Smart 404 Auto-Redirects, 301/302 Redirect Manager, Broken Link Checker, and Image Lossless Compressor.
* Added Maintenance & Reliability tools: Automated Scheduled DB Optimizer, Database Backup & Snapshot Generator, and Plugin/Theme Auto-Rollback safeguard.
* Added interactive "What's New in v1.1.0" announcement modal with 1-click dismiss.
* Enhanced Limit Login Attempts with dedicated IP Whitelisting and lockout countdown on wp-login.php.
* Verified 100% WordPress.org coding standard compliance with zero security flags.

= 1.0.3 =
* Initial public release with 100+ free modular administration tools.
* 10 organized categories: Content, Admin UI, Dashboard, Login, Security, Performance, WooCommerce, Users, Email, Utilities.
* Zero-overhead conditional module loader — disabled modules are never loaded.
* Single autoloaded database row for all 100+ module configurations.
* DOMDocument SVG XML sanitizer with LIBXML_NONET XXE prevention.
* HMAC SHA-256 cryptographic tokens for secure user switching.
* Native WordPress Media Library integration for all image/asset fields.
* Full WordPress.org automated review compliance.
* PHP 7.4 – 8.3 and WordPress 6.0 – 7.1+ compatibility.

== Upgrade Notice ==

= 1.1.0 =
Major feature upgrade: 39 new modules (139+ total), 7 executive dashboard widgets, 1-click starter presets, GeoIP multi-currency switcher, slide-out cart drawer, REST rate limiter, and scheduled DB cleanup. Seamless upgrade with no breaking changes.

= 1.0.3 =
Initial stable release. Install to access 100+ zero-overhead modular WordPress administration, security, speed, and WooCommerce tools — all completely free.
