Smart Admin Assistant is a free, modular WordPress admin toolkit. It brings the small fixes most sites install one plugin at a time into one lightweight plugin: change the login URL, limit login attempts, duplicate posts and pages, hide the admin bar, hide admin notices, disable comments, switch to
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 5.9 and PHP 7.4.
SourceWordPress plugins · Nov 14, 2026
01 / Source details
Aboutthistool.
Smart Admin Assistant is a free, modular WordPress admin toolkit. It brings the small fixes most sites install one plugin at a time into one lightweight plugin: change the login URL, limit login attempts, duplicate posts and pages, hide the admin bar, hide admin notices, disable comments, switch to the Classic Editor, allow SVG uploads safely, add security headers, cache pages and put the site in coming soon mode.
Every module is off until you switch it on, and a module that is switched off loads no code. Nothing in this plugin is locked, limited or trial-only.
Replace a stack of single-purpose plugins with one admin assistant.
Try Live Demo | Read Documentation
What does Smart Admin Assistant do?
In one plugin, Smart Admin Assistant can:
Hide the WordPress login page behind a custom login URL, and send visits to wp-login.php to a 404 page, the homepage or a URL you choose
Limit login attempts and lock out IP addresses that keep failing, with optional progressive lockouts
Duplicate posts, pages and custom post types in one click, including meta and taxonomy terms
Hide the admin bar on the front end or in the dashboard, for everyone or only for chosen roles
Hide admin notices from plugins, themes and WordPress core
Disable comments sitewide or per post type, and close comments on old posts automatically
Switch to the Classic Editor for the whole site or for selected post types
Allow SVG and AVIF uploads , with SVG files sanitized on upload
Add HTTP security headers and harden WordPress (hide the version, disable XML-RPC, disable the file editor)
Speed up your site with a page cache, lazy-loaded images, revision limits and Heartbeat API control
Show a coming soon / maintenance mode page with a countdown timer and a progress bar
Scan your site’s health and get a score with one-click fixes
Why choose Smart Admin Assistant?
One plugin instead of many. Fewer plugins to update, audit and keep compatible.
Modular. Turn on only the features you need. Disabled modules do not run.
Fully free. Every feature described on this page works without a licence or an account.
Private. No telemetry, no remote fonts, no calls to outside servers.
Modern admin. A fast React dashboard with a module search, a command palette (Ctrl/Cmd + K) and per-module overview pages.
Multisite ready. Network activation sets up every site, including sites created later.
Features
Admin Interface: clean up the WordPress dashboard
Hide admin notices – remove notices from plugins, themes and WordPress, including multisite and script-injected banners
Hide the admin bar in the backend, on the front end, or only for selected user roles
Admin bar cleanup – remove the WordPress logo menu, site name, comments, “New”, updates, Customize, search or My Account items, with a live preview
Remove admin bar items added by other plugins
Custom admin footer text (shortcodes supported) and hide the WordPress version in the footer
Body classes – add the user role to the front-end body class, and the role, username and user ID to the admin body class for role-based CSS
Login & User Management: secure and customize the login page
Custom login URL – replace wp-login.php with your own slug (for example /my-login )
Redirect the default login URL to a 404 page, the homepage or any custom URL
WooCommerce compatible – keeps WooCommerce account pages working with a custom login URL
Login with username only or email only
Login page templates – Split Screen, Modern Center and Underline Split layouts, also applied to the lost-password, reset-password and registration screens
Security: protect WordPress from brute force and common attacks
Limit login attempts – 3 to 10 failed attempts before the IP is locked out for 1 to 1440 minutes
Progressive lockout – repeat offenders are locked out for longer each time
IP management – see blocked IPs and time remaining, block an IP manually, unblock or clear all
WordPress hardening – hide the WordPress version (generator tag and ver= query strings), remove RSD, WLW manifest and shortlink tags, disable the theme and plugin file editor, disable XML-RPC and pingbacks
Email address obfuscation – protect email addresses in posts, excerpts, widgets and comments from spam bots, with four methods (HTML entities, JavaScript, CSS reversal, ROT13) and an exclusion list
Security scan – checks the login URL, debug mode, HTTPS, file editor, XML-RPC, version disclosure and recent failed logins
Security Status widget on the WordPress dashboard
Performance: make WordPress faster
Page cache – caches pages for logged-out visitors, ignores tracking parameters such as utm_* , fbclid and gclid , skips WooCommerce and Easy Digital Downloads shoppers, and clears itself when content, comments, menus or the theme change
Revision control – keep 0 to 100 revisions per post, clean up existing revisions in one click, or delete extra revisions weekly
Heartbeat API control – set the interval (15 seconds to 5 minutes) or disable it on the dashboard and front end to reduce admin-ajax.php load
Lazy load images in post content
Content Management: save editorial time
Duplicate post / duplicate page – one-click copy of posts, pages and custom post types with content, meta and taxonomies, saved as a draft
Disable comments sitewide or per post type, and close comments automatically after 1 to 365 days
Classic Editor – disable the block editor (Gutenberg) globally or per post type
Auto excerpts – generate an excerpt of a set length for posts and pages that have none
SVG uploads with security sanitization (administrators only)
Coming soon / maintenance mode – shows a coming soon page (HTTP 503, search-engine friendly) to everyone except administrators, with title, subtitle, description, countdown timer, progress bar and footer text
Additional user features
Extra user profile fields – phone, company, job title, address, social links and a custom bio
Private admin notes on user profiles, visible only to administrators
Dashboard, site health and tools
Site health score – a scan of performance (GZIP, browser caching, mobile viewport), SEO (XML sitemap, robots.txt, image alt text, broken internal links), configuration (WordPress and PHP versions) and security, with a detailed report
Smart recommendations – suggested settings you can apply in one click
Plain-language settings search – type what you want (“hide the admin bar”, “stop spam comments”) and jump to the matching setting; it runs locally, nothing is sent anywhere
Command palette – press Ctrl/Cmd + K to jump to any module or setting
Modules page – filter modules by category or status and activate or deactivate them in bulk
Settings import and export as JSON, to copy your setup to another site
Reset to defaults for all settings
System information – server, PHP and WordPress details with one-click copy for support tickets
Who is it for?
Site owners and bloggers who want a cleaner, safer dashboard without touching code
Agencies and freelancers who set up the same tweaks on every client site and want one plugin and one settings export to do it
Developers who want hardening, security headers and body classes without writing a custom plugin
Content teams who duplicate posts, schedule content and work in the Classic Editor
Pro version
A separate premium plugin, Smart Admin Assistant Pro , is available from store.bdthemes.com . It is installed alongside this plugin and adds its own modules, such as SEO and Google Search Console, an activity log, two-factor authentication, SMTP, admin menu customization and login page styling. Everything listed above works without it.
Smart Admin Assistant 2.4.0 requires Smart Admin Assistant Pro 2.4.0 or newer.
External Services
This plugin does not connect to any third-party service. It sends no telemetry, checks no remote feeds and loads no remote fonts or scripts.
The only HTTP requests it makes are loopback requests to your own site — for example fetching your homepage, robots.txt , a sitemap URL or a core script URL from your own domain — and only when you run the site-health scan from the plugin dashboard. Nothing is sent to any external server.
Source Code and Build Process
This plugin ships with the complete, human-readable source for every generated file it loads. Nothing you need in order to read, study, modify or rebuild the plugin is withheld.
src/admin/ — React source (JSX) for the admin application, built to dist/admin/
src/scss/ — Sass source for every stylesheet, built to dist/css/
src/js/ — JavaScript source for the classic admin screens, built to dist/js/
The build configuration is included as well: package.json , webpack.config.js (via @wordpress/scripts ), vite.config.js , postcss.config.js , tailwind.config.js and tailwind.preset.js .
To rebuild the distributed files from source, from the plugin directory:
npm install npm run build npm run build runs `@wordpress/scripts` (webpack) for the React admin app and
Vite for the stylesheets and classic scripts, writing the result to dist/ . npm run dev and npm run dev:scss are the watch-mode equivalents. The PHP autoloader is generated with composer dump-autoload -o .
No minified third-party library is bundled without its source.
Support & Documentation
Plugin support: WordPress.org support forums
Documentation: Smart Admin Assistant knowledge base
Feature requests: tell us in the support forum
See it in action
Screenshots & previews.
Modules of Smart Admin AssistantModules in ActionExplore All ModulesModule - Admin InterfaceModule - Login & UserModule - PerformanceModule - SecurityModule - Component DisablingModule - UtilitiesModule - System InformationModule - Content ManagementModule - AdditionalHelp & Support
02 / Source details
Gettingstarted.
01In your WordPress dashboard go to Plugins → Add New , search for “Smart Admin Assistant”, then click Install Now and Activate . (Or upload the smart-admin-assistant folder to /wp-content/plugins/ and activate it on the Plugins screen.)
02Open Smart Admin Assistant in the admin menu.
03Go to Modules and switch on the features you need. Each module has its own settings page.
04Save your settings. If you set a custom login URL, bookmark it before you log out.
03 / Source details
Frequently asked questions.
What is Smart Admin Assistant?
Smart Admin Assistant is a free WordPress plugin by BdThemes that combines common admin, security, performance and content tools in one modular plugin. It includes a custom login URL, login attempt limits, post duplication, admin bar and admin notice control, comment disabling, Classic Editor switching, SVG uploads, security headers, a page cache and a coming soon mode.
How do I change the WordPress login URL?
Go to Smart Admin Assistant → Login & User Management, turn on Custom Login URL and enter a slug such as my-login . Your login page then moves to yoursite.com/my-login . Choose whether visits to wp-login.php show a 404 page, go to the homepage or go to a custom URL.
I forgot my custom login URL. How do I get back in?
Deactivate the plugin by renaming the wp-content/plugins/smart-admin-assistant folder over FTP or your host’s file manager. The default wp-login.php works again. Rename the folder back and log in to see the slug.
How do I limit login attempts in WordPress?
Turn on Login Protection under Security. Set the number of failed attempts (3–10) and the lockout time (1–1440 minutes). Locked-out IPs are listed under IP Management, where you can unblock them.
How do I duplicate a page or post?
Turn on Content Duplication under Content Management. A “Duplicate” link appears under each post, page and custom post type in the list screens. The copy is saved as a draft with its content, custom fields and categories/tags.
How do I hide the admin bar for non-admin users?
Turn on Admin Bar Customization under Admin Interface and choose to hide it on the front end, in the dashboard, or only for selected user roles such as Subscriber or Customer.
How do I hide admin notices?
Turn on Hide Admin Notices under Admin Interface. Notices from plugins, themes and WordPress are removed from every admin screen.
How do I disable comments in WordPress?
Turn on Comments Management under Content Management. Disable comments on the whole site or only on chosen post types, or close comments automatically on posts older than a set number of days.
Can I use the Classic Editor instead of Gutenberg?
Yes. Editor Selection under Content Management switches to the Classic Editor for all post types or only the ones you choose.
Is it safe to allow SVG uploads?
SVG files can contain scripts, so this plugin sanitizes every SVG on upload and allows SVG uploads for administrators only.
Does the page cache work with WooCommerce?
Yes. The page cache serves only logged-out visitors and skips anyone with a WooCommerce, Easy Digital Downloads, comment or login cookie, so carts and checkouts are never cached. If you already use a caching plugin or host-level cache, leave this module off.
Will coming soon mode hurt my SEO?
No. The coming soon page is sent with an HTTP 503 status, which tells search engines the site is temporarily unavailable. Administrators still see the normal site.
Is Smart Admin Assistant free?
Yes. Every feature on this page is free, with no licence, account or feature limits. An optional Pro add-on adds extra modules.
Does it slow down my site?
No. Each module loads only when it is switched on, and front-end features only add the code they need. Speed features such as the page cache, lazy loading and Heartbeat control can make the site faster.
Does it work on WordPress Multisite?
Yes. Network activation sets up every site, and new sites are set up automatically. Settings are stored per site.
Can I copy my settings to another site?
Yes. Go to Settings and export your settings as a JSON file, then import it on the other site.
Does the plugin send any data to external servers?
No. It sends no telemetry and loads no remote scripts or fonts. See the External Services section.
What happens to my data if I delete the plugin?
Deleting the plugin from the Plugins screen removes its settings table, options, transients, user meta and scheduled tasks.
How can I report security bugs?
Report security issues through the Patchstack Vulnerability Disclosure Program. Their team helps validate, triage, and coordinate responsible disclosure: Report a security vulnerability .
FinderPress Media Auditor helps site administrators scan for broken images, missing Media Library files, unreachable media URLs, and other media issues across WordPress content. Use it to audit images, video, audio, PDFs, featured images, and attachment files without sending scan data to an external
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
