WPMasterToolKit (WPMTK) – All in one plugin

WPMasterToolKit is a modular all-in-one WordPress plugin for site administration, security, performance, media, email delivery and development. It brings together 100+ tools in one dashboard, including code snippets, content duplication, SMTP, WebP conversion, login protection, redirects and database utilities.

Yes. The free version includes 98 modules for WordPress administration, security, performance, media management and development. WPMasterToolKit Pro adds 37 advanced modules and premium features such as two-factor authentication, vulnerability scanning, AVIF conversion, advanced SMTP providers, White Label and Pixel Tag Manager.

No. WPMasterToolKit is modular, so you can enable only the features you need. Disabled modules do not load their feature logic on your website. This also helps prevent conflicts caused by activating overlapping tools.

WPMasterToolKit is designed to load modules only when they are enabled. Actual performance depends on your hosting, theme, other plugins and the modules you select. Several tools can also help reduce frontend work, including Heartbeat Control, WebP image conversion and options to disable emojis, cart fragments, Dashicons or jQuery Migrate when they are not needed.

WPMasterToolKit is not a replacement for a dedicated WordPress SEO plugin, but it includes technical tools that can support SEO and website performance. These include WebP and AVIF image optimization, robots.txt management, redirect management, media metadata tools, local Google Fonts, external link attributes and control over the default WordPress sitemap.

It can replace multiple single-purpose plugins when its modules cover the features you use. Common examples include plugins for duplicate posts, SMTP email, code snippets, WebP conversion, login URL changes, login attempt limits, redirects, maintenance mode, SVG uploads and child theme generation. Test changes on a staging site and avoid running two plugins that provide the same feature.

WPMasterToolKit includes security hardening tools such as Limit Login Attempts, Move Login URL, strong password enforcement, user enumeration protection, XML-RPC control, security headers and file access restrictions. These features can replace several security tweaks, but they are not a guarantee against every threat and may not replace a dedicated firewall, malware scanner, backup service or security monitoring platform for high-risk websites.

Enable the Move Login URL module and choose a custom login path. The module changes access to the default WordPress login URL to reduce automated login traffic. WPMasterToolKit Pro can additionally block unauthenticated access to /wp-admin with a server-side 403 response.

Enable the Disable XML-RPC module from the WPMasterToolKit dashboard. Disabling XML-RPC can reduce exposure to attacks that target this legacy interface, but first confirm that your mobile app, remote publishing service or integration does not depend on it.

Yes. The Disable REST API module restricts REST API access for unauthenticated visitors and removes related discovery links. Because themes, plugins and external applications may rely on the REST API, test this setting before using it on a production website.

Yes. The Media Encoder module converts images locally on your WordPress server instead of sending them to an external optimization service. The free version supports automatic WebP conversion, while WPMasterToolKit Pro adds AVIF conversion on compatible servers running PHP 8.1 or later.

Enable SMTP Mailer, enter the sender details and SMTP credentials, then send a test email from the module settings. The free version supports PHP mail and generic SMTP. WPMasterToolKit Pro adds integrations for 19+ providers, including Gmail, Outlook, SendGrid, AWS SES, Brevo, Mailgun, Mailjet, Postmark and Resend.

WPMasterToolKit includes WooCommerce-specific tools such as disabling cart fragments for logged-out visitors, removing the logout confirmation and customizing the My Account menu. It also uses standard WordPress and WooCommerce APIs where applicable. As with any plugin stack, test checkout, account and caching behavior on a staging site after enabling performance or WooCommerce modules.

Yes. The Disable Gutenberg module can restore the classic editor for selected post types or disable the block editor more broadly. This gives you control over where Gutenberg is used without modifying your theme.

Yes. Content Duplication adds one-click duplication for posts, pages and custom post types. It also copies associated taxonomy terms and post metadata, which is useful for reusing page structures, product content and custom content templates.

Yes. Code Snippets lets you manage reusable PHP code from the WordPress dashboard without editing your theme’s functions.php file. Snippets can also contain CSS inside <style> tags or JavaScript inside <script> tags. Incorrect custom code can break a website, so validate snippets and test them on staging first.

Yes. The Adminer module provides a database management interface inside WordPress for browsing tables and running database operations. Database changes can be destructive, so restrict access to trusted administrators and create a complete backup before editing data or running SQL queries.

Yes. Child Theme Generator creates a child theme from the active theme directly in the WordPress dashboard. After generation, you can disable the module because the child theme continues to work independently.

Yes. The SVG Upload module enables SVG media uploads and validates SVG file content. Because SVG is an XML-based format that can contain active content, only trusted users should be allowed to upload files.

Yes. The free Redirect Manager supports WordPress/PHP redirects. WPMasterToolKit Pro adds Apache and Nginx redirect engines, redirect logs and CSV import/export. Redirects should be tested carefully to avoid loops and inaccessible pages.

WPMasterToolKit includes multisite-aware behavior in several modules, but support can vary by feature. Test each required module on a staging network before network activation, especially modules that modify files, login URLs, media settings or database content.

WPMasterToolKit uses standard WordPress hooks and is designed to work alongside popular themes and page builders. Tools such as content duplication, custom body classes and custom frontend CSS can complement page-builder workflows. Compatibility can still depend on the specific modules and third-party extensions enabled, so test important pages after configuration changes.

WPMasterToolKit is regularly updated with new modules, improvements, security hardening, bug fixes and compatibility changes. Review the changelog before updating production websites and use a staging environment for business-critical sites.

Please report security issues privately through the Patchstack Vulnerability Disclosure Program. The Patchstack team helps validate, triage and coordinate security reports. Do not publish vulnerability details before a fix is available. Report a security vulnerability.