XeroWP
Bani Honar Toolkit

Bani Honar Toolkit

5/5 (1 ratings) — active installs Updated Nov 10, 2026
duplicate postpage shieldqr codeurl shortenervisitor statistics
Download v1.1.0
The dashboard with one card and one switch per module.

The dashboard with one card and one switch per module.

Bani Honar Toolkit is a small, modular plugin. Every feature is a module that you can switch on or off from one dashboard, and developers can add their own modules.

Included modules

  • Link Shortener – short links on your own domain, with random or custom case-sensitive codes, click counts and a choice of redirect type.
  • QR Code Generator – QR codes for a link, a page of your site or any text, in many looks and with a logo, plus a contact-card (vCard) code that saves a phone number straight into Android and iPhone contacts. PNG and SVG downloads.
  • Visitor Stats (off by default) – every visit with its source, country, device and page, a filterable log with CSV download, and IP blocking. No cookies.
  • Post Duplicator – copy posts, pages and custom content with one click, and edit a live page safely through a hidden draft.
  • Page Shield (off by default) – makes casual copying of your pages harder, with no effect on search engines.
  • Contact the IT team – a tab to write a suggestion, criticism or problem report by e-mail.
  • Profile Pictures – upload a profile picture from the profile screen, no Gravatar needed.

Every option of every module is described in the questions at the start of the FAQ.

Languages, one switch

The plugin screens can be shown in Persian (RTL), English (LTR) or Turkish (LTR), whatever your site language is. Change it under Bani Honar Toolkit > Settings. If the translation of that language is not on your site yet, press Install in the Translations box on the same screen: the official translation is downloaded from WordPress.org (see “External services”).

Languages are a list, not a fixed pair: a new language (German, Arabic, French and so on) needs a translation file and one entry in the list. See “For developers” below.

فارسی

افزونه چندمنظوره، ماژولار و قابل توسعه برای وردپرس: آمار کامل بازدید (چند بازدید، از کجا، با چه آدرس IP و از کدام کشور، با چه دستگاه و چه مدلی)، کوتاه‌کننده‌ی لینک با دامنه‌ی خودتان، کیو آر کد با شکل‌های ظاهری بسیار و «ذخیره مستقیم مخاطب» برای اندروید و آیفون، محافظ صفحه، تکثیر نوشته و برگه با «ویرایش امن» صفحه‌های زنده، آپلود تصویر پروفایل بدون گراواتار، و رابط چندزبانه (فارسی، انگلیسی، ترکی) که از تنظیمات خود افزونه عوض می‌شود.

For developers

Extend BHTK_Module and register your module on the bhtk_register_modules action. It gets a dashboard card, an on/off switch and its own section on the Settings screen.

add_action( 'bhtk_register_modules', function ( $plugin ) { $plugin->register_module( new My_Module() ); } );

Use the bhtk_capability filter to change the capability needed to use the toolkit (default: manage_options).

Use the bhtk_languages filter to add an interface language: add_filter( 'bhtk_languages', function ( $languages ) { $languages['de'] = array( 'name' => 'Deutsch', 'english' => 'German', 'locale' => 'de_DE', 'rtl' => false, 'calendar' => 'gregorian' ); return $languages; } );

Third-party code

The QR Code Generator uses the MIT-licensed “QR Code Generator for JavaScript” by Kazuhiko Arase (version 2.0.4), included in assets/js/vendor/. QR Code is a registered trademark of DENSO WAVE INCORPORATED.

Privacy

The Post Duplicator stores no personal data. It marks copies and safe-edit drafts with four small custom fields (_bhtk_clone_of, _bhtk_fork_of, _bhtk_open_fork, _bhtk_fork_time) that hold post numbers and a time; they are removed when you delete all toolkit data.

The link shortener stores, for each link: the code, the destination, an optional note, the click count, the time of the last click, who created it and when. Visitors are not identified or logged by it.

The Visitor Stats module is off by default. While it is on, one small request is sent from the visitor’s browser to your own website for every page opened (at most 600 views a minute are recorded for the whole site; developers can change this with the bhtk_visits_max_per_minute filter), and your site stores: the date and time, the IP address (or the address with its last part removed, if you choose so), the country, the page address and title, the referring website, campaign tags (utm_), the browser’s User-Agent text and the device details derived from it, screen size, language and time zone. A random session code lives in the browser’s sessionStorage; no cookies are set. Visits older than the retention period you choose (365 days by default) are deleted automatically, and you can delete everything or download it at any time. An IP address can be personal data in some countries: if your visitors are protected by such a law, mention the counting in your privacy policy.

A visit from a logged-in member also stores that member’s user id; the name and e-mail address are read from the WordPress user when you open the details. Words typed into the search box of your website (?s=) are stored with the visit. Visitor Stats never reads or stores a computer name, a file path or an e-mail address from the visitor’s device: browsers do not allow websites to read them.

The country is read from your CDN or server first (Cloudflare, ArvanCloud, CloudFront and others) and from earlier visits of the same address. The option “Find the country online when the server does not know it” is off by default. Only when you switch it on, and only when the country cannot be read in another way, the visitor IP address is sent to an outside lookup service. See the section “External services” below for what is sent, to whom, and the terms and privacy policy of each service. Without that option no address leaves your server. Nothing else is sent to outside services.

The toolkit adds suggested text to the privacy policy guide (Settings > Privacy), and connects Visitor Stats to the WordPress tools Tools > Export Personal Data and Tools > Erase Personal Data: visits of a member are found by e-mail address. When a user account is deleted, the visits of that user stay as anonymous statistics.

The Contact tab sends nothing from your website; it only opens the e-mail program of the person who presses a button.

External services

Bani Honar Toolkit can connect to two kinds of outside service, and each one only when you ask for it: the translation service of WordPress.org (when you choose a plugin language whose translation is not on your site yet, or press Install or Update in the settings) and, if you switch it on, an IP-address-to-country lookup used by the Visitor Stats module. The Link Shortener, QR Code Generator, Post Duplicator, Page Shield and Profile Pictures modules never contact an outside service: QR codes are drawn in the browser and profile pictures are stored on your own site.

Translation download (Settings, only when an administrator asks for a language)

  • What it is and what it is for: WordPress.org’s own translation service, the one WordPress uses to update the translations of your plugins. It is used to get the Persian or Turkish translation of this plugin when your site language is different, so that the plugin language switch works.
  • When it runs: only when an administrator presses Install or Update beside a language in Bani Honar Toolkit > Settings > Translations, or saves the settings with a plugin language whose translation is not on the site yet (WordPress does the same when you change the site language). Nothing is requested in the background by the plugin, and nothing is requested for a language that is built in (English) or one that is already installed.
  • What is sent: to api.wordpress.org the plugin name and version, the WordPress version and the language of your site, exactly as WordPress does for its own translation updates; the request also carries the web address of your site in the User-Agent, as every request that WordPress sends to WordPress.org does. The translation package is then downloaded from downloads.wordpress.org. No visitor data and no personal data is sent. Only a package from downloads.wordpress.org is accepted.
  • What comes back: a small package with the translation files (.po and .mo), saved in wp-content/languages/plugins/ by the WordPress upgrader.
  • Service: WordPress.org, Privacy Policy.

IP-address-to-country lookup (Visitor Stats, optional, off by default)

  • What it is and what it is for: a free web service that tells which country an IP address belongs to. It is used only to fill in the country of a visit when your CDN or server did not provide it and the address was not already known from an earlier visit.
  • When it runs: only after an administrator ticks “Find the country online when the server does not know it” under Bani Honar Toolkit > Visitor Stats > Settings. Then one request is made for a visit from a public IP address whose country is unknown, and an hourly background task retries up to 20 recent addresses whose country is still unknown. If a service fails, lookups pause for ten minutes.
  • What is sent: the visitor’s IP address (inside the request address) and the plugin name and version in the User-Agent header, for example BaniHonarToolkit/1.1.0. Like any web request, the service also sees your server’s IP address. No page address, cookie, name, e-mail or other visitor detail is sent. If you also tick “Hide the last part of every IP address”, your site saves only the shortened address, but the full address is still used for that single lookup and is not stored.
  • What comes back: a two-letter country code, which is saved with the visit.
  • The “Check the country lookup” button (Visitor Stats > Settings): only when an administrator presses it, the plugin asks each service about the public example address 8.8.8.8 (a well-known public DNS address, not a visitor) to find out whether your server can reach the services. No visitor data is sent. It works even when the option above is off, because it is a manual test and nothing is stored.
  • Which service: you choose it in the settings. “Automatic” tries ipwho.is first and then GeoJS.

Services used:

If you do not want any address to leave your server, leave the option off, or answer from a local database with the bhtk_geo_lookup filter, which skips the online services. If you use the option, mention it in your own privacy policy; the plugin adds suggested text to Settings > Privacy.

Links that open another website only when you click them (for example “Write in Gmail” on the Contact us tab, or the Google Search Console link in Visitor Stats) are ordinary links; the plugin itself sends nothing to those sites.