XeroWP
DIGITO Toolkit
DIGITO Toolkit

DIGITO Toolkit

0/5 (0 ratings) — active installs Updated Oct 15, 2026
duplicate postmaintenance modesafe svgsecuritysecurity health
Download v1.2.1
Security Health dashboard showing the weighted score, status summary, findings, and recommendations.

Security Health dashboard showing the weighted score, status summary, findings, and recommendations.

DIGITO Toolkit groups five independently switchable WordPress administration tools in one lightweight plugin. Enable only the modules you need. Disabled modules do not boot their feature hooks.

Security Health

Security Health provides administrator-only, local diagnostics for WordPress update posture, HTTPS configuration, debug exposure, the dashboard file editor, privileged-account signals, public author exposure, selected response headers, and XML-RPC posture.

Its score summarizes the checks that could run. Pass earns full weight, Warning earns half, Fail and Unknown earn no points, and Not Applicable is excluded. The score is guidance, not a guarantee that a site is secure. Every result includes concise evidence, limitations, and a recommended next step. Security Health does not scan site files for malware, replace WordPress Site Health, or use a remote vulnerability service.

Optional controls are off by default and reversible:

  • Login-attempt protection applies a 15-minute client cooldown after five failures within 15 minutes. It stores keyed pseudonymous counters rather than raw IP addresses or usernames. Administrators must explicitly confirm activation. The documented DIGITO_TOOLKIT_DISABLE_LOGIN_PROTECTION configuration constant provides emergency recovery.
  • WordPress response headers can add X-Content-Type-Options and Referrer-Policy when WordPress has not already supplied them. The control does not edit server or CDN configuration and does not add CSP or HSTS.
  • XML-RPC can remain in observe-only mode or be disabled after an explicit compatibility warning. Disabling it can affect publishing clients, mobile apps, Jetpack, and other integrations.
  • Manual and optional daily scheduled scans evaluate the same bounded local checks. Only the latest scheduled summary is retained for up to seven days.
  • A bounded local event log retains up to 500 allowlisted, nonsensitive events for seven days. Clearing it requires administrator authorization and explicit confirmation.

Security Health is off by default. Its screen and settings require the WordPress manage_options capability. It does not add a public API, telemetry, remote accounts, automatic destructive remediation, or network-wide Multisite administration.

Classic Editor

Restore the familiar WordPress Classic Editor for posts and pages.

Duplicate Page & Post

Quickly duplicate posts, pages, and supported custom post types with their content and settings. Copies are created as drafts through capability- and nonce-protected WordPress actions.

Maintenance Mode

Temporarily display a customizable Maintenance or Under Construction page to visitors. Configure the message, presentation, optional Media Library logo, and optional countdown. Authorized administrators retain access. Public maintenance responses use HTTP 503 and Retry-After headers.

Page-cache, hosting-cache, and CDN layers can serve stale HTML without reaching WordPress. Purge those caches after changing Maintenance Mode when needed.
A cache that serves stored HTML without reaching WordPress cannot be overridden by the Toolkit.

Safe SVG Upload

Securely upload sanitized SVG graphics to your WordPress Media Library. The module is off by default and is limited to trusted administrators with upload permission; Multisite additionally requires a super administrator.

Accepted SVGs are parsed and sanitized locally. The default upload limit is 1 MiB. Scripts, event handlers, animation, foreignObject, unsafe CSS, external resources, data URLs, document type declarations, entities, malformed XML, and files that cannot be verified are rejected. Sanitized attachments include Media Library previews and dimensions. Safe SVG Upload does not optimize raster images or promise support for every SVG authoring feature.

Privacy and local processing

DIGITO Toolkit does not include Toolkit telemetry, visitor tracking, remote accounts, or remote security scanning. Settings, diagnostic summaries, and the bounded Security Health event log remain in the site’s WordPress database. No raw IP address, username, credential, cookie, request payload, site content, or diagnostic report is sent to DIGITO WEBS.

Compatibility and limitations

The plugin requires WordPress 6.8 or later and PHP 8.2 or later. Security Health evaluates WordPress-visible evidence and cannot verify every server, proxy, CDN, certificate, WAF, or external service. Its optional controls affect WordPress-generated behavior only.

Multisite support is best effort and site-local. The Toolkit does not provide shared Network Admin settings, network-wide provisioning, or complete network-wide uninstall cleanup.

The bundled enshrined/svg-sanitize library is GPL-2.0-or-later. Source and license details are recorded in the distributed Composer metadata and vendor license.