PowerSuite Modular Admin Toolkit

155 modules. 90 free. 65 more with Pro.

Manage admin, content, media, login, and email tools from one searchable dashboard. Enable what you need and save favorites.

Watch the PowerSuite explainer

🚀 Free and Pro

Use 90 free modules without a PowerSuite account, license, or trial. WP Powersuite Premium adds 65 modules through a separate paid add-on for forms, backups, advanced security, and more. Keep Lite active alongside Pro. Pro code is not included in this download.

PowerSuite launch video (includes Pro features)

This launch video also showcases features available in the separate paid Pro add-on.

✅ All 90 Free Modules

• 404 Redirect: Fallback redirects for unknown URLs.
• Admin Logo: Brand admin bar/sidebar.
• Ads.txt Manager: Manage advertising inventory files.
• Alpine.js Enqueue: Load Alpine.js where needed.
• Analytics Integration: Consent-aware GA4 pageview tracking.
• Auto Image Upload Rename: Clean uploaded image filenames.
• Auto Set Featured Image: Choose first content image.
• Auto Table of Contents: Build heading-based contents lists.
• AVIF Upload: Upload server-supported AVIF images.
• Block Usernames: Restrict registration usernames.
• Block Video Uploads: Restrict videos by role.
• Breadcrumbs: Display breadcrumb navigation.
• Change Post Type: Convert content between types.
• Clean User Profile Screen: Simplify user profile screens.
• Compact Tables: Compact admin list tables.
• Content Expiration: Schedule content unpublishing.
• Content Report Widget: Dashboard content/user counts.
• Custom Admin Footer Text: Customize dashboard footer text.
• Custom Body Class: Add custom CSS classes.
• Custom Excerpt Length: Customize excerpt length/text.
• Custom Login Logo: Brand the login screen.
• Custom Login Logo Link: Customize login-logo destination.
• Customizer Reset: Back up/reset/import/export settings.
• Dashboard Columns: Arrange dashboard widget columns.
• Default Featured Image: Provide fallback post thumbnails.
• Disable Application Passwords: Block application-password authentication; affects integrations.
• Disable Author Archives: Disable public author archives.
• Disable Auto-Update Emails: Suppress update notification emails.
• Disable Comments: Disable site-wide comments.
• Disable Core Sitemap: Disable WordPress’s generated sitemap.
• Disable Dashboard Widgets: Remove selected dashboard widgets.
• Disable Dashicons on Frontend: Remove guest Dashicons; check compatibility.
• Disable Drag and Drop: Discourage dragging, not secure protection.
• Disable File Editing: Disable browser-based code editors.
• Disable Gutenberg: Select classic editing by type.
• Disable Heartbeat: Reduce background Heartbeat requests.
• Disable Keyboard Keys: Discourage shortcuts, not secure protection.
• Disable oEmbed Auto-Embeds: Disable automatic link embedding.
• Disable Password Reset: Restrict resets; arrange alternative recovery.
• Disable Post Auto-Save: Disable autosaves; save manually.
• Disable REST API: Restrict anonymous core REST endpoints.
• Disable Right Click: Discourage right-click, not secure protection.
• Disable RSS Feeds: Disable public RSS feeds.
• Disable Site Search: Disable general searches; retain type-scoped searches.
• Disable Text Selection: Discourage selection, not secure protection.
• Disable Thumbnail Generation: Skip selected new thumbnail sizes.
• Disable Trackbacks/Pingbacks: Disable trackbacks and pingbacks.
• Disable WordPress Emojis: Use device-native emoji rendering.
• Disable XML-RPC: Disable legacy XML-RPC access.
• Display Active Plugins First: Group active plugins first.
• Download Plugin as ZIP: Export installed plugin ZIPs.
• Download Theme as ZIP: Export installed theme ZIPs.
• Duplicate Menu: Copy menus and items.
• Duplicate Post Type: Duplicate posts/pages/custom content.
• Email Delivery: Route email through SMTP/providers.
• Email Obfuscator: Encode visible email addresses.
• External Permalinks: Link entries to external destinations.
• Featured Image Column: Preview thumbnails in content tables.
• Footer Timezone Display: Show site time/timezone.
• Force SSL Admin: Require working HTTPS for admin.
• Generic Login Errors: Standardize failed-login messages.
• Google Sign-in: Google login; optional registration.
• Hide Admin Bar: Hide toolbar by role.
• Hide Author URLs: Obfuscate public author slugs.
• Hide Update Notifications: Hide notices; still apply updates.
• Hide WP Version: Remove public version disclosures.
• Image Sizes Panel: Inspect image sizes/URLs.
• Last Login Column: Display users’ last logins.
• Limit Media Upload Size: Cap media upload size.
• Local User Avatar: Use local profile photos.
• Media Library Infinite Scroll: Scroll-load media; respects user preference.
• Open All External Links in New Tab: Open external links separately.
• Open Menu Links in New Tab: Open selected menu links separately.
• Post Views Counter: Count/display content views.
• Publish Missed Scheduled Posts: Publish overdue scheduled content.
• Reading Time Calculator: Estimate article reading time.
• Regenerate Thumbnails: Rebuild attachment image sizes.
• Registration Date Column: Show/sort account registration dates.
• Remove Admin Bar Items: Hide selected toolbar items.
• Remove Query Strings: Remove local asset version parameters.
• Remove Shortlink: Remove shortlink markup.
• Remove Unused Themes and Plugins: Delete inactive themes/plugins.
• Remove Version from Scripts: Hide core asset version markers.
• Robots.txt Manager: Manage virtual robots.txt directives.
• Search Visibility Warning: Flag discouraged search indexing.
• Storage Monitor: Display dashboard disk usage.
• SVG Upload: Administrator-only sanitized SVG/SVGZ uploads.
• User Role Body Class: Add role-based CSS classes.
• Username Body Class: Expose current username/ID in body classes.
• Wider Admin Menu: Widen the dashboard sidebar.

⭐ All 65 Pro Add-On Modules

Available separately through PowerSuite Pro:

• 404 Error Log: Record missing-page requests/referrers.
• Accessibility Widget: Visitor adjustments; not WCAG certification.
• Activity Log: Record dashboard/user activity.
• Admin Color Customizer: Customize dashboard color schemes.
• Admin Columns Customizer: Configure admin table columns.
• Admin Login Alerts: Email administrator login alerts.
• Admin Menu Organizer: Reorder/rename/hide admin menus.
• AI Alt Text Generator: Generate reviewable AI image descriptions.
• AI Forms: Manual/AI-assisted forms and entries.
• AI Summarize: Open external AI summary prompts.
• Alphabet Avatars: Create letter-based profile images.
• AVIF Conversion: Generate AVIF image copies.
• Backup & Restore: Create and schedule database and file backups, restore saved copies, and use Google Drive, Dropbox, FTP/FTPS, or SFTP for off-site storage.
• Broken Link Checker: Scan content for broken links.
• Bulk Page Creator: Generate pages from CSV.
• Categorize Media: Organize media into folders.
• Change Login URL: Customize the login address.
• Cloudflare Turnstile: Cloudflare form bot checks.
• Code Snippet: Manage code snippets with conditions.
• Coming Soon & Maintenance: Show temporary landing pages.
• Custom Admin CSS: Style dashboard with CSS.
• Custom Fields: Create post/term custom fields.
• Custom Image Sizes: Register additional image dimensions.
• Custom Post Order: Reorder content in supported queries.
• Custom Post Type Builder: Build post types/taxonomies.
• Custom Taxonomy Order: Reorder supported taxonomy displays.
• Customize WordPress Emails: Brand core email notifications.
• Database Cleanup: Review/delete selected database clutter.
• Debug Mode Toggle: Control debugging and logging.
• Disable All Updates: Pause updates; patch manually.
• Download Media Library: Export media ZIP archives.
• Email Logs: Review delivery records/resend.
• Email Reports: Schedule activity/delivery summaries.
• Facebook Sign In: Configure Facebook account login.
• Floating Social Share: Add social sharing links.
• GitHub Sign-in: Configure GitHub account login.
• Google reCAPTCHA: Google form bot checks.
• Gutenberg Block Control: Restrict available editor blocks.
• Header & Footer Code: Insert site-wide code snippets.
• Hide Admin Notices: Collect notices in toolbar.
• IP Allow & Block List: Restrict site access by IP.
• Limit Login Attempts: Lock out repeated login failures.
• Login as User: Authorized user-session switching.
• Login ID Type: Choose username/email login.
• Login Page Customizer: Style the login page.
• Login Session Manager: Manage active login sessions.
• Magic Login: Passwordless links/one-time codes.
• Media Rename Manager: Rename files/update supported references.
• Media Replacement: Replace existing attachment files.
• Options Page Builder: Build custom settings screens.
• Password Protection: Password-protect the whole site.
• Redirect After Login: Set post-login destinations.
• Redirect Manager: Manage redirects and patterns.
• Security Headers: Configure browser security headers.
• Share Draft Preview Links: Share expiring draft previews.
• Show IDs: Show content/user IDs.
• Simple CAPTCHA: Local form CAPTCHA challenges.
• System Summary: Inspect environment/site health.
• Temporary Login: Issue expiring access links.
• Two-Factor Authentication (2FA): Require additional login verification.
• Unused Media Finder: Review potentially unused media.
• URL Shortener: Create on-site short links.
• Username Changer: Change validated account usernames.
• WebP Conversion: Convert uploads to WebP.
• WP Config Editor: Edit configuration with backups.

💡 Before You Enable Modules

Test sensitive changes on staging and keep independent backups. Avoid overlapping features; use either WebP or AVIF Conversion. Disabled modules skip feature logic, but shared core still loads. AI generation requires your provider account; charges are separate. Manual form building needs no AI provider.

🔎 Privacy, External Services & Licenses

Free modules make no licensing requests. Configured integrations, remote images/imports, and submitted feedback contact the recipients below. Disabled modules do not contact these services. Alpine.js is bundled.

Email Delivery

Configured PHP mail/SMTP/providers receive message content, sender/recipients, reply-to, attachments, and credentials for mail and Test email. Test connection authenticates SMTP without sending; API checks request account/domain/sender/permission data. Emailit/Bird retrieve recent messages; SendLayer retrieves delivery events, potentially exposing account mail information. Netcore/turboSMTP POST synthetic connection-test requests with invalid sender/recipient addresses, without customer content. Maileroo checks its key locally; use Test email for delivery verification.

Entered SMTP hosts override defaults below. Relays receive mail/credentials; API User-Agent includes plugin/version. Servers receive your IP/HTTP information. Gmail/Microsoft authorization exchanges code, credentials, callback URL, and later refresh tokens. SES webhooks fetch SNS certificates/subscription-confirmation URLs with tokens. Domain checks query DNS. Delivery webhooks verify signatures/secrets; Mailgun requires its HTTP Webhook Signing Key and HTTPS.

• Other SMTP host you enter: the email content goes to that host. Use that host’s own Terms and Privacy Policy.
• Amazon SES: regional email.*.amazonaws.com API hosts, email-smtp.*.amazonaws.com SMTP hosts, plus sns.amazonaws.com / sns.*.amazonaws.com certificate and subscription URLs when delivery-event webhooks are enabled. Terms and Privacy.
• SendGrid (Twilio): API api.sendgrid.com or api.eu.sendgrid.com; SMTP smtp.sendgrid.net. Terms and Privacy.
• Mailgun: API api.mailgun.net or api.eu.mailgun.net; SMTP smtp.mailgun.org or smtp.eu.mailgun.org. Terms and Privacy.
• Brevo: API api.brevo.com; SMTP smtp-relay.brevo.com. Terms and Privacy.
• Google Gmail API: accounts.google.com, oauth2.googleapis.com, gmail.googleapis.com, and www.googleapis.com. Terms and Privacy.
• Microsoft Graph: login.microsoftonline.com and graph.microsoft.com. Terms and Privacy.
• Postmark: API api.postmarkapp.com; SMTP smtp.postmarkapp.com. Terms and Privacy.
• Mailjet: API api.mailjet.com; SMTP in-v3.mailjet.com. Terms and Privacy.
• MailerSend: API api.mailersend.com; SMTP smtp.mailersend.com. Terms and Privacy.
• SMTP2GO: API api.smtp2go.com, us-api.smtp2go.com, eu-api.smtp2go.com, or au-api.smtp2go.com; SMTP mail.smtp2go.com. Terms and Privacy.
• Resend: API api.resend.com; SMTP smtp.resend.com. Terms and Privacy.
• Mandrill (Mailchimp): API mandrillapp.com; SMTP smtp.mandrillapp.com. Terms and Privacy.
• SparkPost / Bird Email: classic SparkPost API keys use https://api.sparkpost.com or https://api.eu.sparkpost.com; Bird platform API keys use https://us1.platform.bird.com or https://eu1.platform.bird.com. SMTP defaults are smtp.sparkpostmail.com or smtp.eu.sparkpostmail.com. Terms and Privacy.
• Elastic Email: API api.elasticemail.com; SMTP smtp.elasticemail.com. Terms and Privacy.
• SendLayer: API console.sendlayer.com; SMTP smtp.sendlayer.com. Terms and Privacy.
• SMTP.com: API api.smtp.com; SMTP send.smtp.com. Terms and Privacy.
• Netcore (formerly Pepipost): https://emailapi.netcorecloud.net or https://apieu.netcorecloud.net. Terms and Privacy.
• turboSMTP: API api.turbo-smtp.com or api.eu.turbo-smtp.com; SMTP pro.turbo-smtp.com or pro.eu.turbo-smtp.com. Terms and Privacy.
• Maileroo: smtp.maileroo.com for both the HTTPS email API and SMTP relay. Terms and Privacy.
• Emailit: API api.emailit.com; SMTP smtp.emailit.com. Terms and Privacy.
• Mail.baby (InterServer): API https://api.mailbaby.net; SMTP relay.mailbaby.net. Terms and Privacy.

Email failure alerts

After final failure, optional chat alerts send site/provider names and redacted errors, at most every 15 minutes. Errors may retain message-specific information, but exclude bodies/attachments. Email alerts use configured recipients/connection, falling back to admin email. Slack: hooks.slack.com (Terms, Privacy). Discord: discord.com/discordapp.com (Terms, Privacy). Developers may allow other HTTPS hosts; review their policies.

Remote images and imports

Customizer image imports download supplied URLs into Media Library; hosts receive URL, server IP, and HTTP information. Admin Logo URLs load directly in previews/admin bars, including front-end bars; no local copy. External image hosts receive URL, viewer IP/browser and policy-permitted referrer. Review arbitrary hosts’ Terms/Privacy.

Gravatar fallback: When WordPress avatar display is enabled, Local User Avatar profile previews without a local avatar and Remove Admin Bar Items account greetings may request https://secure.gravatar.com/avatar/ unless overridden. Requests include profile-email hash, size/default/rating and selected initials; hosts receive viewer IP/browser/referrer. Local User Avatar respects disabled avatar display, uses local uploads when present, and uses a local placeholder for its hidden removal preview. Terms, Privacy.

Optional deactivation feedback

“Submit & Deactivate” stores up to 50 local snapshots: reason/comments, site/admin details, plugins/theme, modules, environment/browser, and recent errors.

It sends reason/comments, site URL/hash, admin/submitting-user emails, plugin/WordPress/PHP/database versions, theme, installed/active plugins, modules, license status (not key), browser/OS, language/role, hosting/server, memory/cache/CDN, HTTPS/cron details to https://wppowersuite.com/wp-json/licensor/deactivation-feedback for troubleshooting/improvements. Automatic diagnostics exclude raw errors/logs, local user IDs, passwords, API/license keys; recipient receives server IP/HTTP information. Terms, Privacy.

“Skip & Deactivate” collects/sends nothing; opening/closing sends nothing. Contact-permission checkbox defaults checked; its yes/no value permits follow-up, not marketing subscription or immediate email. Uncheck to decline; Skip sends no permission. Developers overriding/disabling recipients through constants/filters must disclose replacements and policies before collection.

Social sign-in

Google Sign-In requires OAuth credentials. Clicking sign-in authorizes at https://accounts.google.com; approval exchanges code, client ID/secret and callback URL at https://oauth2.googleapis.com/token, then retrieves email/name/avatar using the access token at https://openidconnect.googleapis.com/v1/userinfo to sign in/create accounts.

Sign-in/CAPTCHA browser-binding cookies are first-party HttpOnly, expire after ten minutes, clear on matching verification, and are neither shared with providers nor tracking cookies. Use HTTPS.

Google avatar URL storage defaults enabled. Saved external images load during later avatar views while sign-in is enabled/configured, including non-signing-in viewers. Local uploads can override; images aren’t copied locally. Disabling storage doesn’t remove saved URLs. Hosts receive image URL, IP/browser/referrer. Google: Terms, Privacy.

Facebook/GitHub modules require Pro; the shared OAuth HTTP helper ships free. Installed/enabled/configured modules authorize with application ID, callback, permissions/state; approval exchanges authorization code/credentials for tokens, then account ID/name/permitted email/avatar for login/registration. No WordPress passwords are sent. GitHub’s authenticated GET /user/emails uses user:email: API documentation.

Facebook: https://www.facebook.com, https://graph.facebook.com (Terms, Privacy). GitHub: https://github.com, https://api.github.com (Terms, Privacy).

Analytics and bot checks

Configured GA4 waits for CMP analytics consent or wppsmodule_allow_analytics (default false). Disabling Consent Mode allows immediate tracking unless blocked by that filter. Included pageviews request https://www.googletagmanager.com/gtag/js, then send Measurement ID, URL and standard events to https://www.google-analytics.com / https://analytics.google.com. Google Terms/Privacy above apply.

reCAPTCHA/Turnstile require Pro; their Test connection loaders remain in the free admin script. Enabled connection tests load provider scripts; protected forms obtain browser tokens and send tokens/secrets server-side for verification.

reCAPTCHA: https://www.google.com/recaptcha/api.js, https://www.gstatic.com, https://www.google.com/recaptcha/api/siteverify. Google Terms/Privacy above apply.

Turnstile: https://challenges.cloudflare.com/turnstile/v0/api.js, https://challenges.cloudflare.com/turnstile/v0/siteverify. Terms, Privacy.

Bundled libraries

Alpine.js 3.17.2: minified official npm distribution, MIT. Versioned source and build tools; the exact upstream license is included at modules/alpine-js-enqueue/LICENSE-Alpine.md. The bundle includes Vue shared/reactivity 3.5.41, MIT: versioned source, with its exact upstream license at modules/alpine-js-enqueue/LICENSE-Vue.txt. See modules/alpine-js-enqueue/THIRD-PARTY.txt for upstream URLs and notice checksums.

SVG Upload: prefixed svg-sanitize 1.0.0, GPLv2+; source/license, also in modules/svg-upload/includes/svg-sanitize. Local sanitization removes external resources, unsafe CSS/active content; ambiguous IDs, excessive complexity and invalid reference graphs are rejected.