XeroWP
Sysadmin Total Suite
Sysadmin Total Suite

Sysadmin Total Suite

0/5 (0 ratings) — active installs Updated Oct 7, 2026
ai botsintegrityperformanceprofilingsecurity
Download v5.4.1

This plugin brings together several maintenance tools for WordPress in one admin panel:

  • Core integrity: verifies your WordPress files against the official checksums and reports which ones are modified, missing or not part of the core. For a modified file it can show a diff against the official copy, so you can see exactly what changed. The plugin never modifies your files: to repair the core it points you to Dashboard > Updates > Reinstall now, which is WordPress’s own mechanism.
  • Audit: lists WordPress, the installed plugins and the installed themes with their pending updates, and flags the plugins and themes that have been closed on WordPress.org or have not been updated in more than two years. Optionally, and only after you enable it, it checks them against the free WPVulnerability database and shows the publicly known vulnerabilities that affect the installed versions, with their severity and references (CVE and others). Updates are always installed through WordPress’s own Updates screen.
  • Unused media: finds media library items that are not referenced anywhere on the site (posts, pages, custom fields, page builders, widgets, theme settings…) and files in the year/month upload folders that do not belong to any media item. Copies of original images kept by optimization plugins are listed apart. Unused items can be moved to a quarantine: they are hidden from the media library and their files are moved aside, and they can be restored at any time. Only emptying the quarantine deletes them, with a double confirmation.
  • Profiling: measures the front page load time (core, plugins, theme, SQL and outgoing HTTP calls), keeps a history and displays it as charts.
  • Disk usage: a read-only report of the space used by the WordPress core, the uploads (by year and month), each plugin and theme, the other wp-content folders (cache, plugin backups…) and any non-WordPress folder in the site root, plus the size and overhead of every database table and the free space on the server disk. Large sites are measured in batches to avoid timeouts.
  • Check users: lists the registered users (name, registration date, role) and lets you delete them with a double confirmation.
  • WPO (Web Performance Optimization): active plugins, size of the autoloaded options, expired transients, WP-Cron status including cleanup of orphaned tasks, cache detection and environment versions (PHP, MySQL/MariaDB, WordPress).
  • AI bot blocking: robots.txt opt-out plus real User-Agent blocking (HTTP 403) for AI crawlers, selectable bot by bot.

Every action requires administrator capabilities and is protected with nonces. The plugin does not write to or delete anything inside the WordPress core directories. The operations that do change something (deleting a user, clearing expired transients, removing orphaned cron tasks, blocking a bot) act on the database and always ask for confirmation first.

External services

This plugin connects to WordPress.org services in order to verify the integrity of the core and to check the status of the installed plugins and themes, and, only if you explicitly enable it, to the WPVulnerability service. Nothing is contacted until you start an action that needs it (running an analysis, viewing a diff or running an audit scan).

WordPress.org (provided by the WordPress Foundation; see https://wordpress.org/about/privacy/):

  1. WordPress.org checksums API (https://api.wordpress.org/core/checksums/1.0/): queried when you run the integrity analysis, to obtain the official checksums for your version and locale. The WordPress version and the site locale are sent. On sites with a translated locale, the checksums of the international (en_US) package may also be requested, to avoid reporting false positives.
  2. WordPress.org downloads (https://downloads.wordpress.org/ and the localized sites https://*.wordpress.org/): the official ZIP package for your version is downloaded only when you ask to see the differences (diff) of a modified core file. The version and locale are sent to build the package URL.
  3. WordPress.org plugins and themes APIs (https://api.wordpress.org/plugins/info/1.2/ and https://api.wordpress.org/themes/info/1.2/): queried when you run a scan in the Audit section, to know whether each plugin or theme is still available in the directory, when it was last updated and up to which WordPress version it has been tested. The slug of each installed plugin and theme is sent. Pending updates are read from the data WordPress itself already keeps.

WPVulnerability (optional, disabled by default):

  1. WPVulnerability API (https://www.wpvulnerability.net/): a free and open database of WordPress vulnerabilities. It is only contacted if you enable “Check WordPress, plugins and themes against the WPVulnerability database” in the Audit section, and only when you run a scan. The slug of each installed plugin and theme is sent, but not their versions: that comparison is done on your site. For the WordPress core, the WordPress version number is sent, because the service can only look up the core by version. Your site address is never sent. Disabling the option also deletes the vulnerability data already obtained. Service: https://www.wpvulnerability.com/ — Privacy policy: https://www.wpvulnerability.com/privacy/ — Terms: https://www.robotstxt.es/legal/

No personal data is sent to any of these services and no other third-party service is contacted.

The official package is used only as a read-only reference copy of the core, to compare it with the files on your site. No code is fetched from any third-party server, nothing from the download is executed, and nothing from it is ever written to the WordPress core directories: the package is only cached in the plugin’s own folder inside the uploads directory.