UltimaKit consolidates the admin enhancements, site optimizations, security hardening and everyday tweaks you would normally install a dozen separate plugins for — into one modular toolkit.

Every capability is a module you switch on or off individually. Nothing is forced on you, and a module you have not enabled contributes no code, no hooks and no queries to your site.

Everything is free

Since version 3.0.0 there is no Pro version. The modules that used to be sold as UltimaKit Pro, including the WooCommerce and Gravity Forms modules, are included in this plugin. A few Pro modules that were unreliable or unsafe were retired instead (see the FAQ).

Why a modular toolkit?

Every single-purpose plugin you add brings its own update cycle, its own settings page, its own autoloaded options and its own attack surface. Ten small plugins is ten things to keep patched.

UltimaKit gives you one plugin to update, one place to configure, and one codebase to trust — with 180 modules, all free.

Built to stay out of the way

Bundling a lot of features usually means bundling a lot of overhead. UltimaKit is engineered specifically to avoid that:

Disabled modules never load. A module that is off is not instantiated, its class file is never read from disk, and none of its hooks are registered.
Settings load in a single query. All module configuration is read once per request and cached, rather than queried module by module.
Module discovery is cached. The plugin does not scan its own directories on every page load.
Admin assets only load on UltimaKit screens. Nothing is enqueued on the rest of your dashboard, and nothing at all is enqueued on the front end unless a module you enabled needs it.

Content Management

Duplicate Pages & Posts — clone any post, page or custom post type in one click, including post meta, terms and taxonomies
Post & Page Order — drag-and-drop ordering for posts, pages and custom post types
Media Replacement — swap the file behind an existing attachment without breaking its URL
SVG Upload — allow SVG logos and icons in the Media Library, sanitized on upload
Auto-Generate Page Slugs — clean, readable slugs created automatically
Featured Image Column and ID Column — see thumbnails and post IDs directly in admin list tables
Change Excerpt Length and Read More Text
Limit Post Revisions — stop revision tables growing without bound
Content Expiry Reminder, Dynamic Year shortcode, Lowercase Filenames for Uploads

Admin Interface

Hide Admin Notices — move nagging plugin banners into a dedicated panel instead of your workflow
Hide Admin Bar and Cleanup Admin Bar — remove “Howdy”, the WordPress logo and other clutter
Empty Admin Dashboard — hand clients a dashboard without widget noise
Enhance List Tables, Add ID Column, Hide Screen Options Tab
Hide WordPress Version Number
Remove Dashboard Welcome Panel, Remove Login Shake Animation
Clean User Profiles — strip the fields your site does not use

Log In / Out & Register

Change Login URL — move wp-login.php to a custom slug
Login Attempts — limit failed logins and lock out repeat offenders
Auto-Logout Inactive Users — close idle admin sessions
Extend Login Expiration Time
Hide Login Errors — stop the login form confirming which half of the credentials was wrong
Disable Login by Email, Disallow User Registration, Disable New User Notifications
User Last Login Timestamp

Security

Block “Admin” Username — refuse the single most brute-forced username
Force Strong Password and Force SSL
Disallow WP File Edit — remove the theme and plugin editors
Disallow Bad Requests — block common malicious query strings
Disallow Directory Listing
Password Protection — put the whole site behind a password
Allow Only Logged-In Users
Lock Site URL and Lock Admin Email — prevent silent takeover via changed URLs or email
Obfuscate Email Addresses — stop scrapers harvesting mailto: links
Disallow Plugin Upload / Disallow Theme Upload

Disable Components

Thirty-nine one-click switches for the parts of WordPress you do not use — each one removing queries, requests or output:

Disable Comments, Disable XML-RPC, Disable REST API
Disable Gutenberg / Full Site Editing / Widget Blocks
Disable Emojis, Disable Embeds, Disable RSS Feeds
Disable Auto Updates and Automatic Update Emails
Disable Application Passwords, Disable Attachment Pages, Disable Author Archives
Disable Block Directory, Disable jQuery Migrate, Disable Sitemaps
…and many more

Optimizations

Remove Query Strings From Static Files
Remove WP Block Library CSS — drop the block stylesheet on sites that do not need it
Broken Link Checker
Meta Tag Editor — titles and meta descriptions without a full SEO suite
Redirect 404 to Homepage
Featured Image Checker, Navigation Menu Visibility, Set oEmbed Max Width

Custom Code

Custom CSS and Custom JS — site tweaks without touching your theme
Custom Admin Footer
Pixel Tag Manager — Google Analytics, Meta Pixel and Pinterest tags without another plugin

Utilities

Sitemap Generator
Top Notification Bar — announcement bar with full styling control
Change Outgoing Email Sender and Force Send All Email To (useful on staging)
GDPR Compliance Tool — cookie consent notice
Add Page Slug to Body Class

Power tools

Modules for agencies and power users that used to be sold as Pro:

Admin Activity Logger — a full audit trail of who changed what
Custom Post Type / Taxonomy builder — no code required
Redirect Manager — 301/302 redirects with a proper UI
Maintenance Mode, Schema Markup Generator, Robots.txt Editor
Multiple User Roles, Admin UI customizer, Quick Admin Search
SEO helpers: SEO Title & Meta Description Editor, Readability Score, Keyword Density Checker, Keyword Suggestion, Image Alt Text Checker, Duplicate Content Checker, Post Publish Checklist

WooCommerce

Eighteen store-specific modules:

Disable Guest Checkout, Auto-Redirect to Checkout on Add to Cart, Auto Apply Coupons
Hide Out Of Stock Products, Show Free Shipping Only, Show Stock Level Display
Product Timer
Custom Add to Cart Button Text and Custom Sale Badge Text
Remove Related Products, Remove Product Permalink on Shop, Disable Product Sorting Dropdown, Disable Breadcrumbs
Change “$0.00” to “Free”, Show SKU on Archive Pages, Hide Quantity Selector, Disable Reviews, Disable WooCommerce Widgets

Gravity Forms

Twelve modules for Gravity Forms, including Smart Phone Field, Date-Time Field, Simple Range Slider, Email Blacklist, Pre-Submission Preview, Pre-Filled Form Fields via URL, Copy Form Data to Clipboard and Lock Submissions After a Deadline.

External services

UltimaKit does not contact any outside service unless you switch on a module that needs one. These modules connect to third-party services:

Keyword Suggestion sends the keyword you type in the post editor to Google’s autocomplete service (suggestqueries.google.com) when you ask for suggestions. Google terms and privacy policy.
Pixel Tag Manager adds the tracking tags you configure to your site: the Google tag (googletagmanager.com), the Meta Pixel (connect.facebook.net, facebook.com) and the Pinterest Tag (s.pinimg.com, ct.pinterest.com). Only tags whose IDs you enter are added. Visitors’ browsers then send page-view data to those services. Google terms and privacy policy; Meta terms and privacy policy; Pinterest terms and privacy policy.
Broken Link Checker sends a request to each link in your content to check that it still works. Only the link itself is requested; no site data is sent.
Usage data (Freemius): when you activate UltimaKit you can choose to opt in to sharing usage data. Only if you opt in, your profile (name and email), basic site details (URL, WordPress and PHP versions) and plugin and theme events are sent to Freemius (freemius.com). Freemius terms and privacy policy.

UltimaKit – Admin Enhancements, Security, Optimization & Site Tweaks