Settings screen showing the approved plugin/theme lists and the enforcement toggle.
WLock lets a site administrator define an approved whitelist of plugin and theme slugs. Once enabled, any attempt to install something that isn’t on the list — whether searched for in the WordPress.org repository or uploaded as a .zip — is blocked with a clear on-screen explanation.
This is useful for:
- Agencies who manage client sites and want to prevent clients (or other admin-level users) from installing unapproved plugins/themes that cause support issues.
- Site owners who want a second line of defense against accidental installs of low-quality or conflicting plugins.
- Teams with multiple administrators who want to standardize which tools are allowed on a site.
What it does not do
- It does not affect activating, deactivating, deleting, or updating anything already installed — only fresh installs are restricted.
- It does not restrict installs made outside of wp-admin (WP-CLI, SFTP, etc.) — those bypass the WordPress installer entirely and are outside what any plugin can intercept.
- It is fully self-managed: whoever has the
manage_optionscapability on the site can enable/disable it and edit the whitelist at any time from Settings WLock, and can deactivate the plugin like any other.