Skip to content
PHP security alert Two critical PHP flaws (php2shell) were fixed on 21 October. Is your site's PHP patched? Check in a minute →
OvKit
Menu
Download free

44 switches for WordPress. All off until you flip one.

Strip the bloat, shut the doors bots try first, and tidy the admin. Each switch tells you what it does and what it could break, and every change can be undone.

Download free Pro is $3.99 a month

Full plugin name: Ovanap Admin Toolkit. Free, all 44 switches, no account. WordPress 6.3+, PHP 7.4+.

Performance
Security
Cleanup
Admin UI
Tracking
Frontend
Maintenance

A fresh WordPress site leaves these circuits live.

None of this is a bug. It is how WordPress ships, and each one has a circuit that cuts it.

  1. /xmlrpc.php answers on every site

    Bots use it to try hundreds of passwords in a single request.

    Circuit 18 Block remote login attacks

  2. /?author=1 redirects to your username

    Half of a login is handed to anyone who asks.

    Circuit 13 Hide author usernames from URL probing

  3. /wp-json/wp/v2/users lists authors

    The same usernames again, as tidy JSON.

    Circuit 17 Block public user list API

  4. Your WordPress version in the page source

    Scanners match it against known holes before they try anything.

    Circuit 12 Remove WP version number

  5. An emoji script on every page

    Extra code to load on every visit, on sites that rarely use it.

    Circuit 1 Remove unnecessary emoji assets

  6. A PHP editor inside the dashboard

    One stolen admin password and malware goes straight into your theme.

    Circuit 19 Disable file editor in admin

Built so it cannot surprise you.

Off by default
Installing the plugin changes nothing. You flip each switch yourself, or apply a preset for a blog, a business site, a WooCommerce shop or an agency client site.
A risk label before every switch
Safe, Recommended, Advanced or Careful, with a plain note on what could break and on which kind of site.
A logbook with rollback
Every change is written down with who made it. Restore any earlier state in one click.
A scan to start from
It looks at your plugins, theme and settings and points at what is worth switching first.

Pro: know something is wrong before your client does.

Three tools on top of the free plugin. Put it on every site you look after.

  • Security Check. Looks for the signs of a hacked site: changed core files, malware code in plugins and the theme, PHP files hiding in uploads, spam redirects, injected scripts, new admin accounts. Also tells you if your server's PHP is missing the php2shell fixes.
  • Custom tracking code. Head and body code for anything the free plugin does not cover: Pinterest, Clarity, Hotjar, LinkedIn.
  • Emergency recovery link. When an update takes the site down, one secret link switches every other plugin off and gets you back into the admin.

$3.99 a month · or $39 a year · cancel any time

One email when Pro launches. Nothing else. Privacy

Checkout opens soon. 14-day refund on every payment.

Example report sample data
  • Fix this
    Modified WordPress core fileswp-includes/version.php
  • Fix this
    Code that looks like malwarethemes/flavor/functions.php
  • Fix this
    PHP files in the uploads folderuploads/2026/10/img.php
  • Check
    PHP security patch (php2shell)8.3.35: ask your host
  • Check
    New administrator accountwp_support_2
  • OK
    .htaccess redirectsnone to other domains

Before you install.

Is the free version actually complete?

Yes. All 44 switches, the scan, the logbook with rollback, presets and export / import are free. Pro adds three separate tools; it does not unlock anything held back.

Will it break my site?

Not by installing it: everything starts off. Each switch shows its risk before you flip it, and the logbook can put any earlier state back.

Can it tell me if my site has been hacked?

Pro’s Security Check looks for the signs most infections leave: changed core files, malware code patterns, PHP files in uploads, spam redirects, injected scripts and admin accounts you did not create. It reports what it finds and changes nothing. It does not remove malware for you; if it finds something, the report says where to look.

Does it replace Wordfence or my cache plugin?

No. It closes common gaps and removes bloat, but it is no firewall or malware cleaner and does no page caching. Run it next to those.

Does it work with WooCommerce?

Yes. Switches that touch shop pages keep WooCommerce working (product search stays on when you turn site search off, for example), and WooCommerce conversion tracking is included.

What happens if I cancel Pro?

Pro stops at the end of the period you paid for. The free plugin keeps working exactly as before.

Who makes OvKit?

Ovanap, the trading name of Monine AS in Norway. Write to hello@ovanap.no, or read how we build and test it.

Flip the first switch today.

Download free