Features

Everything OvKit (full plugin name: Ovanap Admin Toolkit) can do. All 44 features are free. Each one is off until you switch it on and shows a risk label first. A feature name links to the guide that explains the setting, with or without the plugin.

Performance (10)

• Remove unnecessary emoji assets — Removes wp-emoji-release.min.js loaded on every page
• Remove dashicons on frontend — Stop loading 70KB icon font for visitors
• Remove query strings from CSS/JS — Strip ?ver=X.X from static resources
• Stop pinging WordPress.org — Remove emoji CDN prefetch hint
• Stop loading embed scripts — Remove embed discovery + wp-embed script
• Disable self-pingbacks — Stop WP from pinging itself on internal links
• Reduce admin background requests — Reduce to 60s or disable entirely
• Disable lazy load above fold — Fix LCP by loading hero images immediately
• Drop legacy jQuery polyfill — Drop compatibility script not needed by modern plugins
• Remove block editor CSS from frontend — Remove Gutenberg CSS on sites not using blocks

Security (10)

• Hide login error hints — Generic message on wrong username/password
• Remove WP version number — Strip generator tag from HTML, RSS, assets
• Hide author usernames from URL probing — Redirect author number scan attempts
• Disable application passwords — Remove WP 5.6+ app passwords feature
• Hide login page URL — Change wp-login.php to a custom URL of your choice
• Limit login attempts — Block IPs after repeated failed login attempts
• Block public user list API — Disable /wp-json/wp/v2/users endpoint
• Block remote login attacks — Disable the XML-RPC endpoint used in brute-force attacks
• Disable file editor in admin — Prevent editing theme/plugin files in browser
• Add security headers — Baseline hardening headers plus opt-in HSTS / Permissions-Policy / COOP

Cleanup (9)

• Remove RSD editing link — Remove EditURI/RSD meta tag from header
• Remove Windows Live Writer link — Remove Windows Live Writer reference
• Remove shortlink tag — Remove rel=shortlink from page header
• Remove REST API link from header — Remove api.w.org discovery link
• Disable attachment/media pages — Redirect media URLs to parent post or home
• Disable author pages — 301 redirect author archives to homepage
• Disable comment system entirely — Remove comments, admin menu, widgets, and admin bar item
• Disable RSS feeds — Redirect all feeds to homepage
• Disable frontend search — Remove search form and redirect /?s= queries

Admin UI (11)

• Disable admin email verification — Stop the “verify your email” popup
• Cache manager (admin bar) — Clear WordPress, page cache, and builder caches from the admin bar
• Hide WP core update nag — Remove “WordPress X.X available” banner
• Clean dashboard widgets — Remove Events, Quick Draft, Activity, At a Glance
• Custom admin footer text — Replace “Thank you for creating with WP”
• Hide Help tab — Remove tab for non-admin users
• Hide Screen Options tab — Remove tab for non-admin users
• Smart admin notices — Organize admin notices by priority instead of hiding them
• Custom login page logo — Replace WP logo on wp-login.php with your own
• Custom site favicon — Upload a favicon without digging through Customizer
• Quick site title & tagline — Change site name and tagline without leaving this page

Tracking (2)

• Tracking & analytics codes — Add GTM, GA4, Meta Pixel, TikTok Pixel — no extra plugins needed
• WooCommerce conversion tracking — Auto-send purchase & add-to-cart events to GA4, GTM, and Meta Pixel

Frontend (1)

• Announcement bar — Show a top notification bar for visitors (vacation, delays, sales)

Maintenance (1)

• Maintenance mode — 503 page for visitors + block all robots

Also free

• Site scan — duplicate tracking tags, no cookie consent plugin, missing cache or SEO plugin, conflicting security plugins
• Activity log with rollback — every settings change is recorded and can be undone
• Presets for blogs, business sites, WooCommerce shops and agency client sites
• Export and import of settings as a JSON file

Pro ($3.99 / month)

• Security Check — looks for signs of a hacked site: compares WordPress core files with the official release, finds malware code patterns in plugins and the theme, PHP files in the uploads folder, spam redirects in .htaccess, injected scripts and new admin accounts, checks whether PHP has the latest security fixes (including php2shell), flags outdated PHP, WordPress, plugins and themes, a public debug log, an open file editor and guessable admin usernames. It reads; it changes nothing.
• Custom code in head and after body — for tracking services the free plugin does not cover, such as Pinterest, Clarity, Hotjar or LinkedIn.
• Emergency recovery link — when an update takes the site down, one secret link switches off every other plugin and changes to a default theme. A second link puts everything back.

Pricing