=== Ovanap Admin Toolkit ===
Contributors: ovanap
Tags: admin, cleanup, security, performance, hardening
Requires at least: 6.3
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 3.10.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Replace a stack of single-purpose tweak plugins with one toolkit: cleanup, hardening, performance and admin tidying, each behind a simple toggle.

== Description ==

Ovanap Admin Toolkit is a lightweight WordPress admin toolkit that replaces scattered tweak plugins with one organised dashboard.

Many WordPress sites collect several small utility plugins: one to disable comments, one to remove emoji scripts, one to hide the login page, one to add an analytics tag. Each one is another update to track and another possible conflict.

Ovanap Admin Toolkit puts these tweaks in one plugin, with clear risk labels, an activity log with rollback, and a local site environment scan.

Every feature is off until you switch it on.

= What it does =

**Performance (10 features)**
Remove emoji assets, dashicons on the front end, jQuery Migrate, oEmbed scripts, query strings from static files, the s.w.org DNS prefetch, block editor CSS on pages that do not need it, and self-pingbacks. Limit the Heartbeat API. Turn off lazy loading for above-the-fold images.

**Security (10 features)**
Hide the login page URL, limit login attempts, block XML-RPC, block author enumeration, block the public REST API user list, disable the theme and plugin file editor, hide login error hints, remove the WordPress version number, add security headers, disable application passwords.

**Cleanup (9 features)**
Disable comments entirely, RSS feeds, author pages, attachment pages and front-end search. Remove the RSD link, WLW manifest, shortlink tag and REST API discovery link.

**Admin UI (11 features)**
Smart admin notice summary, clean dashboard widgets, custom admin footer text, custom login page logo and colours, quick site title and tagline editor, custom favicon, hide the Help tab, hide Screen Options, hide the core update nag, disable the admin email verification prompt, and a cache manager in the admin bar.

**Tracking (2 features)**
Add Google Tag Manager, Google Analytics 4, Meta Pixel and TikTok Pixel by entering their IDs, each with its own enable switch. WooCommerce conversion events (product view, add to cart, purchase). See "External services" below.

**Frontend (1 feature)**
Announcement bar for visitors (holiday notices, shipping delays, sales) with a close button and a homepage-only option.

**Maintenance (1 feature)**
Maintenance mode with a branded 503 page that tells search engines to come back later. Administrators keep seeing the normal site.

= Site environment scan =

The toolkit scans your installation locally and reports:

* Duplicate tracking tags (for example GTM loaded by two plugins)
* No cookie consent plugin
* No cache plugin or SEO plugin
* Login protection and security plugin overlap
* Search engine visibility, SSL status, debug mode and version exposure

The scan runs on your server and sends nothing anywhere.

= Key principles =

* Risk labels: every feature is marked Safe, Recommended or Advanced
* Activity log: every settings change is recorded and can be rolled back
* Clean uninstall: deleting the plugin removes all of its data
* No account, no licence key, no telemetry: the plugin never contacts Ovanap or any other server on its own

== External services ==

The plugin itself makes no server-side HTTP requests and sends no data to Ovanap. The optional tracking features below load third-party scripts in your visitors' browsers. Each one is off by default and loads only after a site administrator switches on "Tracking & analytics codes", enables that service and saves a valid ID. These services set cookies and may need visitor consent under privacy law (for example GDPR and ePrivacy); configuring consent is the site owner's responsibility.

= Google Tag Manager =

Loads a Google Tag Manager container so the site owner can manage tags in GTM.

* Loaded from: https://www.googletagmanager.com/gtm.js (and https://www.googletagmanager.com/ns.html for browsers without JavaScript)
* When: on every front-end page view, once GTM is enabled with a container ID (GTM-XXXXXXX)
* Data sent: the container ID, the page URL and referrer, the visitor's IP address, browser and device information, and whatever the tags configured inside the container collect
* Terms of Service: https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/
* Privacy Policy: https://policies.google.com/privacy

= Google Analytics 4 (gtag.js) =

Measures site traffic in the site owner's Google Analytics property. Only loaded when Google Tag Manager is not enabled, to avoid counting twice.

* Loaded from: https://www.googletagmanager.com/gtag/js
* When: on every front-end page view, once GA4 is enabled with a Measurement ID (G-XXXXXXXXXX)
* Data sent: the Measurement ID, page URL, title and referrer, the visitor's IP address, browser, device and screen information, an analytics cookie identifier, and the WooCommerce events below when that feature is enabled
* Terms of Service: https://marketingplatform.google.com/about/analytics/terms/us/
* Privacy Policy: https://policies.google.com/privacy

= Meta Pixel =

Measures ad conversions for the site owner's Meta (Facebook and Instagram) ads.

* Loaded from: https://connect.facebook.net/en_US/fbevents.js (and https://www.facebook.com/tr for browsers without JavaScript)
* When: on every front-end page view, once Meta Pixel is enabled with a Pixel ID
* Data sent: the Pixel ID, a PageView event with the page URL and referrer, the visitor's IP address, browser information and Meta cookies, and the WooCommerce events below when that feature is enabled
* Terms of Service: https://www.facebook.com/legal/technology_terms
* Privacy Policy: https://www.facebook.com/privacy/policy/

= TikTok Pixel =

Measures ad conversions for the site owner's TikTok ads.

* Loaded from: https://analytics.tiktok.com/i18n/pixel/events.js
* When: on every front-end page view, once TikTok Pixel is enabled with a Pixel ID
* Data sent: the Pixel ID, a page view event with the page URL and referrer, the visitor's IP address, browser information and TikTok cookies
* Terms of Service: https://ads.tiktok.com/i18n/official/policy/business-products-terms
* Privacy Policy: https://www.tiktok.com/legal/page/row/privacy-policy/en (visitors in the EEA, UK and Switzerland: https://www.tiktok.com/legal/page/eea/privacy-policy/en)

= WooCommerce conversion tracking =

Does not load any script of its own from a third party. On a product page, on add to cart and on the order confirmation page it passes the event (product ID or SKU, name, category, price, quantity, currency, order ID and order total; no customer name, email or address) to Google Tag Manager's dataLayer, or directly to Google Analytics 4 and Meta Pixel when those are enabled above. The data then goes to those services under the terms listed above.

== Installation ==

1. Upload the `ovanap-admin-toolkit` folder to `/wp-content/plugins/`, or install the plugin from the Plugins screen.
2. Activate the plugin through the Plugins screen.
3. Open Admin Toolkit in the admin menu.
4. Run the site scan to see what needs attention.
5. Switch features on one at a time, or start with "Apply safe defaults".

== Frequently Asked Questions ==

= Does it replace security plugins like Wordfence? =

No. It provides lightweight hardening basics (hidden login URL, login attempt limits, XML-RPC blocking). For a firewall and malware scanning, use a dedicated security plugin alongside it.

= Does it replace cache plugins? =

No. It removes unnecessary scripts and assets to reduce page weight and can trigger the purge of supported cache plugins. For full page caching, use a cache plugin.

= Will enabling features break my site? =

Every feature carries a risk label, and Advanced features explain their trade-offs before you switch them on. Every change is logged and can be rolled back from the Activity Log.

= Does the plugin send any data externally? =

The plugin does not contact any server by itself. Only the optional tracking features load third-party scripts in visitors' browsers, and only after you enable them and enter an ID. See "External services" for exactly what is sent.

= Does it work with WooCommerce? =

Yes. WooCommerce-only features appear when WooCommerce is active, and features that could conflict with WooCommerce are flagged.

= What happens when I deactivate the plugin? =

Its tweaks stop. Maintenance mode turns off, search engine visibility is restored and the login URL returns to the default. Your settings are kept for re-activation.

= What happens when I delete the plugin? =

All of its data is removed from the database: settings, scan results and the activity log.

= I used the earlier OvKit plugin. How do I move over? =

Settings are shared, so nothing has to be re-entered. Deactivate OvKit, then activate Ovanap Admin Toolkit. Remove the old ovkit folder with your file manager or SFTP rather than with the Delete link on the Plugins screen: the old plugin's uninstall routine would erase the shared settings.

== Screenshots ==

1. Dashboard with the site environment scan.
2. Feature toggles with risk labels and detection badges.
3. Tracking setup with individual service switches.
4. Activity log with rollback.

== Changelog ==

= 3.10.1 =
* Site scan: "Debug mode" now also flags WP_DEBUG on with WP_DEBUG_DISPLAY left unset (WordPress then shows errors on pages).
* Site scan and Site Health now check whether the server's PHP version includes the October 2026 "php2shell" security fixes (CVE-2026-109618, CVE-2026-109619) and say what to ask your host if it does not.

= 3.10.0 =
* Renamed from OvKit to Ovanap Admin Toolkit (new slug and text domain; settings carry over).
* All scripts and styles now load through the WordPress script and style APIs.
* Settings are read field by field and sanitized by type; tracking IDs must match the vendor's ID format.
* Removed free-form code fields; tracking is configured with IDs only.
* "Disable file editor" now uses a capability filter instead of a global constant.
* Debug messages go to the PHP error log (only with WP_DEBUG_LOG) instead of a file in the plugin folder.
* Deactivation no longer changes which other plugins are active.
* The custom admin footer no longer adds a credit link by default.

= 3.5.3 =
* Added benefit descriptions to all features.
* Fixed the login form action URL for the hidden login page.
* Fixed attachment page redirects to the parent post.
* Fixed XML-RPC blocking for all request types.
* Features now clean up after themselves when switched off.

= 3.4.0 =
* Added the site environment scan.

= 3.0.0 =
* Initial release.

== Upgrade Notice ==

= 3.10.1 =
Adds a check that tells you whether your server's PHP has the php2shell security fixes.

= 3.10.0 =
New name and slug. Moving from OvKit: deactivate OvKit before activating this plugin, and remove the old folder without using Delete so your shared settings are kept.
