內容簡介
DIGITO Toolkit 是一款輕量級的 WordPress 外掛，將五個獨立可切換的管理工具整合在一起。用戶可以根據需求啟用所需模組，並確保未啟用的模組不會影響網站性能。
【主要功能】
• 安全健康檢查：提供本地診斷，評估網站安全狀況
• 維護模式：顯示自訂維護或施工頁面
• 安全 SVG 上傳：安全上傳經過清理的 SVG 圖形
• 經典編輯器：恢復傳統的 WordPress 編輯介面
• 複製文章：快速複製文章和頁面內容
• 事件日誌：保留最近的非敏感事件記錄
外掛標籤
開發者團隊
原文外掛簡介
DIGITO Toolkit groups five independently switchable WordPress administration tools in one lightweight plugin. Enable only the modules you need. Disabled modules do not boot their feature hooks.
Security Health
Security Health provides administrator-only, local diagnostics for WordPress update posture, HTTPS configuration, debug exposure, the dashboard file editor, privileged-account signals, public author exposure, selected response headers, and XML-RPC posture.
Its score summarizes the checks that could run. Pass earns full weight, Warning earns half, Fail and Unknown earn no points, and Not Applicable is excluded. The score is guidance, not a guarantee that a site is secure. Every result includes concise evidence, limitations, and a recommended next step. Security Health does not scan site files for malware, replace WordPress Site Health, or use a remote vulnerability service.
Optional controls are off by default and reversible:
Login-attempt protection applies a 15-minute client cooldown after five failures within 15 minutes. It stores keyed pseudonymous counters rather than raw IP addresses or usernames. Administrators must explicitly confirm activation. The documented DIGITO_TOOLKIT_DISABLE_LOGIN_PROTECTION configuration constant provides emergency recovery.
WordPress response headers can add X-Content-Type-Options and Referrer-Policy when WordPress has not already supplied them. The control does not edit server or CDN configuration and does not add CSP or HSTS.
XML-RPC can remain in observe-only mode or be disabled after an explicit compatibility warning. Disabling it can affect publishing clients, mobile apps, Jetpack, and other integrations.
Manual and optional daily scheduled scans evaluate the same bounded local checks. Only the latest scheduled summary is retained for up to seven days.
A bounded local event log retains up to 500 allowlisted, nonsensitive events for seven days. Clearing it requires administrator authorization and explicit confirmation.
Security Health is off by default. Its screen and settings require the WordPress manage_options capability. It does not add a public API, telemetry, remote accounts, automatic destructive remediation, or network-wide Multisite administration.
Classic Editor
Restore the familiar WordPress Classic Editor for posts and pages.
Duplicate Page & Post
Quickly duplicate posts, pages, and supported custom post types with their content and settings. Copies are created as drafts through capability- and nonce-protected WordPress actions.
Maintenance Mode
Temporarily display a customizable Maintenance or Under Construction page to visitors. Configure the message, presentation, optional Media Library logo, and optional countdown. Authorized administrators retain access. Public maintenance responses use HTTP 503 and Retry-After headers.
Page-cache, hosting-cache, and CDN layers can serve stale HTML without reaching WordPress. Purge those caches after changing Maintenance Mode when needed.
A cache that serves stored HTML without reaching WordPress cannot be overridden by the Toolkit.
Safe SVG Upload
Securely upload sanitized SVG graphics to your WordPress Media Library. The module is off by default and is limited to trusted administrators with upload permission; Multisite additionally requires a super administrator.
Accepted SVGs are parsed and sanitized locally. The default upload limit is 1 MiB. Scripts, event handlers, animation, foreignObject, unsafe CSS, external resources, data URLs, document type declarations, entities, malformed XML, and files that cannot be verified are rejected. Sanitized attachments include Media Library previews and dimensions. Safe SVG Upload does not optimize raster images or promise support for every SVG authoring feature.
Privacy and local processing
DIGITO Toolkit does not include Toolkit telemetry, visitor tracking, remote accounts, or remote security scanning. Settings, diagnostic summaries, and the bounded Security Health event log remain in the site’s WordPress database. No raw IP address, username, credential, cookie, request payload, site content, or diagnostic report is sent to DIGITO WEBS.
Compatibility and limitations
The plugin requires WordPress 6.8 or later and PHP 8.2 or later. Security Health evaluates WordPress-visible evidence and cannot verify every server, proxy, CDN, certificate, WAF, or external service. Its optional controls affect WordPress-generated behavior only.
Multisite support is best effort and site-local. The Toolkit does not provide shared Network Admin settings, network-wide provisioning, or complete network-wide uninstall cleanup.
The bundled enshrined/svg-sanitize library is GPL-2.0-or-later. Source and license details are recorded in the distributed Composer metadata and vendor license.
