內容簡介
ITX UserOps 是一款整合的使用者管理外掛，提供統一的使用者控制台，讓網站管理員能夠輕鬆監控登入活動、管理使用者會話及審計日誌，提升使用者管理的效率與安全性。
【主要功能】
• 統一的使用者儀表板，顯示所有使用者資訊
• 一鍵禁用使用者帳號，保留內容不刪除
• 活躍會話管理，隨時查看與終止會話
• 登入與使用者審計日誌，記錄所有登入嘗試
• 快速篩選與排序功能，支援大量使用者
外掛標籤
開發者團隊
② 後台搜尋「ITX UserOps — User Management, Login Activity, Sessions & Audit Log」→ 直接安裝（推薦）
原文外掛簡介
WordPress has no unified user administration console. To see who is online, keep a login audit trail, force-logout a compromised account, disable a departed contractor without deleting their content, find out whether the password reset actually went out, or edit a role without deciphering sixty capability checkboxes, you normally need five or six single-purpose plugins.
ITX UserOps replaces that whole stack with one fast, cohesive console — the kind of user administration Microsoft 365 or Google Workspace admins get out of the box.
Website | Documentation | All features | Changelog | Support
Unified user dashboard
Every user in one table: online-now indicator, last login, last activity, active sessions, role, status, registered date, post count
Server-side search, sorting and pagination — stays fast at 100,000+ users
Quick filters that combine: role, status, online now, last login (today / 7 / 30 / 90 days / never), registered date range, inactive 30/60/90 days
Overview tiles — online now, logins today, failed logins, disabled accounts, security alerts — each clickable, drilling into the matching filtered view
Toggleable columns, per-admin
Dashboard documentation →
Disable users without deleting them
One click disables an account: the user can no longer log in on any channel — wp-login, XML-RPC, REST, application passwords — and every active session is destroyed instantly
Content, comments and history stay intact
Customizable “account disabled” message
Safety rails: you can never disable yourself or the last administrator
Account status documentation →
Session management
See every active session per user: browser, OS, device, IP, signed-in time, last activity
Terminate any single session, log a user out everywhere, or log all users out (your own session survives)
Sessions documentation →
Login & user audit log
Dedicated Login Log: every sign-in attempt — success, failed or blocked — with user, IP, device, user agent, and which door it came through (login form, XML-RPC, REST API or WP-CLI)
Records logins, failed logins (with attempted username), logouts, blocked logins, registrations, deletions, role changes, password changes/resets, email and profile changes, application passwords, and bulk actions
Site visibility: content published/updated/trashed/deleted (with author and actor), plugin activations/deactivations, theme switches and WordPress core updates
Tamper-evident: each entry is chained to the one before it, so database-level tampering — an edited dump, SQL injection, a rogue database user — is detectable
Filter by event, user, actor, IP, severity and date; full-text search; CSV export
Configurable retention (30 days up to keep-forever) with daily auto-purge
Brute-force flood protection: failed-login noise is aggregated, never table-flooding
Activity log documentation → · How tamper evidence works →
Email log
Every message WordPress hands to the mail server, recorded at the moment of hand-off: recipient, subject, timing, and what the server said back
Honest states: nothing is labelled “Delivered” or “Sent”, because your site cannot observe either. The good state is Handed off, failures carry the server’s error, and results another plugin merely claimed are shown as reported rather than observed
You choose which kinds of mail are logged — account mail on by default, high-volume kinds off — which is what keeps the log small on a busy store
Message contents are not stored unless you switch it on — and when you do, password reset links, one-time codes and application passwords are stripped before anything is written, so the log cannot become a way in
Its own retention setting with no “keep forever”, and one-click deletion of stored message contents
Email log documentation →
Role editor
WordPress permissions as a grid of areas (Posts, Pages, Media, Comments, Users, Site settings, Plugins & themes) against levels (None, View, Contribute, Manage) — instead of sixty raw checkboxes. Custom post types get their own row automatically
Draft-first: every edit collects into a draft and nothing touches the live role until you press Publish
A Plain English view of the role as toggleable statements, side-by-side role comparison, and people management — add someone to a role, move people out, reassign between roles
Capabilities the grid does not manage are never touched, and a role the grid cannot describe shows the exact difference instead of quietly rewriting it on save
“Restore WordPress defaults” puts the five built-in roles back exactly as WordPress ships them
Guardrails enforced on the server, not merely hidden in the screen: you cannot grant access you do not hold, change your own role, or demote the last administrator
Roles documentation →
Per-user profile drawer
Click any user for an Entra-ID-style panel: overview with 30-day login sparkline, live session list, that user’s complete activity trail, and the mail sent to them — without leaving the page
Profile drawer documentation →
Bulk actions
Multi-select users → change role, disable, enable, log out, send password reset, delete with content reassignment, export to CSV
Runs in batches with a progress bar — no timeouts on large sites
Bulk actions documentation →
Works behind Cloudflare and reverse proxies
Behind a CDN, load balancer or reverse proxy, logs normally record the proxy’s address instead of the visitor’s. Name your proxy (Cloudflare’s ranges are built in) and the real client IP is recorded instead
Forwarding headers are only trusted when the request genuinely arrives from a configured range, so they cannot be forged
Client IP documentation →
Privacy and GDPR
GDPR mode zeroes the last part of every captured IP before it is stored
Log retention is capped and auto-purged; email bodies are opt-in and redacted
Uninstalling can remove every trace of plugin data — your choice, off by default
Privacy documentation →
Extras
Live “online users” count in the admin bar and a user-overview dashboard widget
Online status and a UserOps details link right in the native Users screen
Works on multisite — each subsite gets its own console (multisite notes →)
Performance
Built to a strict budget: front-end requests incur at most one throttled database write per user per minute — no admin-ajax polling, no autoloaded bloat. Logs live in their own indexed tables, never in wp_options. The plugin makes no external HTTP requests and loads no remote assets.
Performance notes →
Free, and complete
Everything described above is free, fully functional, and stays that way. A separate premium edition exists for security teams — two-factor enforcement, passkeys, security alerts, temporary accounts, delegation and more — described at itxuserops.com/pricing. Nothing on this page requires it.
Development
The admin interface is a React app built with @wordpress/scripts. The
human-readable source lives in assets/src/; the compiled bundle in
assets/build/ is generated with:
npm install && npm run build
No third-party JavaScript libraries are bundled — the app uses the
@wordpress/* packages that ship with WordPress core. The plugin makes no
external HTTP requests and loads no remote assets.
