內容簡介
ITX UserOps 是一款強大的用戶管理外掛，提供統一的用戶管理控制台，能夠追蹤登錄活動、管理會話及審計日誌，幫助網站管理員有效監控用戶行為及安全性。
【主要功能】
• 統一的用戶管理控制台
• 追蹤登錄活動與會話
• 審計日誌以監控用戶行為
• 強制登出被入侵的帳號
• 隱藏的管理員與外掛檢測
• 自動識別網站安全隱患
外掛標籤
開發者團隊
② 後台搜尋「ITX UserOps — User Management, Login Activity, Sessions & Audit Log」→ 直接安裝（推薦）
原文外掛簡介
WordPress has no unified user administration console. To see who is online, keep a login audit trail, force-logout a compromised account, disable a departed contractor without deleting their content, find out whether the password reset actually went out, or edit a role without deciphering sixty capability checkboxes, you normally need five or six single-purpose plugins. And none of them tells you when someone has got in and hidden their tracks from the admin screens.
ITX UserOps replaces that whole stack with one fast, cohesive console — the kind of user administration Microsoft 365 or Google Workspace admins get out of the box — and watches the site itself for the signs a break-in leaves behind.
Website | Documentation | All features | Changelog | Support
Signs of a break-in, even one that hides from wp-admin
Written from a real case: a site was held for weeks by attackers whose plugins hid themselves from the Plugins screen, whose administrators were hidden from the Users screen, and whose script was printed in front of every page. Each of those is now checked for, on the site itself:
An administrator who exists in the database but is hidden from the Users screen, or one created by code running on the server with nobody signed in — the file that did it is named
A plugin hidden from the Plugins screen, one running while the Plugins screen calls it inactive, and a plugin, must-use plugin or drop-in that appeared without being installed through WordPress
Code printed in front of your pages or REST responses. The plugin’s own screens read past it and keep working, and show what was added
An administrator signed in without the login form — a login cookie issued with no sign-in, so no password, two-factor or lockout was ever checked
A file inside wp-content that starts WordPress by itself when its address is requested — how backdoor endpoints run. The first week is spent learning what is normal on your site
Each finding says what happened and what to do. It is logged as Critical, emailed to the site’s admin address, sent to connected phones, and shown at the top of the WordPress Dashboard until it is dealt with
Management tools that hide on purpose (MainWP Child, ManageWP Worker, InfiniteWP, iThemes Sync) are left alone, and changing your own password or using View as is recognised
What it cannot see, plainly: code that loads before this plugin (a must-use plugin or a db.php drop-in) can hide from any check made inside WordPress, and a file that never loads WordPress is invisible to it. A new must-use plugin or drop-in is reported when it appears.
What needs your attention, in one place
The Overview: anything that needs an administrator now, who is online, the last 20 things that happened (filter by sign-ins, account changes or warnings) and fourteen days of sign-ins
Tiles for online now, logins today, failed logins, new users, disabled accounts, inactive accounts and security alerts — each opens the matching filtered view
Anything urgent also reaches the WordPress Dashboard as a notice, until it is dealt with or hidden until something new happens
Alerts that may not arrive are said out loud: when an email from UserOps cannot be sent, that is logged and the Dashboard says so, and it says when security email goes out over the server’s PHP mail with no phone connected to carry alerts instead
People: every account in one table
Every user in one table: online-now indicator, last login, last activity, devices, role, status, registered date, post count
Server-side search, sorting and pagination — stays fast at 100,000+ users
Quick filters that combine: role, status, online now, last login (today / 7 / 30 / 90 days / never), registered date range, inactive 30/60/90 days
Toggleable columns, per-admin, and CSV export
People documentation →
Disable users without deleting them
One click disables an account: the user can no longer log in on any channel — wp-login, XML-RPC, REST, application passwords — and every active session is destroyed instantly
Content, comments and history stay intact
Customizable “account disabled” message
Safety rails: you can never disable yourself or the last administrator
Account status documentation →
Session management
See every active session per user: browser, OS, device, IP, signed-in time, last activity
Terminate any single session, log a user out everywhere, or log all users out (your own session survives)
Sessions documentation →
Login and activity log
Login activity: every sign-in attempt — success, failed or blocked — with user, IP, device, user agent, and which door it came through (login form, XML-RPC, REST API or WP-CLI)
Records logins, failed logins (with attempted username), logouts, blocked logins, registrations, deletions, role changes, password changes/resets, email and profile changes, application passwords, and bulk actions
Site visibility: content published/updated/trashed/deleted (with author and actor), plugin installs, updates, activations, deactivations and deletions (with where each plugin gets its updates: WordPress.org, a vendor, or nowhere), theme switches and WordPress core updates
Every change to the plugin’s own settings, one entry per save — what changed, from what to what, and from where (a screen, WP-CLI, a scheduled task, the mobile app or an API key)
Four severity levels — Info, Notice, Warning and Critical — charted over the last 14 days
Tamper-evident: each entry is chained to the one before it, so database-level tampering — an edited dump, SQL injection, a rogue database user — is detectable
Filter by event, user, actor, IP, severity and date; full-text search; CSV export
Configurable retention (30 days up to keep-forever) with daily auto-purge
Brute-force flood protection: failed-login noise is aggregated, never table-flooding
Activity log documentation → · How tamper evidence works →
Email delivery log
Every message WordPress hands to the mail server, recorded at the moment of hand-off: recipient, subject, timing, and what the server said back
Honest states: nothing is labelled “Delivered” or “Sent”, because your site cannot observe either. The good state is Handed off, failures carry the server’s error, and results another plugin merely claimed are shown as reported rather than observed
You choose which kinds of mail are logged — account mail on by default, high-volume kinds off — which is what keeps the log small on a busy store
Message contents are not stored unless you switch it on — and when you do, password reset links, one-time codes and application passwords are stripped before anything is written, so the log cannot become a way in
Its own retention setting with no “keep forever”, and one-click deletion of stored message contents
Email log documentation →
Role editor
WordPress permissions as a grid of areas (Posts, Pages, Media, Comments, Users, Site settings, Plugins & themes) against levels (None, View, Contribute, Manage) — instead of sixty raw checkboxes. Custom post types get their own row automatically
Start a new role from a template — Site Manager, Content Reviewer, Support Agent, and SEO Manager or Order Handler where Rank Math, Yoast or WooCommerce is installed — or from a blank role
Draft-first: every edit collects into a draft and nothing touches the live role until you press Publish
A Plain English view of the role as toggleable statements, side-by-side role comparison, and people management — add someone to a role, move people out, reassign between roles
Capabilities the grid does not manage are never touched, and a role the grid cannot describe shows the exact difference instead of quietly rewriting it on save
“Restore WordPress defaults” puts the five built-in roles back exactly as WordPress ships them
Guardrails enforced on the server, not merely hidden in the screen: you cannot grant access you do not hold, change your own role, or demote the last administrator — and nobody but an administrator can edit an account with more access than their own
Roles documentation →
Per-user profile drawer
Click anyone for an Entra-ID-style panel: an overview with a 30-day sign-in chart, live sessions, that person’s complete activity trail, and the mail sent to them — without leaving the page
Act from the same panel: disable the account, log them out everywhere, send a password reset, or view the site as them
Profile drawer documentation →
Bulk actions
Multi-select users → change role, disable, enable, log out, send password reset, delete with content reassignment, export to CSV
Runs in batches with a progress bar — no timeouts on large sites
Bulk actions documentation →
Stop PHP running from uploads
One switch in Settings stops PHP files in wp-content/uploads from being run by visiting their address — the way a backdoor dropped there is used
Plugins that keep PHP in uploads and load it from inside WordPress are not affected, and nothing is deleted
On Apache and LiteSpeed the rule is written for you and then proved with a harmless test file, so the screen says whether your server actually obeys it; on nginx it shows the rule to give your host
Works behind Cloudflare and reverse proxies
Behind a CDN, load balancer or reverse proxy, logs normally record the proxy’s address instead of the visitor’s. Name your proxy (Cloudflare’s ranges are built in) and the real client IP is recorded instead
Forwarding headers are only trusted when the request genuinely arrives from a configured range, so they cannot be forged
Client IP documentation →
Privacy and GDPR
GDPR mode zeroes the last part of every captured IP before it is stored
Log retention is capped and auto-purged; email bodies are opt-in and redacted
Uninstalling can remove every trace of plugin data — your choice, off by default
Privacy documentation →
Mobile app
Your sites in your pocket, free: who is online, sign-ins and failed sign-ins, recent activity and the people on the site — with the buttons to disable or re-enable an account, sign someone out everywhere, or send a password reset. Alerts arrive on signs of a break-in, and when an administrator account appears, someone is made an administrator, sign-ins fail in a burst, or an account is disabled by someone else; each can be switched off per phone.
Connect a phone from ITX UserOps → Mobile app: scan the code with your phone’s camera, approve the connection on your site, and allow notifications. The app is a web app at app.itxuserops.com — nothing to install from a store — and it talks to your site directly, signing in with an application password made just for that phone. Disconnecting a phone revokes its password. Your site needs HTTPS for a phone to connect. See External services below for what leaves your site, and when.
Extras
Live “online users” count in the admin bar and a user-overview dashboard widget
Online status and a UserOps details link right in the native Users screen
Works on multisite — each subsite gets its own console (multisite notes →)
Performance
Built to a strict budget: front-end requests incur at most one throttled database write per user per minute — no admin-ajax polling, no autoloaded bloat. Logs live in their own indexed tables, never in wp_options. The break-in checks run on a schedule and on the plugin’s own screens, not on your visitors’ page views. The plugin loads no remote assets, and makes no external HTTP requests except to deliver notifications to phones you have connected to the mobile app (see External services).
Performance notes →
Free, and complete
Everything described above is free, fully functional, and stays that way. A separate premium edition exists for security teams — two-factor enforcement, passkeys, your own alert rules on any event, one-click responses to a break-in, file-change monitoring, temporary accounts, delegation and more — described at itxuserops.com/pricing. Nothing on this page requires it.
Development
The admin interface is a React app built with @wordpress/scripts. The
human-readable source lives in assets/src/; the compiled bundle in
assets/build/ is generated with:
npm install && npm run build
The app uses the @wordpress/* packages that ship with WordPress core, and
bundles one third-party library: qrcode (MIT,
https://github.com/soldair/node-qrcode), which draws the mobile app’s pairing
code in your browser so no image service is involved. The plugin loads no
remote assets.
External services
ITX UserOps contacts no outside service on its own. Once a day it requests
your own site’s front page and REST index, to check for code printed in front
of them; those requests go to your site and nowhere else. Two things happen
only when you connect a phone to the mobile app, and stop when you disconnect
it.
The ITX UserOps mobile app (app.itxuserops.com). The pairing code on the
Mobile app screen is drawn in your browser and contains your site’s address.
Scanning it opens app.itxuserops.com in your phone’s browser with that address
filled in. From then on the phone talks to your site directly; your site never
sends anything to app.itxuserops.com, and the app keeps your site’s address
and the phone’s application password on the phone only.
Terms: https://itxuserops.com/terms/ — Privacy: https://itxuserops.com/privacy/
Web Push (your phone browser’s notification service). If you allow
notifications on a connected phone, its browser gives your site an address at
the browser maker’s push service — Google (Chrome and Android), Apple (Safari
and iOS), Mozilla (Firefox) or Microsoft (Edge). When an alert is due, your
site sends the notification there to be delivered: the title and a short line
of text, encrypted end to end (RFC 8291) so the push service cannot read them,
with a signature identifying your site’s push key (VAPID). Nothing is sent
until a phone has allowed notifications, and only that phone’s address is
used.
Google: https://policies.google.com/privacy — Apple: https://www.apple.com/legal/privacy/ — Mozilla: https://www.mozilla.org/privacy/firefox/ — Microsoft: https://privacy.microsoft.com/privacystatement
