Sysadmin Total Suite

Changelog

5.4

• New “Unused media” section: finds media items that are not referenced anywhere on the site and files in the year/month upload folders that do not belong to any media item; copies of original images kept by optimization plugins (name.bk.ext) are listed apart. Unused items can be moved to a reversible quarantine (hidden from the library, files moved aside) and restored at any time; only emptying the quarantine deletes them, with a double confirmation. Uninstalling restores anything still in quarantine.
• The audit now covers WordPress core and themes too: pending updates, themes closed or abandoned on WordPress.org and, if enabled, known vulnerabilities of the installed versions. The section is now called “Audit”.
• Because the vulnerability check now also sends theme slugs and the WordPress version, sites that had enabled it in 5.3 must enable it again: it stays paused, with a notice, until the new text is accepted.
• The diff viewer now shows a real unified diff (the same engine WordPress uses for revisions) with three lines of context: a line added near the top no longer marks the rest of the file as changed.
• Asset URLs include the file modification time, so browsers and server caches always load the current scripts and styles after an update.
• The names of the robots.txt-only AI crawlers are now translatable.
• The readme clarifies which folders the plugin writes in uploads and how they are protected.

5.3

• New “Plugin audit” section: pending updates, plugins closed or not updated on WordPress.org for more than two years and, only after you enable it, publicly known vulnerabilities (CVE and others) of the installed versions, from the free WPVulnerability database. Only plugin slugs are sent; the version comparison is done locally.
• New “Disk usage” section: read-only report of the space used by the core, uploads (by year and month), plugins, themes, other wp-content folders, non-WordPress folders in the site root and database tables, plus the free disk space. Measured in batches to avoid timeouts.
• In multisite, both new sections require network administrator capabilities.
• The diff cache now deletes the official packages of previous WordPress versions instead of keeping them after every core update.
• The readme no longer mentions restoring core files, which was removed in 5.0. The external services section now documents every service used.
• Uninstall also removes the option used for the old prefix migration.
• Tested up to WordPress 7.1.

5.2

• Fixed a false positive: a site running the international WordPress package while using a translated locale reported core files such as wp-includes/version.php as modified. Files are now also compared against the international package before being flagged.

5.1

• Prefixed the variables used by the admin views so that static analysis no longer reports them as unprefixed globals.

5.0

• The integrity section is now a read-only report. Following the plugin review team’s feedback, the plugin no longer writes to or deletes anything inside the WordPress core directories: restoring files, restoring from a backup, the backup manager and the removal of extra files have all been removed.
• When core issues are found, the plugin now links to Dashboard > Updates > Reinstall now, which is WordPress’s own repair mechanism.

4.2

• Renamed the plugin and prefixed every function, global, constant, option, transient, AJAX action and nonce with a unique plugin prefix.
• All inline scripts moved to enqueued files, with data passed through wp_localize_script().
• Updated the bundled Chart.js library to the latest stable release.
• Removed the load_plugin_textdomain() call and the bundled translation files: translations are handled by translate.wordpress.org.
• The top level admin menu no longer uses a prominent position.

4.1

• Documented in detail how the official package is used and which files can be written or deleted, and added a clearer warning when restoring from a backup: a backup reproduces the file as it was, so it does not guarantee clean content the way the official package does.

4.0

• Remaining Plugin Check fixes and renamed the plugin so that its name and slug no longer contain restricted terms.

3.9

• Compliance with the Plugin Check tool: translator comments for every string with placeholders, output escaping, WordPress filesystem API instead of direct calls, prepared LIKE wildcards, wp_safe_redirect() and sanitized server variables.
• Removed a pointless database query that was only used to time itself.
• The readme is now written in English, as required by the plugin directory.

3.8

• New backup manager in the Integrity section: lists backups with their date and time, restores individual files from a backup and deletes backups individually, per batch or all at once.
• Backups saved by earlier versions in the site root are detected too, with a warning that this location is web-accessible.

3.7

• Fixed: the Profiling “Run test” button did not record measurements, because the signed URL was generated with esc_js(), which turns the ampersand into an HTML entity and broke the query string, so the nonce never reached the server.

3.6

• Security (important): the diff viewer no longer renders the analyzed file content as HTML. Previously, a tampered core file containing JavaScript could execute it in the admin panel when clicking “Show changes” (stored XSS).
• Backups use a randomized folder name and a neutralized extension; the ZIP cache is protected against direct access.
• The profiling test now requires a nonce and capabilities: any visitor could previously force database writes while bypassing the page cache.
• Path validation now runs after normalization; cron tasks are backed up before removal; user deletion uses the delete_user meta capability.
• Hidden and configuration files in the site root are no longer flagged as extra, avoiding accidental deletion of .user.ini, ads.txt, search engine verification files and similar.
• Robustness: the official ZIP is opened once per request and limits are raised for long operations.

3.5

• Hardened path resolution, restore and diff limited to core paths, and backups moved to the uploads folder with access protection.
• Fixed: restoring files reported as missing always failed.
• Added uninstall.php to clean options, transients and cache on uninstall.

3.4

• Prepared for the plugin directory: readme, headers and Chart.js bundled locally instead of loaded from a CDN. Internationalization with English as the base language and a Spanish translation included.

3.0 – 3.3

• AI bot blocking with an Allow/Block toggle per bot.
• Redesigned interface as a modern control panel.
• Renamed the Tunning section to WPO.

2.0 – 2.9

• New sections: Check users, WPO (performance, wp_options, WP-Cron, cache) and AI bot blocking.
• Optional backup when restoring; deletion of extra files.

1.6 – 1.9

• Integrity limited to the real core; locale alignment in diff and restore; nonce and interface fixes.