Title: DIGITO Toolkit Author: DIGITO WEBS Published: Sentabr 17, 2026 Last modified: Oktabr 15, 2026 --- Search plugins ![](https://ps.w.org/digito-toolkit/assets/banner-772x250.png?rev=3700069) ![](https://ps.w.org/digito-toolkit/assets/icon-256x256.png?rev=3700069) # DIGITO Toolkit By [DIGITO WEBS](https://profiles.wordpress.org/digitowebs/) [Download](https://downloads.wordpress.org/plugin/digito-toolkit.1.2.1.zip) * [Details](https://uz.wordpress.org/plugins/digito-toolkit/#description) * [Reviews](https://uz.wordpress.org/plugins/digito-toolkit/#reviews) * [Installation](https://uz.wordpress.org/plugins/digito-toolkit/#installation) * [Development](https://uz.wordpress.org/plugins/digito-toolkit/#developers) [Support](https://wordpress.org/support/plugin/digito-toolkit/) ## Description DIGITO Toolkit groups five independently switchable WordPress administration tools in one lightweight plugin. Enable only the modules you need. Disabled modules do not boot their feature hooks. #### Security Health Security Health provides administrator-only, local diagnostics for WordPress update posture, HTTPS configuration, debug exposure, the dashboard file editor, privileged- account signals, public author exposure, selected response headers, and XML-RPC posture. Its score summarizes the checks that could run. Pass earns full weight, Warning earns half, Fail and Unknown earn no points, and Not Applicable is excluded. The score is guidance, not a guarantee that a site is secure. Every result includes concise evidence, limitations, and a recommended next step. Security Health does not scan site files for malware, replace WordPress Site Health, or use a remote vulnerability service. Optional controls are off by default and reversible: * Login-attempt protection applies a 15-minute client cooldown after five failures within 15 minutes. It stores keyed pseudonymous counters rather than raw IP addresses or usernames. Administrators must explicitly confirm activation. The documented` DIGITO_TOOLKIT_DISABLE_LOGIN_PROTECTION` configuration constant provides emergency recovery. * WordPress response headers can add `X-Content-Type-Options` and `Referrer-Policy` when WordPress has not already supplied them. The control does not edit server or CDN configuration and does not add CSP or HSTS. * XML-RPC can remain in observe-only mode or be disabled after an explicit compatibility warning. Disabling it can affect publishing clients, mobile apps, Jetpack, and other integrations. * Manual and optional daily scheduled scans evaluate the same bounded local checks. Only the latest scheduled summary is retained for up to seven days. * A bounded local event log retains up to 500 allowlisted, nonsensitive events for seven days. Clearing it requires administrator authorization and explicit confirmation. Security Health is off by default. Its screen and settings require the WordPress` manage_options` capability. It does not add a public API, telemetry, remote accounts, automatic destructive remediation, or network-wide Multisite administration. #### Classic Editor Restore the familiar WordPress Classic Editor for posts and pages. #### Duplicate Page & Post Quickly duplicate posts, pages, and supported custom post types with their content and settings. Copies are created as drafts through capability- and nonce-protected WordPress actions. #### Maintenance Mode Temporarily display a customizable Maintenance or Under Construction page to visitors. Configure the message, presentation, optional Media Library logo, and optional countdown. Authorized administrators retain access. Public maintenance responses use HTTP 503 and Retry-After headers. Page-cache, hosting-cache, and CDN layers can serve stale HTML without reaching WordPress. Purge those caches after changing Maintenance Mode when needed. A cache that serves stored HTML without reaching WordPress cannot be overridden by the Toolkit. #### Safe SVG Upload Securely upload sanitized SVG graphics to your WordPress Media Library. The module is off by default and is limited to trusted administrators with upload permission; Multisite additionally requires a super administrator. Accepted SVGs are parsed and sanitized locally. The default upload limit is 1 MiB. Scripts, event handlers, animation, `foreignObject`, unsafe CSS, external resources, data URLs, document type declarations, entities, malformed XML, and files that cannot be verified are rejected. Sanitized attachments include Media Library previews and dimensions. Safe SVG Upload does not optimize raster images or promise support for every SVG authoring feature. #### Privacy and local processing DIGITO Toolkit does not include Toolkit telemetry, visitor tracking, remote accounts, or remote security scanning. Settings, diagnostic summaries, and the bounded Security Health event log remain in the site’s WordPress database. No raw IP address, username, credential, cookie, request payload, site content, or diagnostic report is sent to DIGITO WEBS. #### Compatibility and limitations The plugin requires WordPress 6.8 or later and PHP 8.2 or later. Security Health evaluates WordPress-visible evidence and cannot verify every server, proxy, CDN, certificate, WAF, or external service. Its optional controls affect WordPress-generated behavior only. Multisite support is best effort and site-local. The Toolkit does not provide shared Network Admin settings, network-wide provisioning, or complete network-wide uninstall cleanup. The bundled `enshrined/svg-sanitize` library is GPL-2.0-or-later. Source and license details are recorded in the distributed Composer metadata and vendor license. ## Screenshots [⌊Security Health dashboard showing the weighted score, status summary, findings, and recommendations.⌉⌊Security Health dashboard showing the weighted score, status summary, findings, and recommendations.⌉[ Security Health dashboard showing the weighted score, status summary, findings, and recommendations. [⌊Optional Security Health controls and local monitoring tools, all presented with compatibility and recovery guidance.⌉⌊Optional Security Health controls and local monitoring tools, all presented with compatibility and recovery guidance.⌉[ Optional Security Health controls and local monitoring tools, all presented with compatibility and recovery guidance. ## Installation 1. Install and activate DIGITO Toolkit through the WordPress Plugins screen. 2. Open DIGITO Toolkit > Modules. 3. Enable only the modules you need. 4. Open Security Health or another module’s settings page to review its guidance and controls. ## FAQ ### What does the Security Health score mean? It is a weighted summary of observable local checks. Unknown evidence earns no points and Not Applicable checks are excluded. Review each finding and its evidence rather than relying on the number alone. The score is not a certification or guarantee of security. ### Does Security Health change my site automatically? No. Diagnostics and recommendations are read-only. Optional login protection, response headers, XML-RPC control, and scheduled scans are disabled by default and require an authorized administrator to enable them. Disruptive controls require explicit confirmation and remain reversible. ### How can I recover if login protection causes a problem? Define `DIGITO_TOOLKIT_DISABLE_LOGIN_PROTECTION` as `true` in the site’s normal WordPress configuration recovery process, sign in, and correct or disable the setting. The protection uses temporary client cooldowns, not permanent or username-specific lockouts. ### What is stored by Security Health? It stores its allowlisted settings, an optional latest scan summary for up to seven days, pseudonymous login-attempt counters with bounded expiry when protection is enabled, and up to 500 allowlisted security events for seven days. It does not store raw IP addresses, usernames, passwords, tokens, cookies, or request payloads. ### Does Security Health call an external vulnerability service? No. It uses WordPress-visible local evidence and makes no Toolkit remote security request. Update checks depend on the update information WordPress already has; missing or stale evidence is reported conservatively. ### Why can server or CDN headers differ from the dashboard? Security Health can assess and optionally add selected headers in WordPress-generated responses. A web server, reverse proxy, CDN, cache, or security plugin can change the final public response. Verify public headers separately when that matters. ### Who can upload SVG files? Only a trusted administrator who can configure DIGITO Toolkit and upload files while Safe SVG Upload is enabled. Multisite also requires a super administrator. Other roles do not gain SVG permission automatically. ### Does the plugin collect or send my data? No Toolkit telemetry, remote account, visitor tracking, or unnecessary external data transmission is included. Processing is local to WordPress. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “DIGITO Toolkit” is open source software. The following people have contributed to this plugin. Contributors * [ DIGITO WEBS ](https://profiles.wordpress.org/digitowebs/) [Translate “DIGITO Toolkit” into your language.](https://translate.wordpress.org/projects/wp-plugins/digito-toolkit) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/digito-toolkit/), check out the [SVN repository](https://plugins.svn.wordpress.org/digito-toolkit/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/digito-toolkit/) by [RSS](https://plugins.trac.wordpress.org/log/digito-toolkit/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.2.1 * Redesigned the Toolkit Dashboard and Modules screen with compact responsive cards, real module counts, clearer status, and valid contextual actions. * Introduced a reusable scoped admin design system with compact mastheads, accessible notices, disclosures, empty states, focus treatment, and responsive layout primitives. * Reorganized Maintenance settings and added a private, nonce-protected preview for unsaved changes without enabling public Maintenance Mode or persisting preview values. * Redesigned Security Health Overview, Protection, Activity, findings, filters, optional controls, and scan/event presentation without changing security behavior. * Improved keyboard navigation, textual status communication, WCAG AA contrast, reduced-motion handling, 200% zoom support, and 320px reflow. * Preserved all module permissions, nonces, stored settings, disabled-state dormancy, privacy boundaries, and public frontend behavior. #### 1.2.0 * Added the independently switchable Security Health module, off by default. * Added bounded, local security diagnostics with transparent scoring, evidence, and actionable recommendations. * Added optional confirmed login-attempt protection with pseudonymous client counters and emergency recovery. * Added optional WordPress response headers and XML-RPC controls with compatibility safeguards. * Added bounded local event logging, manual scans, and optional daily scheduled scans. * Added accessible administrator guidance, privacy documentation, automated coverage, and real WordPress acceptance testing. #### 1.1.0 * Added the independently switchable Safe SVG Upload module. * Added fail-closed SVG parsing and sanitization with authorization, size, MIME, and content validation. * Added native Media Library and REST-backed upload support, SVG previews, and attachment dimensions. * Added temporary-file locking and final stored-file integrity verification. #### 1.0.1 * Improved Maintenance Mode compatibility, cache guidance, the Plugins-screen Settings shortcut, and author metadata. #### 1.0.0 * Added independently switchable Classic Editor, Duplicate Page & Post, and Maintenance Mode modules. ## Meta * Version **1.2.1** * Last updated **6 soat ago** * Active installations **Fewer than 10** * WordPress version ** 6.8 or higher ** * Tested up to **7.1.3** * PHP version ** 8.2 or higher ** * Language * [English (US)](https://wordpress.org/plugins/digito-toolkit/) * Tags * [duplicate post](https://uz.wordpress.org/plugins/tags/duplicate-post/)[maintenance mode](https://uz.wordpress.org/plugins/tags/maintenance-mode/) [safe svg](https://uz.wordpress.org/plugins/tags/safe-svg/)[security](https://uz.wordpress.org/plugins/tags/security/) * [Advanced View](https://uz.wordpress.org/plugins/digito-toolkit/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/digito-toolkit/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/digito-toolkit/reviews/) ## Contributors * [ DIGITO WEBS ](https://profiles.wordpress.org/digitowebs/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/digito-toolkit/)