| 开发者 | ffscz |
|---|---|
| 更新时间 | 2026年10月12日 15:35 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
/wp-content/plugins/altos/.wp-content/mu-plugins/. Click "Install loader file" to enable full per-screen filtering. Without it, the plugin runs in limited mode. The file is removed automatically on deactivation.wp-content/mu-plugins/ (almost all hosts allow this; some managed-WordPress hosts restrict it).ALTOS runs before WordPress loads regular plugins, using the MU-plugins mechanism. That means the code is genuinely not loaded on screens where you don't need it — not loaded-and-then-suppressed. Deactivation is global and permanent; this lets you keep an item active site-wide while skipping it on specific admin screens or request types.
For 24–48 hours after you enable it, the loader samples real performance data on your own admin: load time, database queries, memory per active item, per admin screen. It then analyses those samples to suggest rules with a confidence score (0–100 %) and estimated savings. Suggestions are never applied automatically — you review them and apply with one click.
ALTOS has multiple safeguards:
Yes. Elementor, Bricks, Divi, and Beaver Builder edit sessions are detected and the loader steps out of the way to avoid breaking editor previews.
Full WooCommerce support: cart, checkout and account pages are excluded from any blocking on the frontend. Admin screens are recognised per area (products, orders, settings, …) so you can keep WooCommerce active on its own screens while skipping it elsewhere.
The Frontend Optimizer is an opt-in feature. If you leave it disabled (default), the frontend is completely unaffected. With it enabled, you can selectively skip items per page-type context (homepage, single, archive, …).
Yes. Open Settings → ALTOS → Administration and scroll to Conditional Rules (device / user). Each rule names a plugin, where it applies (admin, frontend or both), the device (any, mobile only, desktop only) and who it applies to: everyone including visitors, visitors only, all logged-in users, or a WordPress role; for the administrator role you can pick one specific administrator account. A rule with "Mobile only" keeps the plugin loaded on desktop and skips it on phones; a rule with "Administrator → admin2" skips the plugin for that account and nobody else. Conditions in one rule are combined (device AND user); several rules for the same plugin are alternatives.
Rules are evaluated when plugins are loaded, so the plugin code really does not run. The Plugins screen and the ALTOS settings page always load everything, WooCommerce stays protected on shop pages, and safe mode switches the rules off. The device comes from wp_is_mobile(), the user from the login cookie without signature verification: treat these rules as a performance optimisation, not as access control. Rules with users do not apply to visitors who are not logged in.
Developers can implement other conditions (time of day, IP ranges, ...) with the sapm_admin_filtered_plugins and sapm_frontend_filtered_plugins filters from an mu-plugin; SAPM_Core::get_logged_in_user_hint() returns the user login available at that early stage.
Three strategies are available:
api.wordpress.org update HTTP calls so they only re-run after a configurable interval (12 h → 24–72 h). WordPress keeps its own cache; we only reduce how often it gets refreshed.Yes. Network activation is supported but each subsite needs its own per-site rules. The MU-loader is created once for the network. Frontend rules also apply to network-activated (network-wide) plugins.
No. See the External Services section above.
English (source) plus Czech (cs_CZ), Slovak (sk_SK), Polish (pl_PL), German (de_DE), French (fr_FR), and Spanish (es_ES). Translations live in /languages/ as .po/.mo. Community translations from translate.wordpress.org are also picked up automatically.
script_loader_tag, query, admin_enqueue_scripts) no longer stop the request when another plugin passes a non-string value or fewer arguments; the value is passed through unchanged.active_plugins guard compared against the already filtered option value, so a plugin activated or deactivated during a filtered request (for example from a frontend request or an AJAX call) could silently deactivate the plugins ALTOS had hidden. The guard now compares against the stored list. The same protection covers network-activated plugins on multisite.sapm_admin_filtered_plugins filter for the final plugin list on admin screens and SAPM_Core::get_logged_in_user_hint(); the sapm_frontend_filtered_plugins filter now also runs in passthrough mode, so developers can add their own conditions from an mu-plugin.active_plugins guard now covers frontend requests and only re-adds plugins that ALTOS itself hid in the current request instead of discarding the whole change; activate-plugin / deactivate-plugin AJAX actions are recognised.window.SAPM_FRONTEND_BAR was added after the footer scripts were printed) and stayed empty. The data is now printed with wp_print_inline_script_tag().match() expression (PHP 8.0 syntax) although the plugin supports PHP 7.4.preg_match() on a possibly null path (PHP 8.1 deprecation).init instead of at MU-loader time. This removes the WordPress 6.7+ notice "Translation loading for the altos domain was triggered too early" on frontend requests.IF NOT EXISTS), so future schema changes can be applied to existing tables.load_plugin_textdomain() on init for WordPress versions before 6.7; the MU-loader consent notice is translated; network activation creates the sampling table on every site; update_option() autoload uses false instead of the deprecated 'no'.wp-content/mu-plugins/. Without consent the plugin runs in limited mode (filtering still works for later option queries; only the very first plugin-load pass is unaffected).<script> blocks in the settings page extracted to a dedicated assets/admin-handlers.js enqueued via wp_enqueue_script. The frontend bar's JSON payload now goes through wp_add_inline_script() instead of an inline <script> tag.$_POST / $_GET / $_SERVER super-global reads now use wp_unslash() plus an explicit sanitize_*() helper. $_SERVER[REQUEST_TIME_FLOAT] is cast through (float) before arithmetic. $_SERVER[REQUEST_URI] goes through sanitize_text_field( wp_unslash( … ) ).json_decode() results from POST payloads are now deep-sanitised by a new recursive sanitize_rules_array() helper before being persisted. stripslashes() replaced with wp_unslash() where applicable.WP_PLUGIN_DIR / WP_CONTENT_DIR annotated with explanatory comments documenting why the WordPress-provided constants are the correct API here (no __FILE__-relative helper exists for resolving other plugins' base paths or the must-use plugins folder at the MU-loader load stage)..pot, .po, and .mo files in /languages/. Domain Path header added.altos for the WordPress.org directory._e() → esc_html_e() etc.).parse_url(), unlink(), date() and mt_rand() with their WordPress-recommended counterparts.wp_unslash() + sanitize_*.phpcs:ignore documentation on the plugin's own database queries (custom sampling_data table).admin_init to prevent permanent loss after a failed activation._load_textdomain_just_in_time notice).WPMU_PLUGIN_DIR constant.