Dango System Utilities

Dango System Utilities is an admin-focused utility toolkit by DANGO. All modules are off by default on first install — enable only the features you need from the central settings page. Every module listed below is complete and fully functional. Nothing here is time-limited, usage-limited, or unlocked by a key, and this plugin contains no licensing code of any kind. Included modules:

• Diagnostics — environment benchmarking against WordPress and WooCommerce recommendations, a top-10 autoloaded options analyzer, a database table and storage inspector, a one-click cache flush and an email delivery test.
• Cron Manager — inspect, run, pause and delete scheduled events, and register custom schedules.
• WooCommerce Utilities — password policy rules and presets, international phone sanitization and E.164 validation, auto-updating cart quantities, a one-click empty cart button, auto-completion of virtual and downloadable orders, and weight-based shipping bands.
• Order Analytics — revenue, pipeline, rejection rate, average order value, order status distribution, top products, and channel and city performance showing orders received versus delivered per traffic source and per destination city. Computed with single-query SQL aggregation on both High-Performance Order Storage and legacy order tables.
• Search Analytics — admin-only recording of visitor search terms, top searches, zero-result keywords, CSV export, and a one-click import from Search Meter.
• CAPTCHA — Cloudflare Turnstile on the login, registration, lost-password and comment forms, with a light/dark/auto widget theme.
• Performance — Heartbeat API throttling, post revision capping, removal of asset query strings, and switches to disable core emoji and oEmbed scripts.
• Security — switches to disable XML-RPC, the theme and plugin file editor, WordPress version fingerprints, and pingbacks and trackbacks (which also stops the outbound request WordPress makes to every URL you link to).
• Plugin-only Data Purging — manual purge buttons and an optional weekly maintenance task.
• Extra Lightweight Tools — admin notice manager, failed login alerts, maintenance mode, security headers, an email attempt log, and a plugin/theme inventory CSV export.

Every setting carries a help bubble giving what it does, the WordPress default, what is recommended, and what you give up by enabling it. The Overview tab lists the recommended settings not currently in place and can apply them in one click; nothing is changed until you press the button, and every change is named first. Search Analytics is admin-only. This plugin does not include public recent-search widgets, public popular-search widgets, Gutenberg public search blocks, or frontend template tags. Data purging is plugin-only. Manual purge buttons run on demand, and an optional weekly automatic maintenance task prunes only this plugin's own aged data past its retention window. Weekly maintenance is enabled by default and can be turned off. The plugin never deletes unrelated WordPress, WooCommerce, or third-party plugin data. External services This plugin does not contact any external service on its own. On a default install, nothing leaves your site. The only outbound connection it can make is to Cloudflare Turnstile, and only after you enable the CAPTCHA module and save your own API keys. If you never enable CAPTCHA, this plugin makes no external request at all. Cloudflare Turnstile What it is and what it is used for: Cloudflare Turnstile is a bot-detection service operated by Cloudflare, Inc. It is used solely to provide the CAPTCHA challenge on the forms you choose to protect. The challenge cannot be performed locally — issuing and verifying it is the service's entire purpose, and the widget script must be served from Cloudflare's own domain for the token to be valid. What is sent and when:

1. When a page containing a protected form is rendered (login, registration, lost password, or comments — whichever you have enabled), the plugin enqueues the Turnstile widget script from https://challenges.cloudflare.com/turnstile/v0/api.js. Loading that script means the visitor's browser contacts Cloudflare directly, and Cloudflare receives the visitor's IP address, browser user agent, and the address of the page containing the form.
2. When that form is submitted, your server sends a single request to https://challenges.cloudflare.com/turnstile/v0/siteverify containing the Turnstile secret key you entered, the single-use challenge token generated by the visitor's browser, and the visitor's IP address. Nothing else is transmitted, and nothing is sent at any other time.

Terms and privacy:

• Cloudflare Website Terms of Use: https://www.cloudflare.com/website-terms/
• Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/

A separate paid add-on exists DANGO also sells Dango System Utilities Pro, a separate plugin distributed from solutions.dango.pk. It is not required, is not bundled here, and no part of this plugin is disabled, limited, or reserved for it. Installing it adds further modules of its own; removing it leaves everything in this plugin working exactly as before. It also extends some of the modules above. Order Analytics, for example, gains cross-dimensional reports the free plugin does not attempt: which traffic sources convert in which cities, and which convert on phones as against computers. The CAPTCHA module gains Google reCAPTCHA v3 as an alternative provider, WooCommerce account and checkout placements, and an IP allowlist. None of that code ships in this plugin, and the Cloudflare Turnstile protection included here is complete without it. If you install the add-on and later remove it, the CAPTCHA module falls back to Turnstile and keeps working.

2.5.8

• Settings screens are grouped and boxed. Every module, including the ones the paid add-on contributes, now sits in its own card under a section heading, instead of running together as one unbroken column of fields — the Security tab in particular was a wall of inputs with nothing marking where one feature ended and the next began.
• Every setting has help. The "?" bubble now covers all of them, not just some, and each says what the option does, what WordPress does by default, what we recommend, and what you give up by turning it on.
• Options with a real consequence say so where you set them, in a coloured note: an SVG upload can carry script, a 2FA role list can lock out anyone whose email is broken, a maintenance page hides the site from search engines, a published WhatsApp number is public and messaging customers first is regulated, a Cloudflare token should be scoped rather than global.
• Modules worth switching on for most sites carry a "Recommended" tag.
• New on the Overview tab: a recommended-settings checklist that says which of them are not in place, what each one is for, and applies them in one click. Nothing is changed until the button is pressed, and every change is named first.
• Roles and post types are chosen from a list of what the site actually has, rather than typed as comma-separated slugs. Getting a role name wrong is how people locked themselves out of 2FA.
• Two-factor authentication is configured in one place. It appeared under both Security and Privacy & Users, the same field rendered twice, with nothing to say which was real.
• Settings for a module you do not have installed are no longer rendered. On the Integrations and Privacy tabs, the section headings were conditional but the fields underneath them were not, so one installed integration displayed the settings for all ten.
• Quick search now matches module names as well as field names, hides a section heading whose sections have all been filtered out, and says when nothing matched instead of showing a blank page.
• The save button follows you down long tabs, and leaving a tab with unsaved edits now asks first.
• New: disable pingbacks and trackbacks. Ends pingback spam and self-pings, and stops the site making an outbound HTTP request to every URL you link to — the behaviour that lets a WordPress site be used to attack someone else.
• Channel Performance now separates paid advertising from free traffic out of the same place. An Instagram ad and a link in an Instagram bio were one row; they are now "Instagram Ads" and "Instagram", counted separately, so ad spend is never reported as organic reach. Read from the campaign medium WooCommerce already stores (cpc, paid_social and the like) — a row is only called "Ads" when the data says so, and an ad whose link was never tagged with a medium is still counted as an ordinary tagged link rather than guessed at. The medium is printed under every name, and included in the add-on's CSV export.
• Channel Performance: a source reached two different ways no longer appears twice under one identical name. Instagram from a link and Instagram from a tagged campaign link are still counted separately, because merging free traffic into paid would misreport what advertising is doing, but the name now says which is which. Names that do not collide are untouched.
• Search Analytics: "Last 7 days" and "Last 30 days" covered 8 and 31 days. Both the on-screen reports and the CSV exports had their own copy of the same off-by-one; they now share one definition and cover exactly the days they name.
• Search Analytics: "Avg results / search" averaged one value per keyword per day, so a term searched five hundred times counted the same as one searched once. It is now weighted by how often each term was actually searched.
• Search Analytics: the zero-result rate and the unsuccessful-searches table disagreed — a keyword that returned nothing last week but works today was counted as a failure by the rate and left out of the list of failures. Both now use the same definition.
• Search Analytics: the recorded result count could only ever go up, and any secondary search on the page — a sidebar widget, a "related searches" block — was allowed to raise it. A page listing three results could end up recorded as forty. The count now comes only from the query whose results the visitor was looking at.

2.5.7

• Traffic sources in Channel Performance are now named the way a person would say them. WooCommerce records whatever the browser reported, so the report used to read "Referral: Com.google.android.googlequicksearchbox" and "Organic: Google"; it now reads "Google App & Discover (Android)" and "Google Search", covering search engines, social networks and their apps, messengers, AI assistants, email tools, marketplaces and payment-page returns.
• The value WooCommerce actually recorded is printed under each name, along with how the visitor arrived, so every row can still be matched against WooCommerce's own Origin column and nothing is hidden behind the friendlier wording.
• Different spellings of one source — facebook.com, m.facebook.com and the Facebook Android app, for example — now count as a single row. Organic search is never merged with a campaign tag of the same name, so free traffic is never counted as paid.
• Android apps are covered too — the Gmail, YouTube, Instagram, Facebook, Messenger, WhatsApp, Telegram, TikTok, X, Pinterest, Reddit, LinkedIn and Snapchat apps, the mobile browsers that report themselves as the referrer, and the link shims social platforms redirect through.
• A source with no entry in the list is still shown, tidied but never dropped, so nothing goes missing from the report.
• Naming is done while the report is drawn, from data already fetched: no extra queries, no lookups, nothing scheduled, nothing stored.
• The add-on gains Channel by Device: the same orders split across phones, tablets and computers, so a source that completes on a computer but fails on a phone — usually a checkout problem rather than a traffic problem — is visible. Its CSV export covers it too.

2.5.6

• City Performance now supersedes the weaker city table the paid add-on used to draw. That one read the billing address rather than the shipping one on a delivery report, silently dropped every order with no city set, listed "lahore" and "Lahore" as two places, and measured its lost rate against orders that had not settled yet. It has been removed rather than kept alongside.
• The add-on now cross-references the two instead: which traffic sources actually convert in which cities, so a channel that looks healthy overall but fails in one city is visible. Pairings too small to read anything into are hidden.
• The add-on's CSV export now covers channel performance, city performance and the channel-by-city crossing.

2.5.5

• Fixed Channel Performance reporting every order as "Unknown". WooCommerce does not store the Origin string shown in the orders list — it composes it at display time from two separate meta values — so grouping on an origin key matched nothing. Channels are now grouped on the real attribution data and labelled the same way WooCommerce labels them. The Pro dashboard's orders-origin widget had the identical bug and is fixed too.
• Sources that differ only by capitalisation are now merged into one row instead of appearing as separate channels.
• New: City Performance, alongside Channel Performance — orders received versus delivered per destination city, using the shipping city and falling back to billing. City spellings differing only by case or spacing are merged.
• Search dates are now bucketed in your site's timezone instead of UTC. "Today" previously began at UTC midnight, so on a UTC+5 store everything searched before 5am local was filed under the previous day.
• The Search Report now shows "Searches Today" and "Searches Yesterday" as term lists with a count each, replacing the raw timestamped log. The full log remains available as a CSV export.

2.5.4

• Fixed inflated search counts. A search was recorded for any search query running during an AJAX request, so a theme with live search suggestions logged one search per keystroke — typing a seven-letter word recorded seven searches. Only a real front-end search page view is counted now; REST, XML-RPC, cron, feed and robots requests are excluded too, and a secondary query can still correct a result count but can never create a search. Existing recorded data is unchanged.
• Added a minimum search term length (default 2 characters) so one-letter fragments from type-ahead boxes are not recorded as searches.
• Widened crawler detection to cover more SEO, AI and uptime-monitoring agents.
• New: Channel Performance in Order Analytics — orders received versus actually delivered for each traffic source, with completion rate, lost and refunded counts, realized revenue and average order value. Reads WooCommerce's own Order Attribution data; this plugin sets no cookie and stores no visitor data of its own for it. Completion rate is measured against settled orders, so recent timeframes are not penalised for orders still in progress.
• The purge and cache tools now report what they removed instead of returning silently.
• "Clear Cache" now removes every cache the plugin owns, including the hash-keyed order analytics caches that previously lingered until they expired on their own.
• Uninstall now sweeps the plugin's remaining transients, including orphaned timeout rows.

2.5.3

• Corrected the publisher name shown in the plugin header and admin screens to DANGO.

2.5.2

• The Add-ons tab now carries a feature comparison table listing what this plugin includes alongside what the separate paid add-on adds. It is descriptive text only, confined to that one tab; no setting, field, or control for add-on features exists anywhere in this plugin.

2.5.1

• Tested against WordPress 7.1.
• The Add-ons tab and readme now name the extra CAPTCHA providers and placements the separate paid add-on offers. This is descriptive text only — no setting, field, or provider option for them exists in this plugin.

2.5.0

• Renamed the plugin to Dango System Utilities. The folder, slug, text domain, and all your existing settings are unchanged.
• CAPTCHA: this plugin now ships Cloudflare Turnstile only, as a complete and fully functional integration. The alternative provider, score threshold, WooCommerce placements, and IP allowlist that were previously present but reserved have been removed from this plugin entirely and now live in the separate paid add-on. Nothing in this plugin is limited by, or aware of, whether that add-on is installed.
• Settings screens no longer render read-only placeholder controls for modules that are not installed. A section appears only when the module that owns it is present, and everything on screen can be switched on and used.
• All CSS and JavaScript is now registered through the WordPress enqueue system instead of being printed inline.
• The optional debug log now lives in a protected, plugin-specific folder inside your uploads directory, located through wp_upload_dir(), rather than at a hardcoded path in wp-content.
• Failed login alerts now track attempts in one bounded, self-pruning record. Previously each username and IP combination created its own transient, which let unauthenticated visitors grow the options table without limit.
• Cron Manager: pausing an event no longer strips every callback from that hook on ordinary page loads. Suppression now happens only during an actual cron run, and no replacement callback is left bound to the hook.
• Documented Cloudflare Turnstile fully in the readme, including what is sent, when, and links to Cloudflare's terms and privacy policy.

2.4.3

• Enhancement: Added caching wrapper for Order Analytics Pro tables to drastically reduce database impact.

2.4.2

• Order Analytics: Overhauled date range filters to support true calendar months (Last Month Complete, Last 3 Full Completed Months, Month-to-Date, and This Month).
• Pro Order Analytics: Added 3-Month Historical Summary & Trend Comparison table alongside smooth Month-to-Date (MTD) velocity pacing.

2.4.1

• Order Analytics: Fixed a bug where time boundaries were strictly tied to GMT midnight instead of the site's local timezone.
• Pro Order Analytics: Fixed Peak Ordering Hours heatmap shifting based on the server timezone instead of the WordPress timezone offset.
• Fixed a persistent update notice bug where WordPress would incorrectly show that a new version of the Pro plugin was available immediately after updating, due to caching race conditions.

2.4.0

• New Feature: WooCommerce Order Analytics & Intelligence module with zero background server overhead, direct single-query SQL aggregation, and full native support for High-Performance Order Storage (HPOS).
• Free Tier: Executive KPI cards (Realized Revenue, Gross Volume, Pipeline, Lost/Rejection Rate %, AOV), timeframe filtering (Today, Yesterday, 7D, MTD, 30D, 90D, All), order status distribution, and Top 5 Best-Selling Products.
• Pro Tier: Month-to-Date (MTD) vs. Past 3 Months Same-Period Pacing Comparison (+% velocity), Top 10 Customer Cities & Return/Rejection Rate breakdown, Payment Gateway Performance, 24-Hour Peak Sales Heatmap, and 1-Click CSV Export.

2.3.1

• Fix: Resolved a fatal error caused by a missing method declaration for the Search Analytics dashboard widget.

2.3.0

• Search Analytics: Fixed a bug where searches returning products (e.g. "pigmentation") were logged with 0 hits due to core WP_Query found_posts filter timing. Results count is now accurately calculated across the_posts, found_posts, and template_redirect hooks with zero extra database queries.
• Search Analytics: Added interactive timeframe selector (Today, Last 7 Days, Last 30 Days, Last 90 Days, All Time).
• Search Analytics: Added real-time instant keyword filter on the Search Report screen.
• Search Analytics: Added Zero-Result Rate (%) KPI card with color-coded health badges and actionable Unsuccessful Searches section.
• Search Analytics: Added 1-click "Test on Site" links next to every keyword to preview live customer search results.
• Search Analytics: Added filtered Summary and 0-Result CSV export actions.

2.2.0

• Performance: Added "Remove Query Strings from Static Resources" to strip ?ver=x.x.x query strings on frontend assets to enable aggressive CDN edge and proxy caching.
• Performance: Added "Disable WordPress Core Emojis" to dequeue wp-emoji-release.min.js and inline emoji styling from all pages.
• Performance: Added "Disable WordPress Core oEmbed Scripts" to deregister wp-embed.min.js and remove oEmbed discovery links.
• WooCommerce: Added "Auto-Update Cart on Quantity Change" for instant AJAX subtotal and total recalculations when quantity steppers change on the cart page.
• Search Analytics: Replaced recent raw log with "Top Searches: Today" and added number formatting with thousand separators across all cards and tables. Added 1-click Summary & Recent CSV exports.
• Diagnostics: Added "Database Tables & Storage Overhead Inspector" table to analyze data and index sizes, row counts, and storage engines.
• UI/UX: Added instant real-time settings quick search filter at the top of admin settings panels.
• Tools: Added "Settings Backup & 1-Click Site Clone (JSON)" tool to easily export and import configuration backups.
• Pro Features: Added Telegram Bot Push Notifications, 1-Click WhatsApp Direct Chat for WooCommerce, Automatic WebP Image Conversion on upload, and Cloudflare Edge Cache Auto-Purge.

2.1.0

• New: Added WooCommerce international phone number sanitization and ITU-T E.164 standard validation (7 to 15 digits).
• New: Added Heartbeat API 120s throttling interval option to greatly reduce server CPU usage.
• Enhanced: Overhauled admin settings UI/UX with card layouts, responsive toggle controls, and accessible pros/cons/default/recommended hover tooltips.
• Enhanced: Overhauled System Diagnostics to compare environment metrics against WordPress & WooCommerce recommended benchmarks and display top autoloaded options.
• Fix: Fixed search analytics slash unescaping (wp_unslash()) and zero-hits SQL sorting.
• Fix: Fixed Cron Manager recurring event execution to properly reschedule rather than remove recurring tasks.
• Fix: Fixed broken tab redirects on Tools and Diagnostics screens.
• Fix: Updated plugin headers with distinct Plugin URI and Author URI compliant with WordPress.org guidelines.

2.0.7

• Code quality: resolved all WordPress.org Plugin Check errors and warnings — proper wp_unslash()/sanitization on request and server variables, prepared/documented database calls on the plugin's own tables, escaped or safely-documented admin output, and removed the discouraged manual text-domain load. No functional or behavioural change; the free plugin still makes no external request except opt-in Cloudflare Turnstile.

2.0.5

• Pro add-on only: fixed the Pro plugin repeatedly offering an update to the version it was already running. The updater now clears the update notice once you are current, instead of only ever adding one. It also checks for updates about every 12 hours rather than every 15 days, so new releases appear promptly. The free plugin is unchanged in this release.

2.0.4

• Pro add-on only: the obfuscated build no longer carries a banner identifying the obfuscation tool. No functional change. The free plugin is not obfuscated and is unchanged in this release.

2.0.3

• Pro add-on only: fixed the Pro package failing to install with "No valid plugins were found". Obfuscation had stripped the plugin header comment from the main file; the header is now preserved. The free plugin is not obfuscated and is unchanged in this release.

2.0.2

• Pro add-on only: the Pro package is distributed obfuscated again, this time built with a profile that leaves WordPress and the plugin's own APIs intact, so it installs and runs correctly. The free plugin is not obfuscated and is unchanged in this release.

2.0.1

• Fixed the Pro add-on failing to install with a server "Forbidden" error, and being non-functional even when it did install. The Pro build step was mangling the code it packaged; it is now shipped as ordinary source. This release only affects the Pro add-on — the free plugin was never obfuscated and was never affected.

2.0.0

• System Utilities Pro is now a separate add-on plugin instead of a paid build of this one. Pro installs alongside this plugin in its own folder and adds modules to it. This plugin is never replaced or overwritten by Pro, and updating either one can no longer disturb the other.
• This plugin no longer contains any licensing code and never contacts an external server. Deleting it can no longer affect a Pro license, and no license data is stored by it.
• The License tab is now an Upgrade tab explaining what Pro adds and how to install it. When the Pro add-on is present it takes the tab over and shows the license form there.
• Renamed the plugin folder and text domain to match the product name.
• Existing settings, search analytics data, and module toggles are carried over unchanged.

Earlier versions

• Release notes for 1.x are available at https://solutions.dango.pk/software/dango-utilities