Lock My Site
| 开发者 | juaevpa |
|---|---|
| 更新时间 | 2026年6月1日 15:29 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 6.9 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Lock My Site is a lightweight plugin that enables remote management of your WordPress site through a secure REST API. Perfect for agencies, freelancers, and anyone managing multiple WordPress sites.
Features
- Complete Health Check - Monitor site status, PHP version, memory usage, and more
- Update Management - Manage plugins, themes, core, and translations updates remotely
- Plugin Management - Activate, deactivate, and get detailed plugin information
- Theme Management - Switch themes and manage theme updates
- Database Optimization - Clean up and optimize database tables
- Security Audit - Basic security checks and recommendations
- Error Logs - Access PHP error logs remotely
- User Management - List users and roles
- API Key authentication
- Optional HMAC signature verification
- Optional IP whitelist
- Rate limiting protection
- Automatic lockout after failed attempts
- API key expiration (90 days)
- Email alerts for suspicious activity
- Activity logging
GET /ping- Connection check-
GET /health- Complete site health status Updates -
GET /updates- Available updates (plugins, themes, core, translations) POST /update/plugin- Update a specific pluginPOST /update/theme- Update a specific themePOST /update/core- Update WordPress corePOST /update/all-plugins- Update all pluginsPOST /update/all-themes- Update all themes-
POST /update/translations- Update all translations Plugins -
GET /plugins- List all plugins GET /plugins/{plugin}- Get plugin detailsPOST /plugins/activate- Activate a pluginPOST /plugins/deactivate- Deactivate a pluginGET /plugins/ignored- List ignored pluginsPOST /plugins/ignore- Ignore a plugin from bulk updates-
POST /plugins/unignore- Remove plugin from ignored list Themes -
GET /themes- List all themes -
POST /themes/activate- Activate a theme Database -
GET /database/stats- Database statistics POST /database/cleanup- Clean database (revisions, drafts, spam, etc.)-
POST /database/optimize- Optimize database tables Logs -
GET /logs/php- PHP error log -
GET /logs/activity- Plugin activity log Users -
GET /users- List WordPress users
安装:
- Upload the
lock-my-sitefolder to/wp-content/plugins/ - Activate the plugin through the 'Plugins' menu in WordPress
- Go to Tools > Lock My Site to get your API key
- Use the API key in your management dashboard
屏幕截图:
常见问题:
Is this plugin secure?
Yes. The plugin uses API key authentication, supports HMAC signature verification, IP whitelisting, implements rate limiting, auto-lockout after failed attempts, and logs all API access. The API key is generated automatically and can be regenerated at any time.
How do I authenticate?
Include the X-API-Key header with your API key in each request.
Can I restrict access by IP?
Yes, you can configure an IP whitelist in the plugin settings page (Tools > Lock My Site).
Does it work with management dashboards?
Yes, this plugin is designed to work with any management dashboard that implements the API. It's compatible with custom dashboards and management tools.
What happens if someone gets my API key?
You can regenerate your API key at any time from the plugin settings. The old key will immediately stop working. You can also enable email alerts to be notified of suspicious access attempts.
Does it support multisite?
The plugin works on individual sites. For multisite networks, install it on each site you want to manage.
更新日志:
1.6.4
- Fix: update_plugin() no longer destroys the update_plugins transient after each individual update (wp_clean_plugins_cache was implicitly passing true). Prevents loss of cascading updates between sequential plugin upgrades.
- Fix: hardened /performance/audit endpoint — each method isolated in try/catch
- Fix: safer SQL aliases (avoids reserved words) and suppress_errors on information_schema
- Fix: simpler transients query without self-JOIN for compatibility with restrictive MySQL setups
- New: /performance/audit REST endpoint exposing internal performance metrics (autoload bloat, transient stats, object cache / OPcache status, large tables, PHP/WP info) for the management dashboard
- Fix: bulk plugin updates with transient refresh per site before batch upgrade
- Migration: Plugin directory renamed from udista-maintenance to lock-my-site
- New: /migrate-basename API endpoint for automated directory migration
- Deploy system now automatically renames old directories and updates active_plugins
- Fix: Safe plugin reactivation after updates (catch activation failures to prevent site crash)
- Fix: Obfuscate malware scanner signatures to prevent hosting false positives
- Fix: Delete stale transients before force refresh to prevent phantom updates
- Fix: Verify actual plugin version after update (detect silent successes)
- Fix: Object cache flush on force refresh for aggressive hosting caches
- Fix: Bulk plugin updates - single transient refresh per site instead of per plugin
- Fix: Transient re-injection between updates to prevent data loss
- Fix: wp.org API fallback when transient is stale
- WordPress.org approved release
- Final compliance fixes for plugin review
- Replaced WP_CONTENT_DIR paths with wp_upload_dir(), get_theme_root(), WP_PLUGIN_DIR
- Replaced ABSPATH for error logs with get_home_path()
- Added prominent comments for remote management features (activate_plugin, switch_theme)
- Fixed JSON input sanitization with map_deep() after json_decode()
- Removed Polylang Pro integration code
- Improved external services documentation in readme.txt
- Updated all internal prefixes to
lockmysi_for WordPress.org compliance - Replaced inline scripts with properly enqueued JavaScript
- Added wp_localize_script for passing data to admin scripts
- Improved input sanitization across all files
- Documented all external service connections in readme.txt
- Added function_exists checks for WordPress admin includes
- Initial release
- Complete health check system
- Plugin and theme management
- Update management (plugins, themes, core, translations)
- Database optimization and cleanup
- PHP error log access
- Activity logging
- API key authentication with HMAC support
- IP whitelist support
- Rate limiting