OpenWPClub's MU Plugins

MU (Must-Use) Plugins are a special type of WordPress plugin that:

• Always active - Cannot be deactivated from the WordPress admin
• Load automatically - No activation required
• Load early - Before regular plugins and themes
• No updates - Must be manually updated (no auto-updates)
• Single files only - Each plugin must be a single PHP file (no subdirectories)

⚠️ Important: Read Before Using

DO NOT blindly copy all these plugins to your site. Each plugin modifies WordPress behavior in specific ways. You should:

1. Understand what each plugin does before installing it
2. Only use plugins that solve problems you actually have
3. Test on a staging site first before deploying to production
4. Consider your specific use case - what works for one site may break another

Installation Instructions

Zero configuration required - the autoloader loads ALL PHP files from ALL subdirectories. Simply delete any plugins or folders you don't need.

How It Works

1. The autoloader scans all subdirectories
2. Loads every .php file it finds
3. No configuration needed

Don't want a plugin? Delete it. Don't want a category? Delete the folder.

Updating the Plugin List

Run node scripts/update-plugin-list.mjs after changing plugin headers. Pull requests verify that the generated table is current; pushes to main or master update and commit it automatically.

Security.txt Configuration

The Security.txt Provider is intentionally inactive until a public security contact is configured in wp-config.php:

define('MU_SECURITY_CONTACT', 'mailto:security@example.com');
define('MU_SECURITY_EXPIRES', '2027-08-01T00:00:00Z'); // Optional; defaults to 180 days ahead.
define('MU_SECURITY_POLICY', 'https://example.com/security-policy'); // Optional.
define('MU_SECURITY_LANGUAGES', 'en, bg'); // Optional; defaults to en.

MU_SECURITY_CONTACT may also be an array of mailto: and HTTPS contacts. The resulting file is available at /.well-known/security.txt.

Plugin Name	Description	Version	WP	PHP
404 Logger	Logs 404 errors to a file for security monitoring and broken link detection. IP addresses are anonymized (last octet masked) for GDPR compliance.	1.0.0	6.6+	7.4+
Activity Audit Log	Keeps a small privacy-aware audit trail of critical user, settings, login, and software update events.	1.0.0	6.6+	7.4+
Add Footer Signature	Adds a developer signature comment to the website footer for attribution and contact purposes.	1.0.0	6.6+	7.4+
Admin Color Scheme Lockdown	Forces a single admin colour scheme for all users. Useful for white-label admin panels. Set MU_ADMIN_COLOR_SCHEME to any built-in slug (default, light, blue, coffee, ectoplasm, midnight, ocean, sunrise).	1.0.0	6.6+	7.4+
Admin Footer Info	Shows PHP version, MySQL version, WordPress version, and memory usage in the admin footer.	1.0.0	6.6+	7.4+
Admin Session Timeout	Automatically logs out inactive admin users. Default timeout is 60 minutes. Override with the 'mu_session_timeout' filter (value in seconds).	1.0.0	6.6+	7.4+
Auto-Deactivate on Error	Tracks which plugin is being activated via a short-lived transient. If a fatal error prevents wp_loaded from firing, the next admin request detects the stale transient and deactivates the offending plugin.	1.0.0	6.6+	7.4+
Block PHP Execution in Uploads	Writes and maintains an .htaccess file in wp-content/uploads that denies execution of PHP and other server-side script files. Mitigates malware droppers that plant a disguised script through a vulnerable plugin, theme, or upload form. Apache/LiteSpeed only — nginx needs an equivalent rule in the server config.	1.0.0	6.6+	7.4+
Clean Head Output	Removes legacy and discovery tags from the frontend head, including generator, RSD, WLW, shortlink, adjacent-post, REST API, oEmbed, and feed links.	1.1.0	6.6+	7.4+
Cron Monitor	Tracks WP-Cron runs and scheduling errors, and reports overdue or orphaned scheduled hooks without deleting them.	2.0.0	6.6+	7.4+
Custom Login Logo	Replaces the WordPress logo on the login page with your site logo, icon, or name. Links to your homepage instead of wordpress.org.	1.0.0	6.6+	7.4+
Defer Non-Critical Scripts	Adds the defer attribute to enqueued scripts not in the exclude list. Improves Time to Interactive without editing theme files. Extend the exclude list via the 'mu_defer_exclude_handles' filter.	1.0.0	6.6+	7.4+
Disable Admin Email Confirmation	Disables the periodic admin email confirmation prompt that WordPress shows every 6 months.	1.0.0	6.6+	7.4+
Disable Admin New User Email	Prevents admin from receiving email notifications when new users register. Users still receive their welcome email.	1.0.0	6.6+	7.4+
Disable AI Crawlers	Blocks all known AI crawlers and bots from accessing your site content via robots.txt.	1.0.0	6.6+	7.4+
Disable Application Passwords	Disables the Application Passwords feature introduced in WP 5.6 to reduce attack surface for sites not using it.	1.0.0	6.6+	7.4+
Disable Autosave	Disables WordPress autosave functionality to improve performance and prevent unwanted draft saves.	1.0.0	6.6+	7.4+
Disable Block Library CSS	Removes Gutenberg block library CSS from frontend if not using blocks, reducing page weight.	1.0.0	6.6+	7.4+
Disable Block Notes	Disables the collaboration notes feature in the block editor introduced in WordPress 6.9.	1.0.0	6.9+	7.4+
Disable Command Palette	Disables the Command Palette (Ctrl+K / Cmd+K) feature in the WordPress admin.	1.0.0	6.3+	7.4+
Disable Comments Globally	Completely disables comments, trackbacks, and pingbacks across the entire site. Removes all comment-related functionality from admin.	1.0.0	6.6+	7.4+
Disable Core XML Sitemap	Disables the auto-generated /sitemap.xml introduced in WordPress 5.5 to prevent duplicate sitemaps when Rank Math, Yoast SEO, or another sitemap plugin is active.	1.0.0	6.6+	7.4+
Disable Dashicons Frontend	Remove Dashicons CSS from frontend for non-logged-in users to improve performance (saves ~40KB)	1.0.0	N/A	N/A
Disable Emoji Support	A utility plugin to disable emoji support.	1.0.0.	6.6+	7.4+
Disable File Editing	Prevents editing of theme/plugin files from admin	1.0.0	N/A	N/A
Disable FloC	A utility plugin to disable FLoC.	1.0.0.	6.6+	7.4+
Disable Google Fonts	Dequeues all Google Fonts stylesheets and removes preconnect hints to fonts.googleapis.com. EU courts have ruled that loading Google Fonts without prior consent violates GDPR.	1.0.0	6.6+	7.4+
Disable Gravatar	Replaces all Gravatar avatar requests with the local mystery-person image so no request is sent to gravatar.com. Prevents commenter/user emails being hashed and sent to a third party without consent (GDPR).	1.0.0	6.6+	7.4+
Disable Heartbeat API	Disables or limits the Heartbeat API to reduce server load. Keeps it active only in the post editor where it's needed.	1.0.0	6.6+	7.4+
Disable oEmbed	Disables WordPress oEmbed functionality to reduce HTTP requests and improve performance. Use if you don't embed external content.	1.0.0	6.6+	7.4+
Disable Pattern Directory	Prevents the block editor from fetching block patterns from api.wordpress.org on every editor load. Eliminates the external HTTP request and brief pattern-loading delay.	1.0.0	6.6+	7.4+
Disable Pingback	Disables pingback XML-RPC method and removes the X-Pingback HTTP header to prevent IP disclosure attacks behind firewalls/proxies.	1.0.0	6.6+	7.4+
Disable Plugin Update Checks	Disables automatic plugin update checks to reduce server load. Useful for managed/frozen environments where updates are controlled manually.	1.0.0	6.6+	7.4+
Disable Post by Email	Disables WordPress post-by-email functionality to improve security and reduce attack surface.	1.0.0	6.6+	7.4+
Disable Query String Versioning	Strips ?ver= query strings from enqueued script and style URLs so CDN and proxy caches can cache assets without per-version cache misses.	1.0.0	6.6+	7.4+
Disable REST API for Guests	Blocks REST API access for unauthenticated users. Whitelisted routes (oEmbed) remain public. Use the 'mu_rest_guest_whitelist' filter to customise.	1.0.0	6.6+	7.4+
Disable RSS Feeds	Redirects all RSS and Atom feed URLs to the homepage. Use only on sites that have no blog or do not need syndication.	1.0.0	6.6+	7.4+
Disable Scaled Image Generation	Prevents WordPress from creating a -scaled copy of large images (added in WP 5.3). Keeps original dimensions intact for sites that do not require server-side downscaling.	1.0.0	6.6+	7.4+
Disable Site Health	Removes the Site Health admin page, dashboard widget, and its background cron check. For production sites managed externally where Site Health output is noise rather than signal.	1.0.0	6.6+	7.4+
Disable Theme Update Checks	Prevents WordPress from checking for theme updates on wordpress.org. For fully managed environments where themes are updated via CI/CD. Complements the existing plugin update disabler.	1.0.0	6.6+	7.4+
Disable User Enumeration	Prevents user enumeration via author archives and REST API to protect usernames from discovery.	1.0.0	6.6+	7.4+
Disable User Registration	Disables public WordPress self-registration through wp-login.php and the REST API without blocking users created by administrators, WooCommerce, or trusted integrations.	1.1.0	6.6+	7.4+
Disable WC Coupon Field	Hides the coupon field on cart and checkout pages. Prevents customers from abandoning checkout to search for discount codes on stores that don't use coupons.	1.0.1	6.6+	7.4+
Disable WC Guest Checkout	Forces account registration at checkout. Required for subscription or membership stores where an account is needed to manage orders.	1.0.1	6.6+	7.4+
Disable Welcome Panel	Removes the welcome panel from the WordPress dashboard for a cleaner admin experience.	1.0.0	6.6+	7.4+
Disable WooCommerce Cart Fragments	Prevents WooCommerce from enqueuing the cart-fragments AJAX script on pages where no cart interaction is possible, reducing unnecessary AJAX requests on every page load.	1.0.1	6.6+	7.4+
Disable WooCommerce Marketing Hub	Removes the WooCommerce Marketing admin menu and disables marketing-related background cron events and HTTP calls to woocommerce.com. For stores that do not use Mailchimp or other WooCommerce marketing integrations.	1.0.1	6.6+	7.4+
Disable WooCommerce Status Dashboard Widget	Removes the WooCommerce status dashboard widget from the WordPress admin dashboard, reducing noise for sites that use WooCommerce Analytics or a custom overview instead.	1.0.1	6.6+	7.4+
Disable WordPress Search	Redirects /?s= search queries to the homepage, eliminating unnecessary database queries on sites without search functionality.	1.0.0	6.6+	7.4+
Disable XML-RPC	A utility plugin to disable XML-RPC.	1.0.0.	6.6+	7.4+
Disallow Weak Usernames	Blocks creation of accounts with usernames commonly targeted by credential-stuffing attacks (admin, test, wordpress, etc.).	1.0.0	6.6+	7.4+
Enable SVG Upload	Enables sanitized SVG uploads and Media Library previews. Still required on WordPress 7.1+, whose SVG Icon API does not enable SVG media uploads.	1.2.0	6.6+	7.4+
Environment Indicator	Displays a visual indicator in the admin bar showing the current environment (Development/Staging/Production) to prevent editing the wrong site.	1.0.0	6.6+	7.4+
File Integrity Monitor	Daily cron job that hashes every .php file under wp-admin, wp-includes, wp-content/plugins and wp-content/themes and compares against the previous run. Emails the admin and logs a diff when files are added, removed, or modified outside of a core/plugin update. Detects malware droppers and unauthorized file edits.	1.0.0	6.6+	7.4+
Force HTTPS	Redirects any HTTP request to HTTPS with a 301, covering the frontend, wp-admin, and wp-login.php. Only activates when the site's home URL is already configured for https, so an intentionally HTTP-only environment is left untouched. Behind a reverse proxy that terminates TLS, enable the 'mu_force_https_trust_proxy' filter to trust the X-Forwarded-Proto header.	1.0.0	6.6+	7.4+
Force Strong Passwords	Rejects passwords shorter than 12 characters or missing uppercase, lowercase, number, and special character. Applied to profile updates and registration.	1.0.0	6.6+	7.4+
Force WooCommerce Strong Passwords	Applies password strength validation to WooCommerce registration and checkout forms. WooCommerce skips WordPress's default strength rules for customers; this closes that gap.	1.0.1	6.6+	7.4+
Harden Cookie Flags	Adds a SameSite attribute (default Lax) and the Secure flag over HTTPS to every cookie set during the request, including WordPress's auth and logged-in cookies, without touching core's auth cookie logic. Configure via the 'mu_cookie_samesite' filter.	1.0.0	6.6+	7.4+
Hosting Disallowed Plugins	Disallows plugins known to cause issues on managed hosting platforms. Based on popular hosting platforms.	1.1.0	6.6+	7.4+
HTTP API Failure Monitor	Tracks outbound WordPress HTTP API failures by host without storing URL paths, request bodies, headers, or credentials.	1.0.0	6.6+	7.4+
Lazy Load Gravatars	Defers loading of Gravatar images until they're needed, reducing initial page load time and external HTTP requests.	1.0.0	6.6+	7.4+
Limit Autoload Bloat	Runs daily to detect wp_options rows with autoload=yes that exceed a configurable byte threshold. Logs offenders and optionally sets them to autoload=no. Configure threshold via 'mu_autoload_size_threshold' filter (default 10 000 bytes).	1.0.0	6.6+	7.4+
Limit Cron Concurrency	Uses a transient-based lock to prevent multiple simultaneous wp-cron.php processes from running the same scheduled hook, reducing database contention on busy sites.	1.0.0	6.6+	7.4+
Limit Image Sizes	Removes unnecessary intermediate image sizes (medium_large, 1536x1536, 2048x2048) that WordPress generates by default. Reduces disk usage and upload processing time. Keep list via 'mu_allowed_image_sizes' filter.	1.0.0	6.6+	7.4+
Limit Login Attempts	Blocks IP addresses after 4 failed login attempts for 24 hours to prevent brute force attacks.	1.0.0	6.6+	7.4+
Limit Password Reset Attempts	Blocks an IP address after 5 password reset requests within an hour, preventing reset-form spam and mail-bombing of targeted accounts. Independent of Limit Login Attempts, which only covers failed logins. Reuses its 'mu_get_user_ip' filter for sites behind a trusted reverse proxy.	1.0.0	6.6+	7.4+
Limit Post Revisions	Limits the number of post revisions stored in the database to reduce bloat and improve performance.	1.0.0	6.6+	7.4+
Limit Upload Size by Role	Sets different maximum upload file size limits for different user roles to prevent large uploads from non-admin users.	1.0.0	6.6+	7.4+
Mail Delivery Monitor	Records bounded, privacy-safe wp_mail failures and shows administrators the latest sending status.	1.0.0	6.6+	7.4+
Media Accessibility Check	Flags images that need alt-text review while allowing editors to mark intentionally decorative images.	1.0.0	6.6+	7.4+
OpenWP Club Core	Core functionality and branding for OpenWP Club managed WordPress sites.	1.0.0	6.6+	7.4+
OpenWP Operations Center	Consolidates operational health, alerts, privacy-safe logs, retention controls, exports, and safe cleanup reports.	1.0.0	6.6+	7.4+
Optimize Database Tables	Runs OPTIMIZE TABLE weekly on core WordPress tables to reclaim fragmented space and maintain query performance.	1.0.0	6.6+	7.4+
Optimize WooCommerce Assets	Only loads WooCommerce scripts and styles on shop-related pages to improve site performance.	1.0.0	6.6+	7.4+
Preconnect Resource Hints	Outputs tags for configurable external origins. Reduces round-trip latency before the first byte of external resources. Configure via the 'mu_preconnect_origins' filter.	1.0.0	6.6+	7.4+
Remove Author Metabox	Removes the author meta box from post and page edit screens in WordPress admin.	1.0.0	6.6+	7.4+
Remove H1 Editor	Removes H1 heading option from both Classic Editor (TinyMCE) and Block Editor (Gutenberg) to improve SEO structure.	1.1.0	6.6+	7.4+
Remove jQuery Migrate	Removes jQuery Migrate script from WordPress to reduce page weight. Only use if your theme and plugins don't require legacy jQuery support.	1.0.0	6.6+	7.4+
Remove Plugin Bloat	Removes admin bar items and source code footprints from popular plugins like WP Rocket, Redis Cache, etc.	1.0.0	6.6+	7.4+
Remove Unused Admin Menus	Removes admin menu items defined in MU_REMOVE_ADMIN_MENUS. Useful for client sites where certain sections are irrelevant.	1.0.0	6.6+	7.4+
Remove WordPress Branding	Removes WordPress logo, admin footer text, and blocks access to WordPress about pages for white-label admin experience.	1.0.0	6.6+	7.4+
REST API Rate Limiting	Limits REST API requests per IP to prevent abuse. 60 requests/minute for guests, 200 for authenticated users.	1.1.0	6.6+	7.4+
Restrict REST API Blocks	Limits access to block-related REST API endpoints to authenticated users only.	1.0.0	6.6+	7.4+
Restrict Search to Titles	Rewrites the frontend search WHERE clause to match post_title only, instead of scanning post_content and excerpt with LIKE. Reduces query cost on large catalogs/archives that don't need full-text search. Skip on sites where searching body content is required.	1.0.0	6.6+	7.4+
Safe Orphaned Post Meta Cleaner	Reports orphaned post metadata weekly and deletes it in bounded batches only when MU_CLEANUP_MODE is set to delete.	2.0.0	6.6+	7.4+
Safe Unattached Media Cleanup	Reports old unattached media weekly and only trashes or deletes it when the cleanup mode is explicitly changed.	2.0.0	6.6+	7.4+
Safe WooCommerce Order Data Retention	Reports old terminal WooCommerce orders monthly and only trashes or deletes them when the cleanup mode is explicitly changed.	2.0.0	6.6+	7.4+
Safe WooCommerce Stale Order Cleanup	Reports abandoned pending/on-hold WooCommerce orders weekly and only trashes or deletes them when the cleanup mode is explicitly changed. Complements Safe WooCommerce Order Data Retention, which only covers terminal-status orders. Supports both HPOS and legacy post-based orders.	1.0.0	6.6+	7.4+
Sanitize File Name	Automatically removes accents and special characters from uploaded file names for better compatibility.	1.0.0	6.6+	7.4+
Scheduled Maintenance Window	Shows a maintenance page automatically during a recurring time window. Define MU_MAINTENANCE_WINDOWS as an array of windows with 'start', 'end' (HH:MM), and optional 'days' (array of day names). Uses server time.	1.0.0	6.6+	7.4+
Security Headers	Sends X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and (over HTTPS) Strict-Transport-Security headers on every response. Reduces clickjacking, MIME-sniffing, and referrer-leak risk with no configuration. Skips the frontend if a caching/CDN layer already sets these.	1.1.0	6.6+	7.4+
Security.txt Provider	Serves an RFC 9116 security.txt file when MU_SECURITY_CONTACT is configured in wp-config.php.	1.0.0	6.6+	7.4+
Simple Maintenance Mode	Simple maintenance mode that shows a branded page. Toggle by creating/deleting .maintenance file in wp-content.	1.0.0	6.6+	7.4+
Staging Robots Noindex	Outputs X-Robots-Tag: noindex HTTP header and adds noindex to wp_robots on any environment that is not 'production'. Prevents staging or local sites from being indexed without editing wp-config.php.	1.0.0	6.6+	7.4+
Strip EXIF Metadata	Removes GPS coordinates, camera model, and other EXIF data from uploaded JPEG images at save time using GD, reducing privacy exposure.	1.0.0	6.6+	7.4+
Transient Cleaner	Runs a daily WP-Cron job to delete expired transients from wp_options. Keeps the database tidy on sites that accumulate plugin transients over time.	1.0.0	6.6+	7.4+
Trusted IP Allowlist	Blocks access to wp-admin and wp-login.php for IPs not in the allowlist. Define MU_TRUSTED_IPS as an array of allowed CIDR ranges or exact IPs. Only use on sites with a static management IP.	1.0.0	6.6+	7.4+
Two-Factor Email OTP	Adds a second authentication step after a successful password login. A 6-digit code is emailed to the user; the session is not created until the code is verified.	1.0.0	6.6+	7.4+
Update Policy Controller	Keeps update checks visible while applying balanced, automatic, manual, or frozen update policies; frozen also locks file modifications.	1.0.0	6.6+	7.4+
WooCommerce Action Scheduler Monitor	Warns administrators about failed or overdue Action Scheduler jobs used by WooCommerce and its extensions.	1.0.0	6.6+	7.4+
WooCommerce Low Stock Notice	Adds a dashboard widget listing stock-managed products at or below their low-stock threshold, so store admins see restock needs without opening WooCommerce reports. Override the fallback threshold (used when a product has no threshold set) via the 'mu_wc_low_stock_fallback' filter (default 5).	1.0.1	6.6+	7.4+
WooCommerce Order Auto-Complete	Automatically transitions orders containing only virtual or downloadable products from 'processing' to 'completed' immediately after payment. Eliminates manual order management for digital-goods stores.	1.0.1	6.6+	7.4+
WooCommerce Order Number Format	Adds a configurable prefix and/or suffix to the order number shown in admin, emails, and the customer account area. Define MU_WC_ORDER_NUMBER_PREFIX and/or MU_WC_ORDER_NUMBER_SUFFIX in wp-config.php. The underlying order ID is unchanged.	1.0.1	6.6+	7.4+
WooCommerce Payment Health Monitor	Tracks failed orders and webhook deliveries, and reports stale pending or on-hold orders without storing customer or payload data.	1.0.0	6.6+	7.4+
WooCommerce Store Manager Mode	Provides a simplified "Store Manager" view for WooCommerce users. Toggle between full WordPress admin and a decluttered, WooCommerce-focused interface via the admin bar.	1.1.0	6.6+	7.4+