EN 
FR 
ES 
With the 2.20.0, WPMasterToolKit takes a real step forward. This update doesn't just add a few options or correct isolated details. It thoroughly strengthens the plugin's security, improves the robustness of several sensitive modules, and introduces some very useful new tools for the day-to-day administration of a WordPress site.
The main theme of this release is clear: reduce attack surfaces, better control critical actions, secure sensitive data flows and enhance the arsenal of WordPress administrators. The result is a more coherent, more robust version, better suited to sites that want both greater management convenience and a higher level of protection.
Major new features in WPMasterToolKit 2.20.0
Version 2.20.0 brings four new modules that meet concrete needs in terms of security, maintenance and SEO management.
Block 404 PHP File Scanning
The module Block 404 PHP File Scanning blocks requests for non-existent PHP files when WordPress resolves them to a 404 error. Instead of letting this type of traffic through, the module returns a 403 Forbidden and adds a dedicated entry in the logs with the marker PHP404.
It's a simple but highly effective protection against automated scans that look for vulnerable scripts, forgotten files or exploitable entry points on a WordPress site. In practice, this reduces the noise in queries and makes it easier to spot certain malicious recognition attempts.
Custom COOKIEHASH
The new module Custom COOKIEHASH automatically adds a constant COOKIEHASH randomly in the wp-config.php when activated. Its purpose is to improve the isolation of the site's cookies by relying on a specific, robustly generated value.
The module also removes this constant cleanly when deactivated. This new feature is part of a hardening logic that's simple to activate, but relevant for reinforcing WordPress cookie management in certain contexts.
Redirect Manager
The module Redirect Manager is one of the most visible additions to this version. It provides a complete interface for create, modify, delete, import and export redirections.
Designed to meet the real needs of site administrators and SEOs, it enables clean management of URL changes, deleted pages, migrations, redesigns and the recovery of old structures. The Pro version also adds a hits loggingThis allows you to track activity on configured redirects.
Another important point: the module supports several execution modes depending on the environment, with redirections managed on the WordPress, Apache or Nginx. This makes it a true SEO and maintenance tool, capable of adapting to different hosting contexts.
Password Expiration
The Pro module Password Expiration introduces a password expiry policy by user role. When a password exceeds the authorized duration, the user is logged out, his active sessions are invalidated and he is redirected to the reset process.
This new feature will be of particular interest to multi-user sites, sensitive back-offices and all environments where access hygiene needs to be better controlled. It's a very useful addition for reinforcing good security practices on WordPress without relying on a separate plugin.
A global hardening update
One of the most important points of WPMasterToolKit 2.20.0 is that it is not a series of scattered patches. This version applies a logic of transversal hardening on the entire plugin.
Enhanced capacity checks
Many administration, AJAX and form submission workflows have been tightened up with stricter capability controls. In practice, this means that sensitive actions now explicitly require the right permissions depending on context.
This standardization reduces the risk of a critical action being performed by an account that should not have access to it.
Enhanced CSRF protection
Nonces management has been strengthened in several configuration forms, entry points admin_initAJAX handlers and backup flows. The aim is clear: to better protect administration actions against forged requests.
This is not an isolated improvement on a single module, but a more general upgrade of the entire plugin.
Stricter validation of entries
Version 2.20.0 also tightens the validation of inputs manipulated by several modules. These include dynamic identifiers, file names, paths, SQL tables, certain columns and regex patterns.
This in-depth work is particularly visible on functions that affect sensitive areas such as the database, files and exports.
More secure file and database operations
Operations involving paths, multiple selections, copies, deletions, archives or dynamic tables now benefit from additional safeguards. This reduces the risk of directory traversal, unexpected processing or abuse linked to manipulated entries.
The modules most affected on the security side
Although the general philosophy of this release is based on an overall reinforcement, certain modules deserve particular attention.
Password Protection
The module Password Protection abandons a hard-coded cookie secret in favor of a value derived from the password defined by the administrator, in a spirit close to WordPress' native behavior for certain protected content.
In concrete terms, cookies become linked to the password set. If this password changes, old cookies become invalid. This version also improves flag management secure cookies to better respect HTTPS and validate the redirect URL to avoid open redirects.
Temporary Login
The module Temporary Login removes the plain-text password from the administration URL and replaces it with a saner mechanism based on a short-lived server token, accompanied by a one-shot display of the password.
In addition, a system for limiting connection failures by user and IP has been added to limit abuse of magic links. The throttle is cleaned after successful authentication.
Two-Factor Authentication
The module Two-Factor Authentication receives several important enhancements. Public endpoints wp_ajax_nopriv are better protected against abuse, responses are more uniform to limit enumeration and the limitation counter is reset after successful code validation.
The popup interface has also been improved to better inform the user in the event of a rate limit. Finally, a concrete bug has been fixed for e-mail address-based connections, where retrieving the user in certain AJAX handlers could block retrieval of the 2FA method and code generation.
Force SSL
The module Force SSL reinforces its HTTPS redirection logic by relying on the canonical host of home_url rather than on a HTTP_HOST potentially manipulable. It's an unobtrusive change, but an important one for making the construction of secure redirections more reliable.
Maintenance Mode
The module Maintenance Mode improves the entropy of its bypass token by replacing a generation that is too low with random_bytes. This reduces the risk of token prediction to bypass maintenance mode.
Administer
The module Administer benefits from a substantial security upgrade. Identifiers are no longer exposed in HTML or URLs, authentication is based on a cleaner session mechanism, auto-login remains compatible with expected uses, and the file can self-delete on expiry.
The set has also been realigned with Adminer v5+This improves both the security and consistency of the module.
Add Essentials Shortcodes Pro
On the Pro side, the Add Essentials Shortcodes secures access to the WordPress options reading shortcode with a logic of whitelist. Options are blocked by default and must be explicitly authorized by an administrator. Outputs are also escaped to reduce XSS risks.
Redirect Manager: a new feature with a strong SEO impact
Among the new features of this version, Redirect Manager is undoubtedly the one that will have the most immediate impact for many users.
This module provides centralized redirection management with :
- a dedicated administration interface ;
- base storage ;
- support for exact redirects and regexes ;
- query parameter management ;
- several execution modes depending on the infrastructure.
In WordPress mode, the module intercepts the request via template_redirectIt first searches for an exact match, then tests regexes if necessary. It can compare parameters in any order, ignore them or pass them on to the target, depending on the setting chosen.
This makes it a very useful tool for :
- site migrations ;
- URL structure redesigns ;
- correction of broken backlinks ;
- reuse of old content ;
- management of deleted pages ;
- improving user experience and technical SEO.
In the environment Apache or NginxThe module also opens the door to redirections closer to the server layer, which can be interesting depending on performance or architectural constraints.
Even greater security for sensitive modules
File Manager
The module File Manager has been tightened up on upload validation, file names, Windows separators, directory limits, certain low-level operations and recursive copies involving symlinks.
The aim is to more firmly prevent unauthorized access to the file system.
Search Replace in Database
The module Search Replace in Database adds defense-in-depth with a real-time table whitelist, strict table match checks, cleaner validation of SQL identifiers and safeguards on regexes used for replacements.
SMTP Mailer
The module SMTP Mailer sees several entry points better protected, including send tests, previews of captured content and certain OAuth callbacks linked to supplier authentication.
Mail Catcher
The module Mail Catcher also reinforces access controls on the viewing and previewing of captured messages, to prevent the exposure of sensitive content to unauthorized accounts.
Other notable enhancements in WPMasterToolKit 2.20.0
In addition to the large security block and new modules, this release brings a number of useful enhancements.
Disallow Access WP Sensible Files
The module Disallow Access WP Sensible Files extends protection to more files, such as readme and changelog in txt, md and html formats, in addition to license.txt. It also blocks certain sensitive direct accesses to wp-admin and wp-includes.
Disallow Bad Requests
The module Disallow Bad Requests corrects a false positive on search URLs containing Cyrillic or other non-Latin characters, which could produce long UTF encoded URLs.
Blacklisted Usernames
The module Blacklisted Usernames adds 24 new forbidden usernames based on recent security trends and reports, improving protection against certain trivial login attempts.
Auto Regenerate Salt Keys
The module Auto Regenerate Salt Keys changes its default frequency to Never. This choice is intended to avoid certain side-effects with plugins that rely on salt keys to encrypt or protect sensitive data.
Automatic regeneration therefore becomes an explicit choice, while manual regeneration remains available.
Why this version is important
WPMasterToolKit 2.20.0 is an important update because it doesn't just seek to accumulate new features. It consolidates what already exists, standardizes security practices, adds genuinely useful modules and improves the plugin's operational control in a wide variety of contexts.
For WordPress administrators, this means:
- more control ;
- less unnecessary exposure;
- better control of access ;
- more comprehensive tools for managing redirects ;
- greater resistance to scans, abuse and sensitive flows.
For production sites, this version is clearly a step in the right direction in terms of stabilityof safetyof readability of logs and risk reduction.
Conclusion
With this release, WPMasterToolKit 2.20.0 confirms its philosophy: to offer an all-in-one WordPress plugin capable of replacing several specialized extensions, while retaining a modular logic and optimized loading.
This version is distinguished by a highly successful balance between new features, SEO improvements and safety hardening. Visit Redirect Manager, Password Expiration, Custom COOKIEHASH and Block 404 PHP File ScanningThe additions are tangible. And with the overall reinforcement of many existing modules, this update also brings an immediate gain in robustness.
For WPMasterToolKit users, 2.20.0 isn't just a maintenance release. It's a structuring release, designed to make WordPress more secure, cleaner to administer and better equipped for real-world needs.
