Security, backups and cookie consent, in one WordPress plugin.

WP Toolkit Studio is an all-in-one WordPress security and maintenance plugin by Handicraft Marketing. It combines a firewall, malware scanning, login protection, backups, migration, auto-updates, a cookie consent banner and image optimization, with white-label branding for agencies.

For most sites, yes: it covers a firewall, malware scanning, login protection, backups, migration, cookie consent and image optimization. Run one plugin per job, though; switch off the matching module or the old plugin so two firewalls or two backups do not run at once.

It compares WordPress core files, and plugins and themes hosted on WordPress.org, byte for byte with official checksums. It also matches known malware signatures, analyses what obfuscated code actually does, scans the database and watches critical site settings.

It quarantines instead of deleting, and only the highest-confidence findings are quarantined automatically. A file that is byte-identical to its official WordPress.org release is never removed automatically, and permanently deleted quarantine files are kept for 30 days first.

It finds and quarantines malware, removes known malicious database entries for confirmed malware families, and repairs core, plugin and theme files by reinstalling the official package. Badly compromised sites may still need a manual review, which we can do for you.

No. The firewall only inspects anonymous, logged-out traffic, and it starts in learning mode, which logs matches without blocking. Switch to block mode after a few days, once the log looks right.

On the server itself, Nextcloud, Amazon S3 or S3-compatible storage such as Wasabi, Backblaze or DigitalOcean Spaces, Google Drive, Dropbox, OneDrive, FTP or FTPS, and SFTP. You can keep a set number of daily, weekly and monthly copies.

Database restores are automatic: the plugin takes a safety snapshot first and asks you to type a confirmation. Files are restored by downloading the archive and extracting it, which is safer than overwriting a live site automatically.

Yes. Quick Migration creates a one-hour link on the old site. Paste it on the new site, confirm, and it imports the database and content, rewrites every URL without breaking serialized data, and checks the new address afterwards.

Yes. Scans and backups run in small, time-boxed chunks so they finish on shared hosting without timing out, and a circuit breaker keeps a problem in the plugin from taking the site down.

Yes. The banner has necessary, functional, analytics and marketing categories, blocks tracking scripts until consent, sends Google Consent Mode v2 signals, logs consent, and can build a cookie declaration for your privacy policy.

Yes. Users can turn on two-factor login with an authenticator app, with backup codes for when they lose their phone. Secrets are sealed at rest and backup codes are stored hashed.

Add one line to wp-config.php to switch off the hidden login URL, the firewall or the whole plugin instantly, without database access. The constants are listed in the plugin readme.

Yes. Set your agency name, logo, support email and support link, and hide the powered-by line, so client dashboards and alert emails show your brand.

Yes. Fleet lets one site act as a hub that shows the status of every enrolled client site, and shares an IP blocklist across your portfolio.

An optional endpoint, off by default, that lets an AI assistant using the Model Context Protocol run scans and backups and read status. Destructive actions only work while an admin has armed it from WP Admin, and requests are signed.

Auto-updates are off by default. When you turn them on, a full backup runs first and the update uses WordPress's own updater. You can exclude any plugin you do not want updated automatically.

It includes WebP image conversion, missing image size fixes, emoji script removal, self-hosted Google Fonts and a performance audit. It is not a caching plugin, so keep your host's cache in place.

Yes, with a free WPScan API key. Checks are spread out over time to stay inside the free limit, and only publicly disclosed vulnerabilities can be detected.

Three plans in Pakistani Rupees: PKR 2,200 a month, PKR 15,000 a year, or PKR 35,000 once for lifetime use. Every plan includes the full plugin and updates. Prices are per website; ask on WhatsApp for a multi-site price.

Yes. Every plan includes updates: for as long as you are subscribed on the monthly or yearly plan, and for life on the lifetime plan.

WordPress 5.8 or newer and PHP 7.4 or newer. WP-CLI is used when available; SFTP backups need the PHP ssh2 extension, which some shared hosts do not offer.