Version Locker
Version Locker is an update manager that lets you disable automatic updates in WordPress and keep any plugin, theme, or WordPress core itself on the version you are running today. Turn off updates for one plugin, for every plugin at once, for themes, or for WordPress core. Once something is locked it will not update automatically, and the one-click update button is withheld until you unlock it. Every switch is reversible in one click. Stop Automatic Updates, Without Losing Track of Them Most plugins that disable updates simply hide them, and six months later you have no idea how far behind you are. Version Locker still shows you the update it is holding, including the new version number and whether it is a major, minor, or patch release. You can add a note explaining why something is pinned, and set a date for the lock to release itself. Downgrade WordPress Core to a Specific Version Pick the release you want and Version Locker offers it under Dashboard > Updates. Nothing is installed until you start it there yourself, and once the site is on that release, further core updates are held back. You can downgrade WordPress to an earlier version, or hold WordPress on the version you have tested, without editing files over FTP or hunting for an old ZIP. Only releases published on WordPress.org are offered, and the package always comes from WordPress.org in your site’s own language. Going backwards across a major version has to be confirmed first, because WordPress upgrades the database as it goes and cannot migrate it back. Who This Is For Agencies and freelancers managing client sites. Anyone running a customized or patched plugin. Production and eCommerce sites that update on a schedule. Sites on older PHP or an older WordPress version. What It Does Lock an individual plugin or theme at the version it is on, including against another admin who tries to update it. Turn off all plugin updates, all theme updates, or core updates with one switch, so you can freeze a whole site before a migration, an audit, or a busy trading period. Roll back a plugin or theme to any earlier version still published on WordPress.org, from inside your dashboard. No FTP, no hunting for old ZIP files. Downgrade WordPress core to a specific version, or hold it on the one you have tested. Hold new releases for a set number of days before WordPress offers or installs them. Let other people find the bugs first. It only ever delays an update, it never starts one. Block new plugin and theme installs, including ZIP uploads. Lock anything you newly install, automatically. Save your locks and settings to a file and load them on another site. You see exactly what will change before anything is applied. See the version each item is pinned at and how far behind you have fallen, major, minor, or patch, with an “update available” indicator that does not bring the update button back. Add a note to any lock, and set it to unlock itself on a date. Lock and unlock without a page reload, in bulk, with search and filtering across your plugins and themes. Activity log showing who changed what and when, with CSV export. Works on Multisite. How It Works Version Locker uses WordPress filters to hide update notices and refuse update attempts. Locking never touches your files: nothing is added, changed, or removed on disk. The one exception is Roll Back, which only runs when you ask for it. It downloads the version you pick from WordPress.org and replaces the installed files, exactly as a normal update would. You are warned and asked to confirm first. No account, no API key, no external service. Nothing is sent anywhere.
Remove XML-RPC Methods
Removes all WordPress methods from the XML-RPC API to increase security. It does more than just using the xmlrpc_enabled hook, because that is only used “To disable XML-RPC methods that require authentication”. Activating this plugin will also disable pingbacks, trackbacks, and Really Simple Discovery (RSD), because these rely on XML-RPC. It works with any webserver, because it does not use the .htaccess file. Testing the plugin From the command line you can test if the plugin is working correctly using curl. Replace the example.com link to match your website: curl -d ' system.listMethods ' https://example.com/xmlrpc.php This should only return the following methods: – system.multicall – system.listMethods – system.getCapabilities
