Every Feature,
Explained

Adds a "Clone" action to content list tables. Clicking it opens a popup where you can set the title and status of the duplicate before it is created.

Every link pointing to an external domain inside post content is automatically set to open in a new tab. A rel="noopener noreferrer nofollow" attribute is also injected to prevent security vulnerabilities and avoid passing SEO authority to third-party sites.

Enable uploading of additional file types that WordPress blocks by default — including SVG, AVIF, and other formats. Per-role upload permissions included.

Adds a "Sort Order" button to the enabled list tables. Clicking it opens a drag-and-drop page where you can set a custom visual order for posts, taxonomy terms, and users. The saved order is stored privately and does not affect the frontend.

Adds a "Replace File" button to every attachment in the Media Library. Upload a replacement file: the original is overwritten, all image sizes are regenerated, and the attachment metadata is updated — keeping the same attachment ID and URL.

Replaces the Media Library pagination with automatic infinite scroll: new attachments load as you reach the bottom of the page, in both Grid and List views.

Adds a category sidebar to the Media Library. Create custom categories with a name and color, lock them against deletion, drag attachments into categories, use bulk actions to assign files, and rely on the built-in Uncategorized fallback.

Enable uploading of additional file types that WordPress blocks by default — including SVG, AVIF, and other formats. Per-role upload permissions included.

Sets a custom favicon only for the WordPress admin area. The frontend favicon set in your theme or WordPress settings is not affected.

Replace the WordPress logo in the top admin bar with a custom image from the media library. The icon size is preserved (20×20 px) to avoid breaking the layout.

Adds a custom logo at the top of the WordPress admin sidebar menu, with configurable background color, hover color, and an optional link URL.

Changes the font family used throughout the WordPress admin interface. Pick any Google Font or enter a custom font stack.

Forces a specific WordPress admin color scheme for all users, overriding their personal preferences. Choose from 8 built-in presets.

Replaces the default left and right footer text in the WordPress admin. Add your agency brand, a support link, or a copyright notice.

Customizes the font size of admin menu, sub-menu and admin bar items independently from the rest of the admin UI.

Sets a custom top/bottom padding for admin menu and sub-menu items. Adjust for a more spacious or compact sidebar layout.

Sets a custom width for the WordPress admin sidebar menu. Expand to accommodate long labels, or shrink for a tighter layout.

Sets a fixed number of columns (1–4) in the WordPress dashboard for all users, overriding their personal Screen Options preference.

Permanently hide selected items from the WordPress admin bar — comments icon, update notices, howdy text, and more. Keep only what matters.

Permanently hide selected widgets from the WordPress dashboard — Welcome panel, WP News, Quick Draft, At a Glance, and more. Create a clean experience for clients.

Hides the collapse/expand arrow at the bottom of the admin sidebar and keeps the menu always expanded, regardless of the state previously saved in the user profile.

Moves all WordPress admin notices into a slide-in sidebar panel. A bell button in the admin bar shows the unread count. Inside the panel you can mark notices as read or delete them individually or all at once.

Hides the WordPress admin bar on the frontend and/or backend for the selected user roles. If no role is checked for a context, the bar is hidden for all users except administrators.

Create custom admin pages with HTML, CSS, JS and PHP. Each page appears as a menu or submenu entry in the WordPress admin with a custom icon.

Hides all system admin notices (the coloured notice boxes) for the selected user roles. Administrators are always excluded from the module effect unless the Administrator role is explicitly checked.

Removes the Website URL field from the comment form, strips author links from published comments, and prevents new comments from storing a URL — reducing spam and unwanted outbound links.

Completely disables the WordPress comment system: removes comment support from all post types, hides the Comments menu, blocks comment feeds, removes the X-Pingback header, and returns a blank comments template.

Removes the Dashicons stylesheet from the frontend, reducing page weight for visitors who do not need WordPress admin icons.

Removes the oEmbed JavaScript (wp-embed.min.js), discovery links, rewrite rules and prevents others from embedding your site.

Removes the WordPress emoji detection script, inline styles, DNS-prefetch and TinyMCE plugin — reducing HTTP requests and page weight.

Replaces the block editor with the classic editor. Select specific post types to limit the effect, or leave all unchecked to disable Gutenberg everywhere.

Removes the jQuery Migrate script from the frontend. This file is only needed for legacy code written for very old jQuery versions — not required on modern sites.

Removes the zxcvbn (~400 KB) and password-strength-meter scripts from all pages where a password form is not present. They are kept on WooCommerce account, checkout, and native WordPress password-reset pages.

Restricts access to the WordPress REST API. Choose whether to block it for non-logged-in users, non-administrators, or everyone.

Removes the REST API discovery links from the HTML , HTTP response headers, and the RSD endpoint. The REST API remains fully functional — only its public advertisement is hidden.

Removes the RSD (Really Simple Discovery) link tag from the . It is only used by legacy blogging clients like Windows Live Writer and is not needed on modern sites.

Removes the RSS autodiscovery tags from the for both the posts feed and the comments feed. The feed URLs remain accessible — only the autodiscovery hints are hidden.

Disables all RSS and Atom feeds generated by WordPress (posts, comments, categories, tags, authors). Feed URLs return a 404 response and the feed autodiscovery links are removed from the .

Prevents WordPress from sending a pingback to itself when a post links to another post on the same site. External pingbacks are not affected.

Removes the tag from the and the Link HTTP header added by WordPress on singular pages.

Removes the WordPress version from the generator meta tag, RSS feeds and the ?ver query string on scripts and stylesheets — reducing information exposure to potential attackers.

Completely disables the XML-RPC protocol, blocking remote access via xmlrpc.php. This prevents brute-force attacks, pingbacks and any third-party tool that relies on XML-RPC.

Selectively suppress update notifications and automatic updates for WordPress core, translation files, individual plugins and themes.

Browse tables, inspect structure, run custom SQL queries, optimize and repair tables, and export SQL dumps — all from the WordPress admin.

Clean up your database: remove post revisions, auto drafts, trashed posts, spam/unapproved comments, transients, orphan and duplicated meta, unused terms, and run OPTIMIZE TABLE on all tables.

Adds a file manager to browse, upload, rename and edit files on the server. Choose whether it appears as a submenu of this plugin or as a standalone item in the WP admin menu. Includes a CodeMirror-powered code editor with dark mode and fullscreen.

Register external CDN libraries (scripts or stylesheets) and load them on the frontend & backend. Specify position (head/footer) and enable/disable each entry individually with 200+ template.

Reorder, hide and extend the WordPress admin menu. Drag items to reorder, hide items per role, add custom separators and custom menu/submenu items.

Create, edit, duplicate and delete WordPress roles. Includes a full capability map with toggles for all standard WordPress permissions. The Administrator role is protected.

On the Plugins page, sorts plugins by status. Choose whether active or inactive plugins appear first.

Send custom admin notifications to all users, a specific role, or a single user. Track who received, read, or deleted each notification. Delivered via the Notifications Off-Canvas panel.

Sends a Telegram message each time a user logs in. Configure the bot token, chat ID and a custom message template with placeholders for username, role, date/time and IP address.

Assign multiple roles to a single user. Adds an "Additional Roles" section to each user profile page. Capabilities from all assigned roles are combined.

Internal messaging system between admin users. Adds a chat icon to the admin bar with an unread message badge. Configure which roles have access. Features include real-time polling, unread badges, read receipts, dark mode, and conversation management.

Configure a custom SMTP server for all outgoing WordPress e-mail. Set host, port, encryption, credentials and a custom From address. Includes a test button to verify your configuration.

Adds an "Optimize" button to each image in the Media Library. Opens a modal to scale the image by percentage and convert its format (JPEG, PNG, WebP, AVIF). The original is backed up automatically and can be restored at any time.

Manage HTML, CSS, JS and PHP code snippets injected into the frontend, backend, or login page. Supports inline/file loading, execution priority, PHP shortcodes, on-demand AJAX execution, and secure URL execution.

Manage 301/302/410 redirects from the admin panel with access logging. Useful when renaming slugs, moving content, or marking pages as permanently gone (410).

Manage 301/302/410 redirects from the admin panel with access logging. Useful when renaming slugs, moving content, or marking pages as permanently gone (410).

Edit the virtual robots.txt directly from the WordPress admin. Changes take effect immediately without touching any file on disk. A reset button restores the WordPress default.

Adds an SEO panel to the post editor with custom title, meta description, focus keyphrase, robots meta (noindex/nofollow), canonical URL override and Open Graph tags (og:title, og:description, og:image). All values are injected in the page automatically.

Generates a sitemap index at /sitemap_index.xml with individual sitemaps per post type. The cache is automatically cleared on content updates. Optionally disables the WordPress native sitemap and pings Google on each publish.

Automatically generates descriptive alt text for images using AI. Supports OpenAI GPT and Gemini. Can run on upload or in bulk for existing images.

Automatically generates SEO meta descriptions for posts and pages using AI. Supports OpenAI and Google Gemini. Can run on publish/update or in bulk.

Adds an "Add with AI" button next to the standard "Add New" button in post list tables. Click it to open a modal, describe what you want to create, and the AI generates title, content, excerpt and meta description — saving everything as a draft ready to edit.

Adds a "Create with AI" button in the Snippet Manager list and a "Generate with AI" button inside the snippet editor. The AI reads your site context (theme, plugins, post types) to generate accurate CSS, JS, HTML and PHP snippets complete with all settings.

Adds a "Fix with AI" button inside the SEO Meta analysis tab. The AI reads the current fields and the list of issues, then rewrites the SEO title, meta description and Open Graph fields to resolve all detected problems. Requires the SEO Meta module to be active.

Replaces the standard WordPress login error and message boxes with floating toast notifications.

IP blacklist, rate limiting with lockout, and login-attempt log. Protect the login page from brute-force attacks. Whitelist trusted IPs to bypass rate limiting.

Style the WordPress login page with a custom logo, background color/image, form and button colors, and any additional CSS.

Replaces the default wp-login.php and wp-admin access URLs with a custom slug. Unauthorized access can return a 404, redirect to any URL, or display a fully customizable HTML template.

Removes the shake animation that WordPress plays on the login form when credentials are incorrect.

Records each user's last login timestamp and displays it as a sortable "Last Login" column in the Users list. Compatible with Custom Content Columns.

Disable the default global styles loaded by WordPress to reduce unwanted frontend CSS and keep styling output cleaner and easier to control.

Control the WordPress Heartbeat API to reduce background activity in the admin area, limit unnecessary AJAX requests, and improve overall efficiency.

Adjust how often Heartbeat requests run to better balance responsiveness and resource usage across the WordPress admin.

Manage the WordPress revision system to control how content changes are stored, helping keep editing history useful without generating unnecessary database clutter.

Set how often WordPress autosaves content while editing, giving you more control over editor behavior and background save frequency.

Download a complete backup of all plugin settings as a ZIP archive. Includes: all module on/off settings, Custom Content Columns configuration, Admin Menu Organizer configuration, Role Manager rules, Media categories, etc.).

Restore settings from a previously exported ZIP file. All existing settings will be overwritten. Images are automatically imported into the media library and image URLs are updated to point to the new installation.

Export on one site, import on another — the entire TheOneWP configuration travels with you. Site Replication for agencies delivering multiple client sites with identical configurations.