Radmin

The one true admin upgrade for WordPress, by Web9SEO.

Radmin bundles the essentials most sites install five or six plugins for, under one Radmin admin menu: Settings, Email, Tools and Compliance. Every module can be switched on or off.

Features

• Content: post/page duplication, media replacement, safe SVG uploads, disable comments per post type, and a danger-zone reset that wipes all content and media (users, site title, theme and plugin settings stay; plugins are deactivated).
• Admin: clean dashboard (no default widgets), admin bar and Help tab clean-up, custom post types grouped under Posts, hide Comments / Connectors / Privacy menus.
• Login: custom login URL, branded login page (logo, colors, background, centered or split layout, custom CSS).
• Security:
  • two-factor login (authenticator app, backup codes, email code fallback), optionally required per role
  • limit login attempts (automatic proxy-aware visitor IP), hidden usernames, obfuscated author slugs, XML-RPC and application passwords off
  • firewall: IP block/allow lists with ranges, bans for IPs probing for missing pages, a bot trap, attack-tool user agents blocked
  • passwords: breached passwords refused (Have I Been Pwned), minimum length per role, "require new passwords" for chosen roles
  • sessions: idle logout, "Remember me" length, end sessions when the IP changes
  • Cloudflare Turnstile bot check on login, registration, lost password and comments
  • no file editor, optional install lock, hidden WordPress version
  • .htaccess rules: no PHP in uploads, sensitive files and folder listings blocked, security headers, HSTS
  • daily vulnerability alerts (WPScan); weekly integrity check of core and wordpress.org plugin files, with closed and abandoned plugin warnings; activity log; email alerts on risky changes
• Scripts: Google Tag Manager with a page-data dataLayer, custom head / body / footer code.
• Email (Radmin › Email): SMTP, Google / Gmail and Microsoft 365 sign-in (OAuth, no passwords stored), SendGrid, Mailgun, Postmark, Brevo and Resend APIs; a backup mailer that retries failed emails; an email log with search, preview, resend and CSV export; failure alerts to Slack/Discord/Google Chat; switches for WordPress's own notification emails; a "don't send any email" mode for staging; test email. Secrets are stored encrypted or set in wp-config.php.
• Performance:
  • full-page cache that works on any server, with server-level caching on LiteSpeed
  • CSS/JS/HTML minify, CSS combine, JS defer and delay-until-interaction
  • browser caching and gzip rules
  • front-end clean-up
  • an asset manager to unload unused scripts and styles per page, per post type or everywhere
• SEO:
  • titles and meta descriptions with templates and variables
  • robots and canonical URLs
  • Open Graph / Twitter cards
  • JSON-LD schema (organization / local business, website, pages, articles, breadcrumbs)
  • XML sitemaps and a robots.txt editor
  • redirects with a 404 monitor
  • breadcrumbs
  • an SEO box on every post and term
• Compliance (Radmin › Compliance):
  • an overview checklist for privacy, cookie consent, accessibility, data requests and marketing email, auto-detected where possible
  • cookie banner (accept / decline) that can hold GTM and custom scripts until the visitor accepts
  • privacy policy generated from what the site actually runs ([radmin_privacy_policy]), California-focused with an optional EU/UK section
  • accessibility: skip link, visible focus outline, "reduce motion" support, a visitor toolbar (text size, contrast, link underlines, readable font, stop animations), and a generated accessibility statement ([radmin_accessibility_statement])
• Tools (Radmin › Tools): redirects and the 404 log, the activity log, and export / import of all settings to set up new sites in seconds.

Requirements

• WordPress 6.2+
• PHP 7.4+

Installation

Upload the radmin folder to wp-content/plugins/ (or install it from this repository with Git Plugin), activate it, then open Radmin in the admin menu.

The folder must be lowercase radmin. For a dev checkout: git clone ssh://git@git.web9.live:2223/pcgraphics/radmin.git radmin.

Deactivating Radmin removes everything it wrote outside its own folder (advanced-cache.php, the WP_CACHE line, its .htaccess block). Deleting it also removes its settings, tables and cache files.

Third-party libraries

Radmin bundles these libraries, each under its own license (see the license files in vendor/):

Library	Used for	License
matthiasmullie/minify and path-converter	CSS/JS minification	MIT
mrclay/minify (HTML compressor)	HTML minification	BSD-3-Clause
enshrined/svg-sanitize	Sanitizing SVG uploads	GPL-2.0-or-later
qrcode-generator (assets/js/vendor/qrcode.js)	Two-factor setup QR code	MIT

External services

Radmin only contacts these when the matching feature is turned on and set up:

Service	When	What is sent
git.web9.live	Update checks	The installed version
WordPress.org	Weekly integrity check	Installed WordPress and plugin versions (to fetch checksums and plugin status)
WPScan	Daily vulnerability check (needs a free token)	Installed WordPress, plugin and theme names and versions
Have I Been Pwned	Setting a password, logging in	The first 5 characters of the password's SHA-1 hash, never the password
Cloudflare Turnstile	Login, registration, lost password and comment forms	The check's token and the visitor's IP
Google, Microsoft, SendGrid, Mailgun, Postmark, Brevo, Resend	Sending email with that mailer	The email
Slack / Discord / Google Chat webhook you enter	An email fails to send	Site name, subject, recipients and the error
Google Tag Manager	Visitors' browsers load it when a container ID is set	Whatever your GTM container collects

License

GPLv3 or later. See LICENSE.txt.