et Site Tools

E-Toolkit Site Tools — User Guide

What the plugin does

Site Tools combines activity monitoring, alerts, security settings, WordPress optimizations, and maintenance mode in one dashboard.

Quick start

1. Open Site Tools → Dashboard and review the event summary and environment status.
2. Go to Settings → Start and select the site type or a predefined settings set.
3. Enable Activity monitoring and choose a log retention period.
4. Configure email alerts or an available integration.
5. Enable security and performance settings one at a time, testing their effect on the site.

Save changes with the button at the bottom of the screen.

Dashboard

The dashboard shows events from the last 24 hours, critical events and failed logins, WordPress and PHP versions, key module status, and recent log entries. Click an event to view details without leaving the dashboard.

Content and comments

The Content and comments tab can disable comments, comment-related dashboard elements, REST API comment support, pingbacks, and trackbacks. Test WooCommerce product reviews and any external comment system after a change.

Media and store

The Media and store tab controls large-image scaling, attachment-page redirects, names of new files, EXIF removal from new JPG files, and JPG quality. Settings for new files do not modify images already in the Media Library.

Performance and protection

Settings are grouped into technical, frontend, Heartbeat, revisions, WooCommerce, and REST API options. You can limit XML-RPC, dashboard file editing, public author archives, emoji scripts, oEmbed, feeds, Heartbeat, post revisions, and WooCommerce assets outside store pages.

Do not enable everything at once. After each change, test login, content editing, forms, REST API access, and checkout.

Account security

The Security tab sets minimum password length, required digits or special characters, failed-login limits, lockout duration, and shows detected 2FA integrations. Password rules apply when passwords are created or changed. Notify users and test account recovery before making the policy stricter.

Monitoring and logs

On Monitoring, select recorded event types, severity levels, retention, and optional IP anonymization.

The Logs screen filters entries by text, severity, action and object type, user and role, and date range. CSV and JSON exports use the active filters.

Alerts

The Alerts tab configures email recipients, weekly reports, alerts for failed logins, role changes, plugin changes, and bulk deletion, generic webhooks, Slack or Discord webhooks, and custom rules based on event type, count, and severity.

After saving an integration, perform a controlled test and confirm delivery to the selected channel.

Access and WordPress dashboard

The Access tab controls who can see Site Tools, change settings, and view or export logs. On WP Dashboard, selected menu items can be hidden for a role or user. Hiding a menu item does not change capabilities granted by WordPress or another plugin.

System and tools

System shows environment information and administrative shortcuts. Tools can enable frontend maintenance mode, configure the 503 heading and message, export settings, and import a configuration.

Administrators can still use the dashboard during maintenance mode. Test critical external integrations on staging before enabling it.

Personal data

Logs may contain a user ID and role, IP address, user agent, and request path. Retention controls storage time, and IP addresses can be anonymized.

Site Tools integrates with WordPress privacy tools:

1. Tools → Export Personal Data prepares a person's data.
2. Tools → Erase Personal Data anonymizes their log data while retaining the event itself.

Troubleshooting

• Menu or logs are missing — check Access and the account role.
• Too many log entries — record fewer event types or shorten retention.
• An alert did not arrive — check the recipient, webhook URL, and WordPress email delivery.
• An integration broke after optimization — disable the most recently changed option and test again.
• Visitors see a 503 page — check maintenance mode under Tools.

E-Toolkit Site Tools — Developer Guide

Recording a custom event

The etst_log_custom_event action accepts an array of event data. The most commonly used fields are level, action, object_type, object_id, message, and context.

do_action('etst_log_custom_event', [
    'level'       => 'info',
    'action'      => 'crm_contact_synced',
    'object_type' => 'contact',
    'object_id'   => $contact_id,
    'message'     => 'The contact was sent to the CRM.',
    'context'     => [
        'provider' => 'my-crm',
    ],
]);

Available levels depend on the monitoring configuration. Use info, warning, or critical in ordinary cases.

Changing data before it is saved

The etst_log_entry_payload filter lets you add to or modify an entry before it is stored:

add_filter('etst_log_entry_payload', function (array $entry): array {
    $entry['context']['integration'] = 'my-plugin';
    return $entry;
});

The callback must return an array. Returning another type prevents the event from being saved.

Skipping selected entries

The etst_should_log_entry filter receives the current decision and entry data. Return true to skip the entry:

add_filter('etst_should_log_entry', function (bool $skip, array $entry): bool {
    if (($entry['level'] ?? '') === 'info' && ($entry['action'] ?? '') === 'heartbeat') {
        return true;
    }

    return $skip;
}, 10, 2);

Responding after an entry is saved

The etst_after_log_insert action runs after a successful save and receives the complete stored entry:

add_action('etst_after_log_insert', function (array $entry): void {
    if (($entry['level'] ?? '') === 'critical') {
        // Send a custom notification or call an integration.
    }
});

Bypassing maintenance mode

The etst_maintenance_bypass_request filter can keep a custom route available while maintenance mode is active:

add_filter('etst_maintenance_bypass_request', function (bool $bypass): bool {
    $path = wp_parse_url(wp_unslash($_SERVER['REQUEST_URI'] ?? ''), PHP_URL_PATH);

    if ($path === '/my-integration/callback') {
        return true;
    }

    return $bypass;
});

The condition should match only the specific integration route. Returning true allows the current request despite active maintenance mode.