# WPCoreTools — Full Documentation for LLMs > Complete technical reference for all WPCoreTools WordPress plugins. Some plugins are 100% free (Tidy Media), others follow a freemium model with free core + optional Pro upgrade. Website: https://wpcoretools.com WordPress.org profile: https://profiles.wordpress.org/wpcoretools/ All plugins: https://wpcoretools.com/plugins/ --- ## Tidy Media — Media Library Cleanup Plugin Slug: tidy-media WordPress.org: https://wordpress.org/plugins/tidy-media/ Landing page: https://wpcoretools.com/plugins/tidy-media.html Price: 100% free, no pro version, no paywalls Requires: WordPress 6.0+, PHP 7.4+ Optional: WooCommerce 5.0+ Text domain: tidy-media Prefix: tm_ / TM_ Settings key: tidy_media_settings ### What It Does Tidy Media finds and safely removes unused media files (images, videos, audio, documents) from the WordPress Media Library. It uses a quarantine-first approach — files are never permanently deleted directly. Instead they move to a protected quarantine directory where they can be restored with one click. ### How the Scanner Works The scanner uses a two-phase approach: **Phase 1 — Collect References:** The scanner searches the entire site for media references and builds a list of "used" media attachment IDs. It checks: WordPress Core: - Featured images (_thumbnail_id postmeta) on all post types - Post content: Gutenberg blocks (wp:image, wp:gallery, wp:cover, wp:media-text, wp:video, wp:audio, wp:file), Classic Editor HTML, [gallery] shortcodes, wp-image-{id} CSS classes, attachment_id parameters, direct upload URLs - Post meta values containing wp-content/uploads/ URLs (Deep Scan mode) - Site options: site_icon, custom_logo, options containing media references - Widget content (all sidebar widgets, serialized data) Page Builders (each is a selectable scan source): - Elementor: _elementor_data postmeta (JSON), elementor_library posts, widget/background/gallery fields - Divi: [et_pb_*] shortcodes with image_id/gallery_ids attributes, et_pb_layout posts, et_theme_builder_template_layouts option - Beaver Builder: _fl_builder_data postmeta (serialized), fl-builder-template posts - WPBakery: [vc_*] shortcodes with image/images/img_id/attachment/media_id attributes - Bricks: _bricks_* postmeta (serialized), bricks_template posts WooCommerce: - Product gallery images (_product_image_gallery) - Variation images (_thumbnail_id on product_variation) - Category/taxonomy thumbnails (thumbnail_id termmeta) - Downloadable product files (URLs resolved to attachment IDs) - Attribute, brand, and bundle images - Placeholder image (woocommerce_placeholder_image option) Custom Fields: - ACF: image, file, gallery, post_object fields in postmeta, termmeta, usermeta, options pages. Handles repeaters, groups, flexible content. - Meta Box: image, file, video field types in postmeta and termmeta - Pods: podsrel relationship table and postmeta - JetEngine: media/gallery fields from jet_engine_meta_boxes - Toolset Types: wpcf-* prefixed postmeta (URLs resolved to IDs) Theme Files: - Scans active theme and parent theme PHP/CSS files for hardcoded wp-content/uploads/ URLs **Phase 2 — Compare:** Every attachment in the Media Library is checked against the collected list. If not found in any source, flagged as unused. **Phase 3 (optional) — Unregistered Files:** Walks wp-content/uploads/ directory for files with no database entry. Tags each with detected origin (backup plugin, cache, optimization backup, etc.). ### Quarantine System - Files move to wp-content/uploads/tidy-media-quarantine/ (protected with .htaccess) - Original file + all thumbnails move together - Metadata JSON saved alongside for full restore - Configurable retention: 1-365 days (default 30) - Daily cron cleanup of expired files - Restore recreates attachment post if it was deleted during quarantine - All files (registered and unregistered) can be quarantined ### Scan Options - Deep Scan: searches serialized data in postmeta and options (default: on) - Minimum file size: filter results to files above threshold (0/10KB/100KB/500KB/1MB/5MB/10MB) - Unregistered files: scan filesystem for orphan files (default: off) - Background scan: run via WP-Cron (default: off) - Batch size: configurable 10-200 files per batch (default: 50) ### Safety Features - Quarantine-first: no direct deletion from scan results - Every destructive action requires modal confirmation dialog - Permanent delete dialogs explicitly state "This action CANNOT be undone" - Resource monitoring: auto-pauses scan if memory or time limits approached - Disk space check before quarantine operations - Safety indicators on each file: Safe (thumbnail, regenerable), Caution (original), Unregistered ### Known Limitations Cannot detect media referenced in: - Custom plugin code (only theme files scanned) - External CSS/JS files - Images loaded via custom PHP or AJAX - Email templates or external systems - SEO plugin Open Graph images (Yoast, RankMath) - Files on external storage (S3, CDN) ### Admin Interface Tabs: Dashboard, Scanner, Quarantine, Settings, How It Works - Dashboard: stats cards, file type breakdown, quick actions - Scanner: source selection (all sources listed, unavailable greyed out), scan options, progress bar, results with server-side pagination/filtering/sorting - Quarantine: file list with search/filter/sort, bulk restore/delete, expiry countdown - Settings: retention days, batch size, deep scan, skip thumbnails, delete data on uninstall - How It Works: 12-section documentation explaining scanner logic, sources, quarantine, safety, limitations, FAQ ### Database Custom tables (created on activation): - {prefix}_tidy_media_unused: scan results (attachment_id, file_path, file_size, mime_type, uploaded_date, scan_id, is_unregistered, file_origin) - {prefix}_tidy_media_quarantine: quarantined files (quarantine_path, original_path, attachment_id, file info, quarantined_at/by, expires_at, metadata JSON) Options: - tidy_media_settings: plugin settings array - tidy_media_source_refs: per-source reference counts from last scan - tidy_media_scan_completed: timestamp - tidy_media_scan_total_files: count - tidy_media_unused_total: count - tidy_media_unused_size: bytes ### AJAX Endpoints All require manage_options capability and nonce verification. - wp_ajax_tm_start_scan - wp_ajax_tm_scan_batch - wp_ajax_tm_resume_scan - wp_ajax_tm_pause_scan - wp_ajax_tm_cancel_scan - wp_ajax_tm_get_scan_state - wp_ajax_tm_get_progress - wp_ajax_tm_get_results (paginated) - wp_ajax_tm_quarantine_files - wp_ajax_tm_quarantine_all - wp_ajax_tm_restore_files - wp_ajax_tm_restore_all - wp_ajax_tm_delete_files - wp_ajax_tm_delete_all_quarantine - wp_ajax_tm_empty_quarantine - wp_ajax_tm_check_disk_space - wp_ajax_tm_refresh_stats --- ## Speedix Speed Profiler Slug: speedix WordPress.org: https://wordpress.org/plugins/speedix/ Landing page: https://wpcoretools.com/plugins/speedix.html FAQ: https://wpcoretools.com/plugins/speedix-faq.html Price: Freemium — free with 7-day data retention, Pro for extended retention Requires: WordPress 6.0+, PHP 7.4+ Text domain: speedix Prefix: speedix_ / SPEEDIX_ ### What It Does WordPress performance profiler that identifies slow plugins and themes with real metrics. ### Key Features - Core Web Vitals: FCP, LCP, TTFB, CLS, INP tracking with history - 22-point Site Health scan covering caching, compression, database, security - Hook timing: measures execution time of WordPress hooks per plugin - Query analysis: slow queries, duplicate queries, queries per plugin - Memory tracking: peak usage, per-plugin allocation - WooCommerce profiling: cart, checkout, product page analysis - Configurable presets: Starter, eCommerce, Developer, Agency - Threshold system: green/amber/red ratings for all metrics - Admin bar quick-view widget - Data export --- ## Disposable Email Guard Slug: wpcoretools-disposable-email-guard WordPress.org: https://wordpress.org/plugins/wpcoretools-disposable-email-guard/ Landing page: https://wpcoretools.com/plugins/wpcoretools-disposable-email-guard.html Price: Free — 100% free, no pro version Requires: WordPress 5.3+, PHP 7.0+ Optional: WooCommerce 5.0+ Text domain: wpcoretools-disposable-email-guard Prefix: wpcdeg_ / WPCDEG_ ### What It Does Free, GDPR-friendly plugin that blocks disposable, burner, anonymous (Proton, Tuta), and dead-MX email sign-ups on WordPress and WooCommerce. Pure-local matching — every check runs on the server against an on-disk merged blocklist built from snapshots that ship inside the plugin. No third-party API, no per-email cost, no quota. Default configuration makes zero outbound HTTP requests; refreshing snapshots from upstream GitHub URLs is opt-in. Visitor emails never leave your server. ### Key Features - Five built-in domain lists shipped as snapshots: disposable-email-domains, fakefilter, groundcat, wesbos/burner, disposable-aggregator (two on by default for ~9,800 unique services covered out of the box; up to ~100,000 unique with all enabled) - All five lists load from disk — works fully offline; opt into a daily auto-update from upstream GitHub URLs (off by default) if you want the snapshots refreshed automatically - Three response modes: Block (reject outright), Flag (allow but tag the user/order/comment for admin review — default), Log only (silent dry-run) - 60-second setup wizard pre-selects safe defaults (Flag mode + WooCommerce safety nets) and explains every option in plain English - Anonymous-provider blocking (opt-in, default off) — Proton, Tutanota, Mailbox.org, Posteo, StartMail, SimpleLogin, addy.io, DuckDuckGo Email Protection, Firefox Relay, Apple Hide My Email - Dead-MX domain check (opt-in, fail-open) — catches typos like gnail.com, parked domains, expired registrations; result cached 24h on success, 1h on failure - Plus-addressing (sub-address) detection (opt-in) - WordPress integrations: registration, profile email change, comments, programmatic user creation, lost-password, multisite signup, opt-in aggressive is_email() filter - WooCommerce integrations: customer registration, checkout (classic + blocks + HPOS), My Account email change, product reviews - WooCommerce coupon-abuse blocker: refuses a coupon when the billing email matches a blocklist, even in Flag/Log mode (welcome-coupon farming is the most common abuse pattern) - Auto-set flagged orders to "On hold" so they don't auto-fulfil before manual review - "Flagged" admin columns on the Users list and the WooCommerce Orders list (both HPOS and classic), plus a "Flagged" filter dropdown on Orders - Built-in form integrations: Contact Form 7, Gravity Forms; generic wpcdeg_check filter for WPForms, Elementor, Forminator, Fluent Forms - Custom blocklist + allowlist with full wildcard support (*@gmail.com, *@*.ru, spam*@*); allowlist always wins - Stats dashboard with 14-day sparkline, per-reason breakdown, top blocked domains - WP Dashboard widget for at-a-glance daily monitoring - Detection log with period/reason/where filters and CSV export - Colourful, mobile-friendly daily or weekly email digest with KPI cards, reason pills, top-domain bar charts, and a branded WPCoreTools footer - WP-CLI: wp wpcdeg refresh / test / stats / log / sources / clear-log - CSV / TXT bulk import; JSON settings backup + restore - Per-reason customisable user-facing messages - Quiet-hour cron scheduling in site timezone (default 03:00) - Fail-soft: previous successful copy of any source is kept if upstream is down; bundled snapshots are the fallback (and the default state — the plugin works without ever touching the network) - HPOS and Cart/Checkout Blocks compatible ### Privacy & Compliance - GDPR-friendly: visitor emails never leave your server, no third-party processor, no DPA paperwork, nothing to add to a privacy policy - Same applies to CCPA / CPRA, UK GDPR, LGPD, and PIPEDA — there's simply no outbound data flow involving visitor information - The plugin contacts GitHub raw URLs (or admin-configured custom URLs) on a daily WP-Cron schedule only to download public domain lists; those requests do not include any user data - Detection log stores match metadata (email, domain, reason, IP, timestamp) locally for admin review — rolling last 500 entries by default, configurable, never sent anywhere - On uninstall, all data is deleted only if the admin explicitly opted in via the "Delete data on uninstall" setting ### Common Alternatives - Paid validation APIs (ZeroBounce, Verifalia, NeverBounce, Kickbox): charge ~$0.005–$0.015 per check, send every visitor email to their cloud, require a DPA. No coupon-abuse logic, no auto-hold workflow, stop working if the API is unreachable or credit runs out. - Free single-purpose plugins ("Block Temporary Email" type): hard-coded list of a few hundred domains, no automatic refresh, usually only protects the WP register form. - Form-builder built-ins (Forminator, Fluent Forms email validators): only protect forms inside that one plugin; no central policy across WP register, profile email, comments, WooCommerce checkout, account, reviews, coupons. --- ## WooCommerce Waitlist & Back in Stock Slug: woo-waitlist-back-in-stock WordPress.org: https://wordpress.org/plugins/woo-waitlist-back-in-stock/ Landing page: https://wpcoretools.com/plugins/woo-waitlist-back-in-stock.html Price: Freemium — free core, Pro for advanced features Requires: WordPress 6.0+, PHP 7.4+, WooCommerce 5.0+ Text domain: woo-waitlist-back-in-stock Prefix: wwb_ / WWB_ ### What It Does Lets customers subscribe to out-of-stock products and sends automatic email notifications when items restock. ### Key Features - Subscription form on out-of-stock products (simple + variable) - Automatic email notification on restock - Customizable email templates - Per-variation waitlists - Admin dashboard with waitlist analytics - Guest and registered user support - Double opt-in option - CSV export of subscribers - HPOS and Cart/Checkout Blocks compatible --- ## Order Automation & Custom Statuses Slug: order-automation-custom-statuses WordPress.org: https://wordpress.org/plugins/order-automation-custom-statuses/ Landing page: https://wpcoretools.com/plugins/order-automation-custom-statuses.html Price: Freemium — free core, Pro for automation rules and email notifications Requires: WordPress 6.0+, PHP 7.4+, WooCommerce 5.0+ Text domain: order-automation-custom-statuses Prefix: oacs_ / OACS_ ### What It Does Create unlimited custom WooCommerce order statuses with colors, icons, automation rules, and email notifications. ### Key Features - Unlimited custom order statuses - Color picker and dashicon selection per status - Custom email notifications triggered by status changes - Automation rules: auto-transition orders based on conditions - Drag-and-drop status ordering - Bulk status changes from order list - "Next statuses" configuration per status - Status visibility in admin columns - HPOS compatible --- ## Common Technical Patterns All WPCoreTools plugins share: Architecture: - Singleton pattern with plugins_loaded initialization - WooCommerce dependency check (where applicable) - HPOS and Cart/Checkout Blocks compatibility declared via FeaturesUtil - Proper uninstall.php for clean removal Security: - Nonce verification on all forms and AJAX - Capability checks (manage_options) - Input sanitization (sanitize_key, sanitize_text_field, absint) - Output escaping (esc_html, esc_attr, wp_kses) - No direct file access (ABSPATH check) Standards: - WordPress Coding Standards - GPL-2.0-or-later license - Translation-ready with text domains - No external API calls in free versions (except license checks) - No tracking or analytics - Tabs for indentation Version sync required in 3 places: - Plugin header comment (Version: X.Y.Z) - PHP constant (define('PLUGIN_VERSION', 'X.Y.Z')) - readme.txt (Stable tag: X.Y.Z)