DIGITO Toolkit
A modular toolkit with Security Health, Safe SVG Upload, Maintenance Mode, duplication, and Classic Editor tools.
Solid choice
DIGITO Toolkit is a solid plugin choice in 2026, with a few things worth checking first. Was last updated 3 days ago, and scores 64/100 on our health check.
- Actively developed — last update 3 days ago
- Tested with the latest WordPress (7.1)
- Small user base (<10 active installs)
- Very few reviews so far
- Needs PHP 8.2 or newer
How does it stack up?
Side-by-side on installs, updates, ratings & support
Daily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where DIGITO Toolkit stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| duplicate post | >100 |
| maintenance mode | >100 |
| safe svg | >100 |
| security | >100 |
| security health | >100 |
About DIGITO Toolkit
From the official readme · v1.2.1Description
DIGITO Toolkit groups five independently switchable WordPress administration tools in one lightweight plugin. Enable only the modules you need. Disabled modules do not boot their feature hooks.
Security Health
Security Health provides administrator-only, local diagnostics for WordPress update posture, HTTPS configuration, debug exposure, the dashboard file editor, privileged-account signals, public author exposure, selected response headers, and XML-RPC posture.
Its score summarizes the checks that could run. Pass earns full weight, Warning earns half, Fail and Unknown earn no points, and Not Applicable is excluded. The score is guidance, not a guarantee that a site is secure. Every result includes concise evidence, limitations, and a recommended next step. Security Health does not scan site files for malware, replace WordPress Site Health, or use a remote vulnerability service.
Optional controls are off by default and reversible:
- Login-attempt protection applies a 15-minute client cooldown after five failures within 15 minutes. It stores keyed pseudonymous counters rather than raw IP addresses or usernames. Administrators must explicitly confirm activation. The documented
DIGITO_TOOLKIT_DISABLE_LOGIN_PROTECTIONconfiguration constant provides emergency recovery. - WordPress response headers can add
X-Content-Type-OptionsandReferrer-Policywhen WordPress has not already supplied them. The control does not edit server or CDN configuration and does not add CSP or HSTS. - XML-RPC can remain in observe-only mode or be disabled after an explicit compatibility warning. Disabling it can affect publishing clients, mobile apps, Jetpack, and other integrations.
- Manual and optional daily scheduled scans evaluate the same bounded local checks. Only the latest scheduled summary is retained for up to seven days.
- A bounded local event log retains up to 500 allowlisted, nonsensitive events for seven days. Clearing it requires administrator authorization and explicit confirmation.
Security Health is off by default. Its screen and settings require the WordPress manage_options capability. It does not add a public API, telemetry, remote accounts, automatic destructive remediation, or network-wide Multisite administration.
Classic Editor
Restore the familiar WordPress Classic Editor for posts and pages.
Duplicate Page & Post
Quickly duplicate posts, pages, and supported custom post types with their content and settings. Copies are created as drafts through capability- and nonce-protected WordPress actions.
Maintenance Mode
Temporarily display a customizable Maintenance or Under Construction page to visitors. Configure the message, presentation, optional Media Library logo, and optional countdown. Authorized administrators retain access. Public maintenance responses use HTTP 503 and Retry-After headers.
Page-cache, hosting-cache, and CDN layers can serve stale HTML without reaching WordPress. Purge those caches after changing Maintenance Mode when needed.
A cache that serves stored HTML without reaching WordPress cannot be overridden by the Toolkit.
Safe SVG Upload
Securely upload sanitized SVG graphics to your WordPress Media Library. The module is off by default and is limited to trusted administrators with upload permission; Multisite additionally requires a super administrator.
Accepted SVGs are parsed and sanitized locally. The default upload limit is 1 MiB. Scripts, event handlers, animation, foreignObject, unsafe CSS, external resources, data URLs, document type declarations, entities, malformed XML, and files that cannot be verified are rejected. Sanitized attachments include Media Library previews and dimensions. Safe SVG Upload does not optimize raster images or promise support for every SVG authoring feature.
Privacy and local processing
DIGITO Toolkit does not include Toolkit telemetry, visitor tracking, remote accounts, or remote security scanning. Settings, diagnostic summaries, and the bounded Security Health event log remain in the site’s WordPress database. No raw IP address, username, credential, cookie, request payload, site content, or diagnostic report is sent to DIGITO WEBS.
Compatibility and limitations
The plugin requires WordPress 6.8 or later and PHP 8.2 or later. Security Health evaluates WordPress-visible evidence and cannot verify every server, proxy, CDN, certificate, WAF, or external service. Its optional controls affect WordPress-generated behavior only.
Multisite support is best effort and site-local. The Toolkit does not provide shared Network Admin settings, network-wide provisioning, or complete network-wide uninstall cleanup.
The bundled enshrined/svg-sanitize library is GPL-2.0-or-later. Source and license details are recorded in the distributed Composer metadata and vendor license.
Installation
- Install and activate DIGITO Toolkit through the WordPress Plugins screen.
- Open DIGITO Toolkit > Modules.
- Enable only the modules you need.
- Open Security Health or another module’s settings page to review its guidance and controls.
Frequently asked questions
What does the Security Health score mean?
It is a weighted summary of observable local checks. Unknown evidence earns no points and Not Applicable checks are excluded. Review each finding and its evidence rather than relying on the number alone. The score is not a certification or guarantee of security.
Does Security Health change my site automatically?
No. Diagnostics and recommendations are read-only. Optional login protection, response headers, XML-RPC control, and scheduled scans are disabled by default and require an authorized administrator to enable them. Disruptive controls require explicit confirmation and remain reversible.
How can I recover if login protection causes a problem?
Define DIGITO_TOOLKIT_DISABLE_LOGIN_PROTECTION as true in the site’s normal WordPress configuration recovery process, sign in, and correct or disable the setting. The protection uses temporary client cooldowns, not permanent or username-specific lockouts.
What is stored by Security Health?
It stores its allowlisted settings, an optional latest scan summary for up to seven days, pseudonymous login-attempt counters with bounded expiry when protection is enabled, and up to 500 allowlisted security events for seven days. It does not store raw IP addresses, usernames, passwords, tokens, cookies, or request payloads.
Does Security Health call an external vulnerability service?
No. It uses WordPress-visible local evidence and makes no Toolkit remote security request. Update checks depend on the update information WordPress already has; missing or stale evidence is reported conservatively.
Why can server or CDN headers differ from the dashboard?
Security Health can assess and optionally add selected headers in WordPress-generated responses. A web server, reverse proxy, CDN, cache, or security plugin can change the final public response. Verify public headers separately when that matters.
Who can upload SVG files?
Only a trusted administrator who can configure DIGITO Toolkit and upload files while Safe SVG Upload is enabled. Multisite also requires a super administrator. Other roles do not gain SVG permission automatically.
Does the plugin collect or send my data?
No Toolkit telemetry, remote account, visitor tracking, or unnecessary external data transmission is included. Processing is local to WordPress.
Changelog
1.2.1
- Redesigned the Toolkit Dashboard and Modules screen with compact responsive cards, real module counts, clearer status, and valid contextual actions.
- Introduced a reusable scoped admin design system with compact mastheads, accessible notices, disclosures, empty states, focus treatment, and responsive layout primitives.
- Reorganized Maintenance settings and added a private, nonce-protected preview for unsaved changes without enabling public Maintenance Mode or persisting preview values.
- Redesigned Security Health Overview, Protection, Activity, findings, filters, optional controls, and scan/event presentation without changing security behavior.
- Improved keyboard navigation, textual status communication, WCAG AA contrast, reduced-motion handling, 200% zoom support, and 320px reflow.
- Preserved all module permissions, nonces, stored settings, disabled-state dormancy, privacy boundaries, and public frontend behavior.
1.2.0
- Added the independently switchable Security Health module, off by default.
- Added bounded, local security diagnostics with transparent scoring, evidence, and actionable recommendations.
- Added optional confirmed login-attempt protection with pseudonymous client counters and emergency recovery.
- Added optional WordPress response headers and XML-RPC controls with compatibility safeguards.
- Added bounded local event logging, manual scans, and optional daily scheduled scans.
- Added accessible administrator guidance, privacy documentation, automated coverage, and real WordPress acceptance testing.
1.1.0
- Added the independently switchable Safe SVG Upload module.
- Added fail-closed SVG parsing and sanitization with authorization, size, MIME, and content validation.
- Added native Media Library and REST-backed upload support, SVG previews, and attachment dimensions.
- Added temporary-file locking and final stored-file integrity verification.
1.0.1
- Improved Maintenance Mode compatibility, cache guidance, the Plugins-screen Settings shortcut, and author metadata.
1.0.0
- Added independently switchable Classic Editor, Duplicate Page & Post, and Maintenance Mode modules.
Screenshots
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
Best DIGITO Toolkit alternatives
All duplicate post plugins →
FAQ
DIGITO Toolkit: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Oct 18, 2026
Is DIGITO Toolkit free?
Yes. DIGITO Toolkit is free to download and use from the official WordPress.org plugin directory.
Is DIGITO Toolkit safe to use in 2026?
DIGITO Toolkit is a solid plugin choice in 2026, with a few things worth checking first. Was last updated 3 days ago, and scores 64/100 on our health check.
How many websites use DIGITO Toolkit?
DIGITO Toolkit is active on <10 WordPress websites and has been downloaded 298 times since it launched in September 2026. It was downloaded 257 times in the last 30 days.
Does DIGITO Toolkit work with WordPress 7.1?
Yes. The developer has tested DIGITO Toolkit up to WordPress 7.1.3, the latest release. It requires WordPress 6.8 or newer.
What PHP version does DIGITO Toolkit need?
DIGITO Toolkit requires PHP 8.2 or higher. Most hosts run PHP 8.x today, so it works on any modern WordPress hosting.
When was DIGITO Toolkit last updated?
The latest version, 1.2.1, was released on October 15, 2026 (3 days ago).
Who makes DIGITO Toolkit?
DIGITO Toolkit is developed and maintained by DIGITO WEBS.
What are the best alternatives to DIGITO Toolkit?
The most popular alternatives to DIGITO Toolkit are Yoast Duplicate Post (3M+ installs), Duplicate Page (3M+ installs) and Duplicate Post (300K+ installs).
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
