Deskmode Pro Suite documentation

Installation and first run

Deskmode Pro Suite installs like any other WordPress plugin, and nothing changes on your public site. Once activated, the admin picks up the new theme immediately, while every security feature stays switched off until you decide to enable it — so there is no risk of locking yourself out on the first day.

• Go to Plugins → Add New → Upload Plugin, select the ZIP and activate it.
• Open the new Deskmode Pro Suite menu that appears in the sidebar.
• Enter your license key to enable automatic updates.
• Start from the General screen: colour, logo and dark mode take two minutes and show the value immediately.

General

The home of the plugin, and where the visual identity of the admin is decided. Everything here is cosmetic and completely safe to experiment with: nothing can break a site.

• Accent colour — twelve one-click palettes; the whole admin, buttons and charts follow the choice.
• Logo image — replaces the WordPress mark in the admin bar. It is aligned to the left and scaled automatically, so a large file will not break the bar.
• Site name and link — what appears next to the logo, and where it points.
• Footer text — accepts HTML, so you can put a credit line, a support link or an image.
• Dark mode — enables the floating toggle. The preference is saved per user, not for the whole site.

Security summary

Security settings are spread across half the plugin, and each one is as easy to forget as it is to set. This screen collects them in one place: every protection with a green or red badge, green when it is on and red when it is off, and one line underneath saying what that means in practice. Every item is a link to the screen that governs it, so reading the page and fixing it are the same gesture.

Protections

Eleven entries covering the login rules, two-factor and captcha, the custom login URL, XML-RPC, user enumeration, REST API rate limiting, application passwords and block notifications. A counter at the top says how many are off and how many checks need attention.

• Captcha counts as active only when both API keys are saved — the same condition the 2FA module applies, so a half-configured service never shows green.
• Block notifications need an address — the entry stays red until a valid notification email is set, because a notification nobody receives protects nobody.

Site checks

Three things WordPress never looks at, and that stay invisible until someone is already inside. All three are read only: nothing is changed, moved or deleted.

• Must-use plugins — mu-plugins load on every request and cannot be deactivated from the Plugins screen. The page lists what is in the folder so you can recognise what belongs there.
• PHP .user.ini — whether it exists, whether the web server can write to it, and the values of open_basedir, allow_url_fopen, disable_functions and the rest. Each directive shows the value in effect next to an In the file column, which says whether it comes from your file or from the server php.ini.
• Executable files in uploads — a recursive scan for .php, .phar, .phtml and a dozen other extensions the server could run, plus a warning when no .htaccess stops PHP from executing there.

The uploads scan is kept for one hour and stops after 20,000 files, so it never slows the dashboard on a large media library. When it stops early the page says so, rather than presenting a partial result as a complete one.

Login options

This screen governs how wp-login.php looks. It is the first thing a client sees every morning, and the cheapest way to make a site feel finished.

• Layout — the modern two-panel arrangement or the classic centred form.
• Logo and background — your own image on the login screen, with colour fallbacks.
• Colours and rounding — form fields and button follow the accent colour by default.
• Texts — welcome message and footer note, useful for telling users who to contact for access.

Login security

The rules that decide who is even allowed to reach the login form. Everything here is evaluated before the password is checked, which is what makes it effective against automated attacks: blocked traffic never gets a chance to guess. From this screen you can also look up the visitors and bots attacking your site, simply by clicking the IP address listed in the logs.

• Geofencing — allow only the countries you operate in, or block specific ones.
• Blocklist — individual IP addresses you never want to see again.
• Allowed hours — a time window for logins, useful when nobody works at night.
• Rate limit — a ceiling on attempts from the same origin.
• Anti-lockout — protects the IP you are working from, so you cannot shut yourself out by mistake.

Two-factor authentication

A second step after the password, so a leaked credential is not enough to get in. It works on the standard WordPress login, so nothing changes in the daily routine except one extra confirmation.
Google reCAPTCHA v2 and v3 and Cloudflare Turnstile are both supported. To use Turnstile, check if your DNS must be managed by Cloudflare. Generally DNS does not need to be on CF. (We recommend Turnstile, as bots can bypass reCAPTCHA fairly easily).

• Enable it per user, or enforce it for entire roles.
• Administrators and editors are the accounts worth protecting first.
• An administrator can switch it off for a user who has lost their device.
• Got a static IP? Trust it — 2FA is skipped for whitelisted addresses.

Network info

Server and connection details gathered in one page, so you can answer a hosting question without installing a diagnostic plugin or opening a terminal.

• Check IP, DNSBL, AS lookup, Whois and DNS in one place.
• ISP and location.
• The IP address WordPress sees for the current visitor — the quickest way to confirm that a proxy or CDN is passing the real one through.

Notices & ads

Keep your dashboard clean and get rid of annoying ads. WordPress dashboards fill up with upsell banners, review requests and promotional notices injected by other plugins. This screen silences them, which matters most on sites your clients log into.

• Hide promotional banners and upgrade notices from third-party plugins.
• Keep the notices that actually matter — updates and genuine errors.
• Choose which roles see the remaining messages, so clients are not alarmed by technical warnings meant for you.

Site Health

The analytical heart of the plugin: a single score, the charts behind it, and a Task-Manager view of what every plugin costs you.

Health score

Derived from checks across performance, database, plugins, security and server environment. Critical issues and warnings lower it, and the value is recorded daily so you can show the trend rather than a single snapshot.

Charts

Average load time with a seven-day moving average, and the score history. Both are inline SVG, so they cost nothing to render.

Plugin resource usage

Database time, SQL queries and registered hooks for each active plugin, with a status dot. It shows the fifteen heaviest.

• Query profiling — off by default. Switch it on for a few days to populate the database columns, then off again.
• “No data” means a plugin ran no query during the sampled requests — good news, not a fault.
• Vulnerability scan — optional, needs an API token (free WPScan account).
• Data collection — enables known-vulnerability checks, needs an API token (free WPScan account).
• Outbound connection monitor — check the external connections made by each plugin.

Database checks

Maintenance tools for the database, plus the migration tool you need after cloning a site. This is the most powerful screen in the plugin, and the one to approach with a backup already made.

Audit

• Expired transients — safe to clean; WordPress recreates them when needed.
• Largest tables — read only, to see where the weight is.
• Largest autoloaded options — loaded on every request. Leftovers from removed plugins are the usual culprit; core options are protected and cannot be deleted.

Search & replace (migration)

Changes the old URL and path to the new ones everywhere in the database. It is serialization-aware: it unpacks serialized data, replaces the values inside and repacks them with recalculated lengths, which is what prevents the classic disaster of widgets disappearing after a migration. The guid column is deliberately skipped.

• Fill in old and new URL, and optionally the old and new path.
• Run the preview — it is mandatory and shows how many rows in which tables will change.
• Confirm twice to execute.

Maintenance mode

One of the two features that visitors can actually see. It puts a branded holding page in front of the site while you work, without taking anything offline for you.

• Title, message and logo — the page inherits the accent colour.
• Who can still browse — by capability, so administrators (and anyone else you choose) keep seeing the real site.
• Retry-After — tells search engines the outage is temporary, which protects your rankings during a long maintenance window.

404 page

The other visitor-facing feature. A default 404 is a dead end; a good one keeps the visit alive and tells you which links are broken.

• Title, text and logo for the page.
• Search box and home button — the two exits that recover most visits.
• 404 log — records the URLs that were not found, which is how you discover broken links and stale backlinks.

Customize menu

The admin menu grows with every plugin installed, until a client logs in and finds thirty entries they must not touch. This screen puts it back in order.

• Hide entries completely, or restrict them by role.
• Do not compact the menu — by default long menus collapse behind a “show more” button; tick this to keep everything visible and simply scroll.
• Easy manage menu items — adds a quick remove and a duplicate button next to each entry in Appearance → Menus, for the site’s navigation menus.

Activity log

Who did what, and when. On a site with more than one editor this is the difference between a mystery and a timestamp.

• Logins, both successful and refused, with the originating IP.
• Content published, edited or deleted.
• Plugins activated, deactivated or updated.
• Settings changed, including the plugin’s own.
• Block an aggressive IP with a single click.

Mail log

Every email the site sends, recorded. It answers the question that has no other answer: did the order confirmation actually leave, or is the customer right?

• Recipient, subject, time and delivery outcome.
• The message body is not stored, for privacy reasons: you can see that a message was sent, but not what it said.
• The sender captured from the form, which works across the common contact form plugins without any specific configuration.

Backup & restore

Full-site backups, encrypted and sent off the server. The screen estimates the size before you start, so you know whether you are about to create a small archive or a very large one.

• Scope — database only, which is fast and covers content and settings, or database plus site files before a major change.
• Destination — download locally, any S3-compatible storage, or a remote server over FTP.
• Schedule — automatic runs, so the backup exists before you need it.

Enjoy your new welcome screen

Two widgets, “Security summary” and “Site speed”, gather everything you need to understand what is happening on your website. In the upper-left corner you will also find the widget showing how many banners have been hidden and moved to the “ADV” section.

• Security summary — requests refused by your rules over the last 24 hours or 7 days: they never reached the password check.
  Failed logins are the attempts that did reach it and were refused by WordPress: wrong password, or no such user.
• Site speed — check the average site load time over the last 24 hours or 7 days. If something changed after an update, it is time to look at the plugins involved.
• Hidden banners — shows how many banners or errors Deskmode has intercepted and moved to its dedicated page.