The Hack Repair Guy’s Plugin Archiver

Plugins you switch off but never delete pile up, and one day somebody clicks Activate on the one that broke the site, or the one that was hacked. Plugin Archiver moves a plugin’s files out of wp-content/plugins into a separate archive folder. WordPress stops listing it, so it cannot be activated by accident, but nothing is deleted and its settings stay in the database. Restore it whenever you want, configured as you left it. Under Plugins > Installed Plugins every plugin gets an Archive link, and Archive joins the bulk actions. Under Plugins > Archived Plugins you can: Restore a plugin to wp-content/plugins, one at a time or in bulk Delete a plugin’s files from the archive, one at a time or in bulk Unarchive all at once Switch between several archive folders Download an archived plugin as a zip file See when each plugin was archived and how long it has been there, and sort by either Know what happened. The Archived Plugins list shows Archived on and In the archive for, and an Activity Log tab records who archived, restored, deleted or downloaded what, and when. The log keeps the newest 500 entries on your own site; export it as CSV or clear it any time. Plugins archived before this feature show an estimated date marked “about”. Archives are hard to find. New archive folders get random names such as plugins-archive-k3x9a7q2m5zt, so the location cannot be guessed. Archives made by earlier versions keep working, and one click on Secure this archive gives them a random name. Archives are blocked from the web. Every archive folder gets deny rules for Apache (2.2 and 2.4) and IIS plus an index file, rewritten if they go missing. The plugin checks that they work by requesting a small marker file from your own site, warns you on screen if a folder can still be read, and adds a test to Site Health. Archived plugins are often old and sometimes vulnerable, so they should never be downloadable. Respects locked-down sites. If your site sets DISALLOW_FILE_MODS, archiving, restoring and deleting are turned off, while the Archived Plugins list stays visible and Download still works. The plugin never overwrites a plugin that already exists at the destination. Good for preventing accidental re-activation, quarantining a buggy or compromised plugin, testing different plugin sets, and keeping occasional-use tools out of sight until needed. Privacy The plugin sends nothing about your site anywhere and adds nothing to the public side of your site. Its one network request goes to your own site: a check that the archive folder cannot be read from the web, made at most every 12 hours or when you press Check again. It uses the WordPress Filesystem API and checks capabilities and nonces on every action. Archived plugins stay on your server until you restore or delete them. What it is not Plugin Archiver is not a backup tool, a malware scanner or a plugin manager. Archiving removes a plugin from WordPress’s view; it does not make a vulnerable plugin safe to keep on disk. If you archive a plugin because it is compromised or abandoned, delete it from the archive when you are done. If you want a deeper look at a site, The Hack Repair Guy can help. Other Hack Repair Guy plugins More free WordPress tools by The Hack Repair Guy: Site Inspector keeps a history of read-only security checks, so you can see what is new and what is fixed. Plugin Detective finds the plugin that broke your site in a few quick checks, even when wp-admin is down. Disable Other Plugin Notices groups notices from other plugins and themes into one collapsed panel. Group Password Reset lets administrators bulk reset passwords and send secure reset links. Admin Login Notifier tells you the moment an Administrator logs in to your dashboard. Credits Created and maintained by Jim Walker. Support For questions, ideas and bug reports, use the WordPress.org support forum: https://wordpress.org/support/plugin/hackrepair-plugin-archiver/ Report security concerns privately to Jim Walker at jim@hackrepair.com. Do not include credentials or sensitive site information in public posts.