{"id":11367,"date":"2026-05-30T05:29:56","date_gmt":"2026-05-29T21:29:56","guid":{"rendered":"https:\/\/aeosub.com\/plugseal\/"},"modified":"2026-05-30T05:29:56","modified_gmt":"2026-05-29T21:29:56","slug":"plugseal","status":"publish","type":"post","link":"https:\/\/aeosub.com\/zh\/plugseal\/","title":{"rendered":"PlugSeal"},"content":{"rendered":"
\n\n\n\n\n\n\n\n
Developer<\/th>\nMarc Armengou<\/a><\/td>\n<\/tr>\n
Version<\/th>\nv0.1.0<\/td>\n<\/tr>\n
Active Installs<\/th>\n0 +<\/td>\n<\/tr>\n
Requires \/ Tested<\/th>\n6.6 \/ 7.0<\/td>\n<\/tr>\n
Last Updated<\/th>\n2026-05-29 9:16pm GMT<\/td>\n<\/tr>\n
Official Link<\/th>\nView Details \u2192<\/a><\/td>\n<\/tr>\n<\/table><\/div>\n
Control what each active plugin is allowed to do. Allow or deny specific permissions per plugin, with immediate effect.<\/div>\n

PlugSeal gives administrators granular control over what each active plugin is allowed to do, inspired by Android app permissions. Each active plugin is listed in the settings page. For each plugin, administrators can allow or deny individual permissions with immediate effect. All permissions are allowed by default, so no existing functionality is broken until an administrator explicitly restricts it.<\/p>\n

Permissions covered:<\/strong><\/p>\n

    \n
  • db:read<\/code> \/ db:write<\/code> \u2014 database queries via $wpdb<\/li>\n
  • db:read:users<\/code> \/ db:write:users<\/code> \u2014 read and write access to user data (also covers wp_delete_user and wp_update_user)<\/li>\n
  • http:outbound<\/code> \u2014 outbound HTTP requests via the WordPress HTTP API<\/li>\n
  • options:read<\/code> \/ options:write<\/code> \u2014 WordPress options via get_option \/ update_option (see limitations)<\/li>\n
  • email:send<\/code> \u2014 sending email via wp_mail()<\/li>\n
  • cron:write<\/code> \u2014 scheduling events via wp_schedule_event()<\/li>\n
  • transients:write<\/code> \u2014 writing transients via set_transient()<\/li>\n
  • users:create<\/code> \u2014 creating users via wp_create_user() (updates and deletes are covered by db:write:users)<\/li>\n
  • rest:register<\/code> \u2014 registering REST API endpoints via register_rest_route()<\/li>\n
  • shortcode:register<\/code> \u2014 registering shortcodes via add_shortcode()<\/li>\n
  • rewrite:register<\/code> \u2014 registering rewrite rules via add_rewrite_rule()<\/li>\n
  • admin:menu<\/code> \u2014 adding entries to the admin menu and submenus<\/li>\n
  • dashboard:widget<\/code> \u2014 adding dashboard widgets via wp_add_dashboard_widget()<\/li>\n
  • hooks:frontend<\/code> \u2014 hooking into frontend hooks (wp_head, wp_footer, the_content, wp_enqueue_scripts…)<\/li>\n
  • hooks:admin<\/code> \u2014 hooking into admin hooks (admin_head, admin_notices, admin_enqueue_scripts…)<\/li>\n
  • hooks:auth<\/code> \u2014 hooking into authentication hooks (wp_login, wp_logout, user_register, authenticate…)<\/li>\n
  • hooks:content<\/code> \u2014 hooking into content hooks (save_post, delete_post, pre_get_posts, wp_handle_upload…)<\/li>\n
  • hooks:lifecycle<\/code> \u2014 hooking into plugin and theme lifecycle hooks (activated_plugin, deactivated_plugin, switch_theme…)<\/li>\n<\/ul>\n

    Honest limitations:<\/strong><\/p>\n

    This plugin intercepts official WordPress APIs by identifying the calling plugin via the PHP call stack. It cannot intercept calls made by WordPress core on behalf of a plugin \u2014 for example, when WordPress processes a settings form via options.php<\/code>, the call stack contains core files rather than the plugin files.<\/p>\n

    Specific limitations:<\/p>\n

      \n
    • options:read<\/code> \/ options:write<\/code> \u2014 work when a plugin calls these APIs directly from its own code (hooks, AJAX, cron). Do not block standard WordPress settings forms processed by options.php<\/code>.<\/li>\n
    • Filesystem access (file_get_contents<\/code>, fopen<\/code>, etc.) is not intercepted.<\/li>\n
    • Direct mysqli<\/code> connections, eval()<\/code>, and raw PHP file functions bypass all interceptors.<\/li>\n
    • wp_update_user()<\/code> and wp_delete_user()<\/code> are covered by db:write:users<\/code> since they write directly to the users table.<\/li>\n
    • admin_init<\/code> is intentionally excluded from hooks:admin<\/code> as it is too critical to block safely.<\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"

      Control what each active plugin is allowed to do. Allow or deny specific permissions per plugin, with immediate effect.<\/p>","protected":false},"author":1,"featured_media":9317,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[252],"tags":[1692,1027,2572,664,555],"class_list":["post-11367","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-trends","tag-access-control","tag-hardening","tag-permissions","tag-security","tag-wordpress-plugin"],"_links":{"self":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts\/11367","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/comments?post=11367"}],"version-history":[{"count":0,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts\/11367\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/media\/9317"}],"wp:attachment":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/media?parent=11367"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/categories?post=11367"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/tags?post=11367"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}