Description
UltimaKit is a modular WordPress toolkit that replaces 50+ single-purpose plugins with a single, lightweight plugin. Enable only the modules you need — disabled modules run zero code, so your site stays fast no matter how many features you unlock.
30+ free modules. Zero performance bloat.
Whether you’re a freelancer managing client sites, an agency needing white-label tools, or a site owner tired of juggling 20 plugins — UltimaKit gives you everything in one clean dashboard.
What Users Are Saying
“Finally a plugin that does everything without slowing my site down. Replaced 12 plugins in one go.”
“The modular approach is genius — I only run what I need. My PageSpeed score jumped 8 points after switching.”
“Perfect for client sites. White labeling is flawless and the agency tools save me hours every week.”
Plugins You Can Uninstall Today
Switch to UltimaKit and safely remove all of these:
- Yoast Duplicate Post UltimaKit’s Duplicate Pages & Posts
- SVG Support / Safe SVG UltimaKit’s SVG Upload
- Disable Gutenberg UltimaKit’s Gutenberg Manager
- WPS Hide Login UltimaKit’s Change Login URL
- Limit Login Attempts Reloaded UltimaKit’s Login Security
- Redirection UltimaKit’s 301 Redirect Manager
- Cookie Notice / GDPR Cookie Compliance UltimaKit’s GDPR Tool
- Simple Custom CSS and JS UltimaKit’s Code Manager
- WP Maintenance Mode UltimaKit’s Maintenance Mode
- Post Types Order UltimaKit’s Drag & Drop Sort Order
- Code Snippets UltimaKit’s Code Snippets Manager
- Query Strings Remover UltimaKit’s Remove Query Strings
- Heartbeat Control UltimaKit’s Heartbeat Manager
- Disable Emojis UltimaKit’s Disable Emojis & Embeds
Most Popular Free Modules
- Duplicate Posts & Pages — One-click cloning for posts, pages, and custom post types
- SVG Upload — Safely upload SVG logos and icons to the Media Library
- Disable Gutenberg — Revert to the Classic Editor for specific post types or the whole site
- Hide Admin Notices — Move plugin banners out of your dashboard into a dedicated panel
- Change Login URL — Secure your /wp-admin from bots by customizing the login URL
- Drag & Drop Post Order — Reorder Posts, Pages, and CPTs visually
- Code Snippets Manager — Add PHP, JavaScript, and CSS snippets without editing theme files
- Heartbeat Control — Reduce server load caused by the WordPress Heartbeat API
- Disable XML-RPC — Block the most common DDoS and brute-force attack vector
- Login Security — Auto-lock IPs after repeated failed login attempts
All Free Features
Content & Post Management
- Duplicate Pages & Posts — Clone any content with a single click, including custom post types
- Drag & Drop Post Order — Custom sort order for posts, pages, and CPTs
- SVG Upload — Enable safe, sanitized SVG file uploads for all or specific roles
- Auto-Generate Slugs — Create clean, SEO-friendly URL slugs automatically
- Featured Image Column — View post thumbnails directly in the admin list table
- Post/Page ID Column — Show object IDs in the admin list for faster debugging
- Open External Links in New Tab — Auto-add target=”_blank” to outbound links
Admin Interface & UX
- Hide Admin Notices — Move plugin notices to a collapsible panel in the admin bar
- Clean Up Admin Bar — Remove “Howdy Admin,” WP Logo, and unwanted admin bar clutter
- Custom Admin Footer — White-label the dashboard footer for clients
- Login Page Styler — Remove login error hints and animated shake effects
Security & Hardening
- Change Login URL — Rename /wp-login.php to a custom slug to block automated attacks
- Limit Login Attempts — Lock out IPs after configurable failed login attempts
- Disable XML-RPC — Eliminate a major attack surface for brute-force and DDoS
- Hide WordPress Version — Prevent targeted version-based exploits
- Block “Admin” Username — Refuse creation of the most commonly targeted username
- Disable File Editing — Prevent theme/plugin file edits from the WordPress dashboard
- Auto-Logout Inactive Users — Automatically end idle admin sessions
- Disallow Bad Requests — Filter malicious URL strings and base64 injection attempts
- Disallow Directory Listing — Hide folder contents from public view
Performance & Optimization
- Disable Gutenberg — Remove block editor overhead where it’s not needed
- Disable Emojis & Embeds — Strip unnecessary JavaScript from every frontend page load
- Disable Comments — Turn off comments globally or per post type
- Disable RSS Feeds — Block content scrapers and save server resources
- Disable Cart Fragments (WooCommerce) — Fix the #1 WooCommerce performance bottleneck
- Heartbeat Control — Throttle the WP Heartbeat API to reduce server CPU usage
- Remove Query Strings — Improve GTmetrix, PageSpeed Insights, and Pingdom scores
Custom Code & Design
- Code Snippets Manager — Add and manage PHP, JS, and CSS snippets with location control (head, footer, init, before/after content)
- Header/Footer Code — Insert Google Analytics, Meta Pixel, GTM, or any tracking snippet
- Custom CSS/JS — Add site-wide style and script tweaks without editing theme files
- GDPR Compliance Tool — Display a cookie consent notice to meet legal requirements
Pro Features (Agency Power Tools)
- SEO Title & Meta Editor — Lightweight meta management without a heavy SEO plugin
- Custom Post Types (CPT) UI — Register CPTs and Taxonomies visually, no code required
- Admin Activity Logger — Full audit log of every change made on the site
- Maintenance Mode — Professional coming-soon pages with countdown timer
- White Labeling — Rename “UltimaKit” to your own agency brand in the dashboard
- Advanced WooCommerce Tools — Breadcrumb control, custom “Add to Cart” text, and more
- Gravity Forms Modules — Advanced analytics, form management, and field utilities
- Export/Import Settings — Move your entire UltimaKit configuration to client sites instantly
- 301 Redirect Manager — Manage all redirects from a central dashboard
- Ban Emails & Blacklist Usernames — Prevent registrations from specific addresses or names
- Multiple User Roles — Assign more than one role to a user account
View All Pro Features & Pricing
SyncSheets: Google Sheets Integration for WordPress
Why UltimaKit Instead of Many Separate Plugins?
Every plugin you install adds HTTP requests, database queries, admin menu overhead, and potential security vulnerabilities. Running 15 separate plugins to do what UltimaKit does in one means 15× the update maintenance, 15× the compatibility risk, and a slower dashboard.
UltimaKit uses strict module isolation: code for a disabled module never runs. Unlike omnibus plugins that load everything at once, UltimaKit’s architecture means you pay zero performance cost for features you don’t use.
Part of the PluginStack Bundle
UltimaKit is part of the PluginStack ecosystem — a growing suite of focused WordPress tools built for developers and agencies.
Links: Website | Upgrade to Pro | PluginStack Bundle
Installation
- Install using the WordPress built-in Plugin installer, or extract the zip file and drop the contents in the
wp-content/plugins/directory. - Activate the plugin through the Plugins menu in WordPress.
- Go to UltimaKit in the admin sidebar.
- Enable only the modules you need — everything else stays dormant and adds zero overhead.
FAQ
-
Does UltimaKit slow down my WordPress site?
-
No. UltimaKit uses strict module isolation — if a module is not enabled, its code does not load at all. Running UltimaKit with 10 active modules is significantly more efficient than running 10 separate single-purpose plugins, because there is no redundant bootstrapping, duplicate asset loading, or plugin framework overhead.
-
Why should I use UltimaKit instead of separate plugins like Duplicate Post, SVG Support, or WPS Hide Login?
-
Each plugin you install adds its own database queries, admin hooks, asset files, and update maintenance. UltimaKit replaces 50+ of these single-purpose plugins with one optimized codebase. You get fewer updates to manage, fewer compatibility conflicts, and a lighter, faster WordPress installation.
-
How many modules does UltimaKit include?
-
The free version includes 30+ fully functional modules across content management, security hardening, performance optimization, and custom code. The Pro version adds advanced agency and developer tools including CPT UI, admin activity logging, maintenance mode, white labeling, Gravity Forms modules, and more.
-
Can I use UltimaKit on client sites?
-
Yes. The White Label Pro feature lets you rebrand the entire UltimaKit dashboard with your own agency name and logo. The Export/Import Settings module lets you clone your configuration to new client sites in seconds. It’s built with agencies in mind.
-
Is it compatible with WooCommerce?
-
Yes. UltimaKit includes WooCommerce-specific optimization modules in both Free and Pro tiers — including disabling cart fragments (the most common WooCommerce performance issue), hiding out-of-stock products, and customizing checkout behavior.
-
Is UltimaKit compatible with popular page builders?
-
Yes. UltimaKit works alongside Elementor, Beaver Builder, Divi, Bricks, and other major page builders. The Disable Gutenberg module can be set per post type so you can use the block editor on some content types and a page builder on others.
-
The free version includes 30+ real, fully functional modules. You can manage content, harden your login page, block XML-RPC attacks, disable Gutenberg, remove query strings, add code snippets, and much more — all without spending a cent. Pro adds advanced agency tools and deeper customization, but the free version is genuinely complete.
-
Does UltimaKit work with multisite?
-
UltimaKit can be activated on individual sites within a multisite network. Network-wide activation is not officially supported, but many users run it on each sub-site without issues.
-
What happens to my settings if I deactivate the plugin?
-
Your settings are preserved in the database when you deactivate UltimaKit. Reactivating the plugin restores your previous configuration. If you want to fully remove the plugin and its data, you can delete it from the Plugins screen.
-
Does UltimaKit include a code snippets manager?
-
Yes. Version 2.3.0 added a dedicated Code Snippets module supporting PHP, JavaScript, and CSS. Each snippet has its own title, type, location (Frontend Head/Footer, Admin Head/Footer, On Init, Before/After Content), priority, description, and active toggle — managed from a full admin page at UltimaKit Code Snippets.
Reviews
Contributors & Developers
“UltimaKit – WordPress Admin Tools, Security & Performance Optimizer” is open source software. The following people have contributed to this plugin.
Contributors
Translate “UltimaKit – WordPress Admin Tools, Security & Performance Optimizer” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
2.3.0
- NEW: Code Snippets module added to “Custom Code” category. Supports PHP, JavaScript, and CSS snippets with per-snippet title, type, location (Frontend Head/Footer, Admin Head/Footer, On Init, Before/After Content), priority, description, and active toggle. Snippets are stored in a dedicated database table and managed via a full admin page (UltimaKit Code Snippets) with add/edit form, search, type-tab filters, inline toggle, and delete.
- FIXED: Change Login URL — login form was posting to /wp-login.php instead of the custom slug. Added site_url filter to correctly rewrite the form action attribute.
- FIXED: Change Login URL — removed early wp_redirect() call from class constructor that ran before WordPress was fully initialized, which could cause headers-already-sent errors.
- FIXED: Change Login URL — removed redundant admin_init hook for blocking /wp-login.php (the init hook at priority 1 already handles this correctly).
- FIXED: Admin UI — sidebar icon color live preview was reflecting the admin bar icon color due to a wrong DOM selector.
- FIXED: Admin UI — color pickers were double-initialized, causing picker UI conflicts.
- FIXED: Admin UI — sidebar width value now sanitized with absint() before CSS output to prevent potential CSS injection.
- IMPROVED: Admin UI color scheme updated to match PluginStack brand palette — replaced Bootstrap purple with brand indigo (#6366f1), removed gold/yellow accent in favour of violet (#8b5cf6), and standardised backgrounds to #f8fafc.
- FIXED: Admin UI — modal title text was near-zero contrast. Changed to white (#ffffff).
- FIXED: Admin UI — “Get Pro” button text colors failed WCAG contrast checks. Changed all button text to #ffffff.
- FIXED: Admin UI — sidebar border colors were invisible (same as background). Changed to #e2e8f0.
- FIXED: Admin UI — button hover state had no visual change. Changed hover to #4f46e5.
- IMPROVED: Admin UI — replaced outdated silver on borders and nav-tabs with modern slate-grey (#e2e8f0).
- IMPROVED: Admin UI — .settings-actions .btn-secondary changed to outline-indigo style for palette consistency.
[GF] Form Analytics (Pro)
- FIXED: Dead AJAX action registrations removed — handler methods did not exist, causing PHP notices on every admin page load.
- FIXED: get_average_completion_time() was querying per-field blur events instead of submission completion_time, producing incorrect averages.
- FIXED: Submission Rate always showed 100% — count() returned the number of array keys rather than the actual submission count.
- FIXED: CSV export crashed with undefined index errors — export now decodes event_data JSON column instead of non-existent DB columns.
- FIXED: $field_label referenced before assignment. Initialized to ” before the conditional block.
- FIXED: JS — gform_confirmation_loaded was double-counting submissions alongside the PHP hook. Handler removed; PHP hook is now authoritative.
- FIXED: JS — session cookie not being set, causing PHP and JS to read different session IDs.
- FIXED: JS — gform_field_validation_error is not a real Gravity Forms JS event. Removed.
- FIXED: JS — form abandonment used a single shared boolean; switched to an object keyed by form ID for multi-form pages.
- IMPROVED: get_user_location() now called only for view, submission, and abandon events — not every field interaction.
- IMPROVED: Empty state messages added for field performance table, abandonment table, and device stats section.
Simple Notification Bar (Pro)
- IMPROVED: Settings UI migrated from modal/popup to a dedicated full-page admin screen (UltimaKit Notification Bar).
- IMPROVED: Notification message field upgraded from plain textarea to wp_editor() (TinyMCE + Quicktags).
- FIXED: Bar position CSS output without esc_attr(), allowing unescaped values in inline style.
- FIXED: Admin-bar CSS selector was incorrect. Corrected to body.admin-bar.has-notification-bar.
- FIXED: JS admin-bar top offset calculation ignored positionOffset, causing bar overlap with admin bar.
- FIXED: Save handler caused fatal error because $this->helper was always null. Handler now calls inherited method directly.
2.2.0
- NEW: Additional Gravity Forms modules added to Pro version.
- IMPROVED: Module manager performance improvements.
- FIXED: Various UI and compatibility fixes.
2.1.0 – 03.11.2025
- NEW: Gravity Forms modules added to Pro version.
- IMPROVED: UI, performance, and security hardening.
2.0.1 – 25.11.2025
- NEW: Added “Plugin Replacer” guide to settings.
- IMPROVED: Duplicate Post now supports Custom Post Types (thanks @jasD).
- FIXED: Minor CSS conflict with Admin Bar on mobile.
- SECURITY: Hardened SVG upload sanitization.
- UPDATED: Freemius SDK to 2.13+.
1.8.5 – 02.06.2025
New Free Modules: Featured Image Column, Change Login URL (Hide /wp-admin), Disallow Directory Listing, Force SSL & Strong Passwords.
New Pro Features: Ban Emails & Blacklist Usernames, Multiple User Roles support.
UI Revamp: Complete redesign of the admin interface.
1.8.0 – 16.03.2025
- Security Suite Added: Disallow Bad Requests, Lock Site URL, Password Protection.
- New Translations: Support for 8 new languages.