TogglePilot – Admin Module Manager

Description

TogglePilot – Admin Module Manager adds a “⚡ Plugins” menu to the WordPress Admin Bar that lists every installed plugin and lets authorized administrators toggle activation on or off in place, using AJAX, with no full page reload.

It is built primarily as a developer/troubleshooting utility to speed up plugin-conflict testing: instead of navigating to Plugins → Installed Plugins, finding a plugin, and clicking Activate/Deactivate (which reloads the page), you can toggle plugins directly from any screen — front end or back end — via the Admin Bar.

Features

• Admin Bar dropdown listing all installed plugins with name, version, author, and status
• One-click activate/deactivate via AJAX — no page reload
• Client-side instant search/filter for sites with many plugins
• Active / Inactive grouping (optional; can be shown as a flat alphabetical list instead)
• Protected Plugins list — require a confirmation dialog before deactivating sensitive plugins
• TogglePilot – Admin Module Manager can never deactivate itself
• Native WordPress-style confirmation modal (no browser alert())
• Plugin dependency awareness (reads the “Requires Plugins” header / WP_Plugin_Dependencies) with a clear warning if a dependency is missing
• Troubleshooting Mode: select multiple plugins to deactivate at once for conflict testing, then restore the exact previous state with one click
• Configurable settings: Admin Bar label/icon, which fields to show, menu width, compact mode, grouping
• Optional debug logging of activation/deactivation attempts (never logs nonces, tokens, or passwords)
• Multisite-aware capability checks
• Full keyboard navigation, ARIA labeling, and screen-reader support
• Translation-ready (text domain: togglepilot-admin-module-manager)

Security

• Every action requires the activate_plugins capability (or higher, depending on multisite context)
• Every AJAX request verifies a WordPress nonce via check_ajax_referer()
• Plugin identifiers sent from JavaScript are never trusted directly — they are sanitized, validated against a strict pattern, and confirmed to correspond to a real installed plugin before any action is taken
• Directory traversal and arbitrary file paths are rejected
• TogglePilot – Admin Module Manager itself is hard-protected against deactivation from its own UI
• Administrator-defined protected plugins require an explicit confirmation step
• Activation/deactivation always goes through WordPress core’s own activate_plugin() / deactivate_plugins() functions — the plugin never writes directly to the active_plugins option or plugin files

Configuration

Go to Settings → TogglePilot – Admin Module Manager to:

• Change the Admin Bar label and icon
• Choose whether to show plugin versions/authors
• Choose whether inactive plugins are shown
• Enable/disable the search box
• Enable/disable Active/Inactive grouping
• Select which plugins require confirmation before deactivation (Protected Plugins)
• Adjust menu width and compact mode
• Enable debug logging

Usage

1. Click “⚡ Plugins” in the Admin Bar from any page.
2. Use the search box to quickly find a plugin if you have many installed.
3. Click a toggle to activate or deactivate that plugin.
4. For protected plugins, confirm the action in the dialog that appears.
5. The row updates immediately to reflect the new status — no page reload.

Troubleshooting Mode

1. Click “Troubleshooting Mode” in the Quick Plugins dropdown footer.
2. Check the plugins you want to temporarily disable for conflict testing.
3. Click “Disable Selected.” The plugin records your pre-change state for your user session.
4. Test your site with those plugins off.
5. When done, reopen the dropdown, click “Troubleshooting Mode,” and click “Restore Previous Plugin State” to put everything back exactly as it was.

Troubleshooting

• The menu doesn’t appear: Confirm your user has the activate_plugins capability and that the Admin Bar is enabled for your account (Users → Your Profile → Toolbar).
• A toggle does nothing: Open your browser console for errors; your session/nonce may have expired — refresh the page.
• “Security check failed” message: Your nonce expired (usually after 12–24 hours or after logging out/in elsewhere). Refresh the page and try again.
• A plugin won’t activate: Click “View Details” on the failure message for the sanitized error WordPress returned; it usually indicates a PHP error or missing dependency in that plugin.

Minimum Requirements

• WordPress 6.9 or greater
• PHP 8.1 or greater