Skip to content

Swiss Army Knife for WordPress is a standalone tool which allows you to perform some recovery operations on your WordPress site. This tool is intended to be used for a short time only and then removed in order to prevent security issues. The tool records the current IP address and browser info and will not work with from any other IP or browser.

Switch branches/tags
Go to file

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time

SAK4WP - Swiss Army Knife for WordPress

Swiss Army Knife for WordPress is a standalone tool which allows you to perform some recovery operations on your WordPress site. This tool is intended to be used for a short time only and then removed in order to prevent security issues. The tool records the current IP address and browser info and will not work with from any other IP or browser.


Upload !sak4wp.php in the folder where your WordPress installation is. Then open your browser and navigate to!sak4wp.php

Note: The file name is intentionally prefixed by an exclamation mark (!) to make sure the file appears first in the list of files, even above .htaccess. That way you should be able to see it in case you forget the file.


  • Dashboard - Shows some description about the app.

  • Self contained. You just need to upload one file. It outputs JavaScript and CSS files however returns header not modified to make the page load faster.

  • Built-in Self Destroy mechanism (must be user triggered) -> the script will try to remove itself. If that is not accessible (due to permissions issues). The user must delete the !sak4wp.php file manually (e.g. by using an FTP client or accessing the file from a control panel).

  • When data is shown in tables the currently viewed row is nicely highlited.

  • Shows User and Server's IP

  • Easy to Use


Limit Login Attempts related features

  • Allows you to Unblock yourself or somebody else from Limit Login Attempts plugin
  • Added a link to a whois service to see more info about the blocked IP.

Stats Module

  • It shows WordPress site stats e.g. number of posts, pages, users, attachments, revisions etc. Numbers are nicely formatted.
  • Db version info, db config details parsed from wp-config.php
  • Shows if you are running an older or the latest WordPress version. Links to update and to the latest wp are provided.
  • Shows site's disk space usage (du -sh linux only)
  • Shows total server's disk usage with nice coloring on the total disk size, usage and free space (df -h linux only)
  • Shows top processes (top -b -n 1 linux only)
  • Shows free memory (free -m linux only)
  • Lists top 15 larger files (linux only)
  • Shows phpinfo

Sice v1.1.5

  • Showing wp base dir.
  • Detect if wp caching is enabled
  • Check if caching is in within WP base dir.
  • Showing load average
  • Using Orbisius_WP_SAK_Util::m() to output some simple error messages

List Page Templates

  • This module allows you to see which page templates are use by your pages.


  • This module allows you to protect WordPress admin area by creating an .htaccess and .htpasswd files.
  • Protects wp-login.php too
  • User and Passwords can be auto-generated
  • TODO: check a list of sites if they have successfully protected their wp-admin folder
  • TODO: cookie remember pwd?
  • TODO: Update .htaccess files Note: This will stop affect WordPress registrations because WP uses wp-login.php for registrations. You can overcome that if you use a plugin that handles the registrations without relying on wp-login.php file.
  • offer zip archive
  • prefill db account on db dump screen

Locate WordPress

  • This module searches for local WordPress installations (linux only). It starts from a specified folder and shows the found WordPress installations and their versions. Useful if you manage multiple WordPress sites and want to make sure all of them are running the latest WordPress version. It also allows you to find old/forgotten WordPress installations. If the version cannot be detected it will show 0.0.0 The versions that are older will be shown in red, the up-to-date ones will be shown in green. TODO: autosuggest?

Plugin Manager

  • This module allows you to manage plugins: bulk download, install, and activate plugins. TODO: (de)activate, delete. Just enter the plugin's page or a zip file location (web) and the plugin will be downloaded and extracted into wp-content/plugins directory. The plugin will show which links are skipped and if they were successfully extracted. The file size of the downloaded file is shown. The plugin directory where the download plugin will be extract is shown. Warning: If the plugin already exists its files will be overridden! SAK4WP checks the remote file size before downloading the file. Plugins files larger than the limit (10MB) will be not be downloaded. Temporary files from the download are deleted later so they don't take too much space in the TMP folder which should be cleaned on reboot anyways. Plugin list can be retrieved from a text or HTML file.

User Manager This module allows you to see user account, user meta info, to log in as a user without knowing their password. TODO: Create, delete users. Administrators accounts are highlighted.

Self Protect This module allows you to run SAK4WP more securely. The first time you access SAK4WP, it will save your IP and browser info. If somebody else accesses the file from a different IP or browser, he/she will be stopped. The module doesn't require any configurations. It is always run before other modules.

PostMeta The PostMeta module retrieves meta information for a given post/page or multiple posts, pages separated by comma The meta information also contains post and author info. The search can also be done using post/page slug. Video demo:

Site Packager

  • Export the whole site in .tar or .tar.gz format with a single click
  • Can run in background (linux only)
  • Shows disk usage.
  • Automatically skips some files (logs, cache files etc, previously created archives by SAK4WP)
  • TODO: (o) backup only current WordPress site. i.e. wp-* + index.php + .htaccess all else no

Db Export

  • This module allows you to dump the database into a nice sql file (gzip compression optional) and provides download links.
  • Can run in background (linux only)
  • Parse wp-config.php line by line and not using regex to avoid any commented out lines
  • Backup only current site's tables.

Addons Added !sak4wp-theme-troubleshooter.php plugin. For more info see addons/!sak4wp-theme-troubleshooter.php

Troubleshooting If you see an error e.g. SAK4WP: Error this could be caused because you're accessing the !sak4wp from a different IP address or web browser. Because the tool gives enormous control it only allows connections from the same brower and IP address. If any of these are different you'll see the error message.

if you need to access the SAK4WP you can delete this file: /wp-content/uploads/

Please fork and improve!

Future Ideas / TODO

  • Make it not to require WordPress to be present -> e.g. it can download and install WP

  • Manage Plugins - Activate/Deactivate/Deploy Service to hold different plugin plugin configuration options e.g. a list of faviourite plugins

  • Manage Users - add, delete, update, import

  • Manage Content - add, delete, update, create sample pages e.g. Home, Services, Contact, About etc.

  • Clean DB - removes all content, attachments, menus, plugins -> show checkboxes so the user decides what to delete.

  • Download stats (as HTML, TEXT, PDF?)

  • Email stats This may require some inline CSS in the email because lots of mail providers will remove most of the CSS

  • Detect if a WordPress plugin crashed e.g. by setting a custom error function and raising the error reporing level. if there is a fatal error coming from /wp-content/plugins/PLUGIN-SLUG/ then deactivate that plugin either by updating the active plugins array or renaming the plugin's folder.

  • Use TMP folder to set the time when it was last used. If the app is hasn't been used for more than 2-3 hours -> self destroy

  • Automatic updater -> check the latest version at git hub and override itself

  • Create/modify child themes

  • Create a nice filemanager

  • Simple IDE - rich text or simple text to create txt or HTML files

  • Use files to setup some encrypted PWD in case the user decides to keep using the script.

  • Download any file from WP or ZIP a folder

  • Setup a service that will accept ftp details and will upload the !sak4wp on any hosting

  • Backup -> Files + Db; Send to Dropbox

  • Scan the folders for other WP installations -> manage multiple WP installs from 1 copy of the program or copy/move itself to another folder/site

  • DONE: Protect WP admin directory (basic auth)

  • Check if WP is setup to use https .. and SAK4WP is not accessed via https -> show a warning or redirect

  • Add a favicon

  • Add site title to the SAK4WP so when printting content it'll show the tested site

  • Log viewer -> scan for *.log and either offer them for download or show last 20 lines

  • The WP install scanner to show plugin versions and if they are up-to-date (Thanks Seb for the idea)

  • If WP-CLI is available enable commands such as update: core, plugins, themes

  • Mass site and db pkg

  • Detect and function to remove wp maintenance file

  • Detect wrong db and offer to help or don't start in full mode.

  • In users module -> search and load users by role, user, email etc.

  • Parse wp config...

  • Download and unzip remote files from old hosting.

  • Generate hash of files and check if all were correctly transferred.

  • Module: File Manager -> upload/download files, zip/unzip, (un)tar, check for large files, color large files with red > 1GB, process line per line list archive contents

  • do a scan ... wp core checksum -> check if there files other than images, docs in wp-content/ and uploads.

  • show php RC and ini folder for quick inspection.

  • load error if exists -> offer for download (>1mb) or visualize

      	//echo `find /doc_root_dir/ -type f -size +100k -exec ls -lh {} \; | awk '{ print $9 ": " $5 }'`;
      	// > 50MB
      	echo `find /doc_root_dir/ -type f -size +50000k -exec ls -lh {} \; | awk '{ print $9 ": " $5 }'`;
      it seems the syntax differs for differet OSs
      download can be limited with this
      # BEGIN BackUpWordPress
      # This .htaccess file ensures that other people cannot download your backup files.
      	RewriteEngine On
      	RewriteCond %{QUERY_STRING} !key=26xafasfasfasff09e5
      	RewriteRule (.*) - [F]
      # END BackUpWordPress


  • Installed and configured WordPress
  • FTP client to upload SAK4WP
  • Reminder to remove the SAK4WP after use to prevent being hacked.
  • php_curl extension to be available


Help Videos

Check out this YouTube playlist:


Q1: I am getting SAK4WP: Error A1: If you're getting SAK4WP: Error this means that the tool cannot verify you. It intentially doesn't provide more info in case the tool is accessed by a hacker. The reason for the error could be that your IP has changed and/or you're using a different browser etc.

Solution: using (S)FTP go to wp-content/uploads and and delete a file that starts with ".ht-sak4wp-" This should allow give you access.

Premium Support

If you want to get premium support for this product contact us to discuss your needs and a possible estimate.


By using this script you take full responsibility to remove it after the work is complete.



Svetoslav (Slavi) Marinov | twitter: |


Swiss Army Knife for WordPress is a standalone tool which allows you to perform some recovery operations on your WordPress site. This tool is intended to be used for a short time only and then removed in order to prevent security issues. The tool records the current IP address and browser info and will not work with from any other IP or browser.



No packages published