🔐 WordPress Security Plugin

DVault — Secure Menu Lock
& Role Manager

Lock any WordPress admin menu behind a secure PIN gateway and granular role-based access control. Built for administrators who need real control over their dashboard security.

📦 Free Version 1.3.3

💎 Pro Version 1.3.0

👤 Author Plixorobd

📄 License GPLv2 or later

📖

Overview

DVault is a professional, high-performance security plugin designed for WordPress administrators who need granular control over their dashboard's visibility and access.

Whether you are managing a multi-user enterprise site, a WooCommerce store, a membership platform, or a client project — DVault lets you lock sensitive administrative areas behind a secure PIN gateway and role-based access control (RBAC).

Unlike traditional "menu hider" plugins that simply CSS-hide items, DVault uses an "Immersive Security" architecture. If a user bypasses the UI through a direct URL, they are immediately challenged by a high-fidelity PIN authentication screen synchronized with WordPress's native security engine.

🏆

Core Features Free Edition

🔒

Menu Lock Manager

Lock any top-level or sub-level WordPress admin menu item behind a secure gateway — the heart of DVault.

Dynamic discovery of all menu items including third-party plugins
Sub-menu locking without affecting parent items
Role targeting — choose which roles are affected
Instant activation with no page reload required

👥

Enterprise Role Manager

Complete CRUD interface for managing WordPress user roles — no coding required.

Create custom roles with inherited permissions
Safely delete custom roles; core roles are protected
Fine-tune 40+ atomic capabilities via a visual checkbox grid
Changes take effect immediately in the WordPress database

🛡️

PIN & Session Security

Robust encryption and session handling that balances strong security with real-world usability.

Master PIN stored using WordPress's native wp_hash_password
Onboarding Setup Wizard on first activation
Session grace period — no repeated prompts per session
Session Flush Tool to force all users to re-authenticate

📋

Activity Audit Logs

Track every administrative action with the built-in forensic logging engine.

Real-time timestamped feed of all lock and unlock events
Records User ID, role, IP address, browser agent, and timestamp
Clear classification: lock, unlock, and failed_attempt types
Integrated dashboard widget for at-a-glance security status

🎨

Premium Admin Interface

A professional, immersive control panel built for long-term daily use.

"Obsidian & Gold" design system with modern dark UI
Glassmorphism UI cards with depth effects
WCAG 2.1 AA accessible — meets international standards
Fully responsive with app-style navigation on mobile

⚡

Zero-Friction Architecture

Engineered to be fast, private, and non-invasive to your WordPress site.

Zero external dependencies — no CDN or API calls
Privacy-first: all data stays within your server
Lightweight footprint with no front-end performance impact
Safe exclusion logic — you can never accidentally lock yourself out

⚙️

How It Works

DVault uses a three-layer security architecture to ensure protection is seamless for authorized users and impossible to bypass for unauthorized ones. The entire enforcement chain runs server-side — it never relies on JavaScript or CSS tricks that can be circumvented from the browser console.

Layer 1

UI Interception

Hooks into WordPress menu rendering to detect access to locked items. If the current user's role is affected, the request is immediately redirected.

Layer 2

PIN Gateway

The user is presented with a high-fidelity PIN entry screen. Submitted PINs are verified server-side using wp_check_password() against the securely hashed value.

Layer 3

Session Authorization

On correct entry, a session token is granted for that specific menu. All events — success, failure, timeout — are written to the audit log.

💎 Pro

DVault Pro Edition — Enterprise Security Suite

Upgrade to unlock elite-level security features and enterprise-grade protection for high-stakes environments.

🔑 Multi-Tier PIN Security

Assign unique PINs per menu item, per role, or per individual user. Add 2FA integration for maximum assurance.

⏰ Automation & Rules Engine

Scheduled locking, adaptive auto re-lock, expiring access links, and session expiration dates for contractors.

🌍 Perimeter Security

Country-based geo-fencing, IP allowlist/blocklist, device trust fingerprinting, and Emergency Lockdown mode.

📊 Forensic Audit Engine

Extended log metadata, CSV and PDF export, and custom log retention controls for compliance reporting.

🏷️ White Label & Branding

Replace DVault branding with your agency name, hide DVault from clients, and deploy security profile templates.

🌐 Multisite Support

Full WordPress Multisite compatibility with centralized, network-level configuration and Priority 24/7 Support.

🚀 Get DVault Pro at plixorobd.com →

✅

Feature Comparison

Security Feature	Free	Pro
Core Protection
Lock Any Admin Menu	✔	✔
Sub-Menu Locking	✔	✔
Master PIN Protection	✔	✔
Role-Based Menu Access (RBAC)	✔	✔
Management Tools
Enterprise Role Manager (CRUD)	✔	✔
Capability Grid (40+ capabilities)	✔	✔
Activity Audit Logs	✔	✔
Session Grace Period & Flush Tool	✔	✔
Dashboard Security Widget	✔	✔
Onboarding Setup Wizard	✔	✔
Pro — Advanced Security
Multiple PINs (per menu item)	✗	✔
Role-Specific & User-Specific PINs	✗	✔
2FA Integration	✗	✔
Scheduled Locking Rules	✗	✔
Adaptive Auto Re-Lock	✗	✔
Emergency Lockdown Mode	✗	✔
IP Allowlist / Blocklist	✗	✔
Country-Based Geo-Fencing	✗	✔
Device Trust & Login Alerts	✗	✔
Security Email Notifications	✗	✔
PDF & CSV Audit Export	✗	✔
White Label Branding	✗	✔
Client Mode (Hide DVault)	✗	✔
WordPress Multisite Support	✗	✔
Priority 24/7 Support	✗	✔

📦

Installation

⚡ Automatic (Recommended)

In your WordPress admin, navigate to Plugins → Add New
Search for "DVault" in the plugin search bar
Click Install Now, then Activate
Follow the Onboarding Setup Wizard to configure your Master PIN

🗂️ Manual Installation

Download the .zip file from WordPress.org or your account dashboard
Upload the dashboard-vault folder to /wp-content/plugins/
Activate via Plugins → Installed Plugins
The Setup Wizard will launch automatically

⚠️ Important: Change your Master PIN immediately after initial setup. The factory default is 246850 — activating with this code is a security risk. The Setup Wizard will prompt you to do this automatically.

❓

Frequently Asked Questions

What is the default PIN after installation?

During the first installation, the Setup Wizard guides you through setting your own Master PIN. If you skip the wizard, the factory default is 246850. You must change this immediately from the DVault → Settings panel.

Can I lock sub-menus independently?

Yes. DVault allows you to lock any specific sub-page without affecting its parent menu item. For example, you can lock WooCommerce → Settings while leaving the main WooCommerce menu fully accessible.

Can I accidentally lock myself out?

No. DVault is engineered with a safety exclusion list. The main DVault control panel and the WordPress main dashboard are always excluded from any lock — so you can always access your settings, regardless of what rules you configure.

What happens if I forget my Master PIN?

If you are still logged in as an Administrator, go to DVault → Settings and use the PIN reset tool. If you are locked out entirely, a developer can reset the dvault_pin_hash option directly in the wp_options database table.

Does DVault work with custom post types and third-party plugin menus?

Yes. DVault's Menu Lock Manager dynamically reads the WordPress $menu and $submenu global arrays at runtime. Any menu item registered by any plugin or theme is automatically discoverable and lockable.

Does DVault affect the front-end of my website?

No. DVault is 100% an administrative-only plugin. It has zero impact on your website's public-facing front-end, page load times, or SEO.

Is DVault compatible with Elementor or Divi?

Yes. DVault only hooks into the WordPress admin backend. It has no interaction with front-end page builders or theme code whatsoever.

Is DVault GDPR compliant?

Yes. DVault operates with a Privacy First architecture. All data (PINs, logs, roles) is stored exclusively in your own WordPress database. DVault does not send any information to external servers, APIs, or third parties.

What happens to my data if I deactivate DVault?

Plugin settings and database tables are preserved on deactivation for easy reactivation. Full data removal only occurs on plugin deletion via the uninstall hook, which cleanly removes all dvault_* database tables and wp_options entries.

🗄️

Database Schema

DVault creates two custom database tables on activation using WordPress's dbDelta() function for safe, forward-compatible schema management.

{prefix}_dvault_items Locked Menu Items

Column	Type	Description
id	mediumint(9)	Auto-incremented primary key
menu_slug	varchar(255)	WordPress menu slug identifier
menu_name	varchar(255)	Human-readable menu display name
locked_by	bigint(20)	User ID of the administrator who created the lock
locked_at	datetime	UTC timestamp when the lock was created
affected_roles	text	JSON-encoded array of affected role slugs
status	tinyint(1)	1 = Active lock, 0 = Unlocked

{prefix}_dvault_logs Activity Audit Log

Column	Type	Description
id	mediumint(9)	Auto-incremented primary key
user_id	bigint(20)	WordPress User ID of the acting user
action	varchar(50)	Event type: lock, unlock, failed_attempt
target	varchar(255)	Menu name and slug that was targeted
ip_address	varchar(45)	IPv4 or IPv6 address of the client
user_agent	text	Full browser user agent string
logged_at	datetime	UTC timestamp of the event

🔧

Technical Requirements

Requirement	Minimum	Recommended
WordPress	5.8	6.4+
PHP	7.4	8.1+
MySQL / MariaDB	5.6	8.0+
Browser (Admin)	Chrome 80+, Firefox 78+	Latest versions

🔐

Security & Privacy

DVault is built with WordPress security best practices enforced at every layer.

🧹

Input Sanitization

All user inputs are sanitized with sanitize_text_field, absint, and other WordPress functions before processing.

🛡️

Output Escaping

All database values are properly escaped on output using esc_html(), esc_attr(), and esc_url().

💉

Prepared Statements

All database queries use $wpdb->prepare() to prevent SQL injection attacks entirely.

🎫

Nonce Verification

All form submissions and AJAX requests are verified with WordPress nonces to prevent CSRF attacks.

🔑

Capability Checks

Every admin action verifies that the current user has the manage_options capability before proceeding.

🔒

Hashed PIN Storage

The Master PIN is stored as a one-way wp_hash_password() hash. It cannot be recovered — only verified.

📡

No External Connections

DVault makes zero outbound network requests. No telemetry, no analytics, no update pings to external servers.

🔏

Privacy First

All data processing occurs 100% locally within your WordPress installation. No data is ever shared externally.

📜

Changelog

Version 1.3.3 Current Stable

WordPress Plugin Repository compliance patch — asset enqueueing standards fully enforced.

Fixed Compliance: Replaced raw <link> HTML tags for Google Fonts in pin-entry-display.php with a fully compliant wp_register_style() + wp_enqueue_style() + wp_print_styles() pipeline, resolving the WP Plugin Review Team flag
Fixed Compliance: Google Fonts stylesheet declared as a formal dependency of dvault-pin-entry, ensuring correct load order and de-duplication by the WordPress asset manager
Fixed Compliance: Set external Google Fonts URL version argument to null to prevent WordPress appending a ?ver= query string that would break the third-party URL
Improved Hardening: Full audit confirmed zero remaining raw <link>, <script>, or <style> tags across all plugin PHP files

Version 1.3.2

Security and repository compliance update.

Fixed Security: Escaped time() in search input name attribute to comply with WP repo standard

Version 1.3.1

Security and compliance patch release. Full WordPress Plugin Repository standards enforcement.

Fixed Security: Enforced wp_unslash() + sanitize_text_field() on all nonce verification calls across all form handlers
Fixed Security: Applied esc_url() to all admin_url() outputs in display partials to eliminate XSS vectors
Fixed Compliance: Purged all remaining legacy wp_lock / WP_Lock class and option identifiers from the codebase
Fixed Compliance: Removed all remaining inline <style> and <script> fragments; all assets now served via wp_enqueue_style() / wp_enqueue_script()
Fixed Database: Corrected SQL table names in uninstall.php from uppercase to lowercase for Linux case-sensitive database compatibility
Fixed Compliance: Standardized all i18n functions to use dashboard-vault-secure-menu-lock-role-manager text domain
Improved Privacy: Removed remote Gravatar dependency; author avatar now served from a local plugin asset

Version 1.3.0

Major maintenance and hardening release.

Fixed Security: Implemented mandatory nonce sanitization and unslashing for 100% repository compliance
Fixed Security: Standardized output escaping across all administrative partial screens to eliminate XSS risks
Fixed Compliance: Retired all legacy "wp_lock" identifiers in favor of the unique "dvault" namespace
Fixed Compliance: Migrated remaining inline styles and scripts into properly enqueued external assets
Improved Immersive PIN Gateway: Refactored the security screen into a glassmorphic, focus-trapped experience
Improved Responsive Layout: Hardened the Access History and Audit Log grids for perfect mobile rendering
Improved Plugin Authority: Updated author identity with professional certifications and local avatars
Improved Asset Privacy: Eliminated 3rd party Gravatar dependencies to ensure zero external tracking

Version 1.2.0

New Enterprise Role Manager — full CRUD interface for WordPress roles and capabilities
New Integrated in-plugin User Guide documentation panel
New Professional "Gold & Dark" enterprise UI redesign
New Session Flushing tool for security maintenance
Improved Deep scan capability detection for third-party plugin roles

Version 1.1.0

Added Onboarding Setup Wizard for guided first-time configuration
Improved Security PIN hashing logic; migrated to wp_hash_password()
Added Sub-menu locking support

Version 1.0.0

New Initial public release

Version 1.3.0 Current Stable

Enterprise security maintenance, audit sweep, and version alignment release.

Fixed Security: Completed codebase output escaping and safety validation sweep
Improved Codebase: Aligned layout system, security assets, and versions with the Free core package

Version 2.5.1

Enterprise compliance audit and security hardening release.

Fixed Security: Implemented strict nonce sanitation using wp_unslash() and sanitize_text_field() on settings and activation forms
Fixed Security: Escaped output URLs utilizing esc_url() across admin headers, log views, and wizard displays
Fixed Compliance: Cleared all remaining legacy class and option definitions matching wp_lock namespace
Fixed Compliance: Purged inline scripts and custom styled controls in favor of enqueued assets
Fixed Database: Modified Pro uninstall handlers to delete lowercase tables dvault_items and dvault_logs
Improved Privacy: Converted Gravatar display loops to absolute local images inside the About panel

Version 2.5.0

Redesigned Licensing, update engine, and core synchronization.

New Fully localized local translation system with text-domain normalization
Improved Multi-site license verification and automatic updates system
Improved Synchronization of database options with the core Free codebase