Documentation

How to set up all 14 modules of Target Media Toolkit (version 1.2.0). The plugin requires WordPress 6.2+ and PHP 7.4+.

Getting started

After activation, open the Target Media menu. Each module has a switch: turn on the ones you want and click Save. Each active module gets its own settings page.

Under Construction / Coming Soon

• Mode: Coming soon (HTTP 200) or Maintenance (HTTP 503 with Retry-After, so Google keeps your rankings).
• Template: choose one of 10 templates and change the headline, message, logo, colours, font, background and custom CSS.
• Countdown: set a date and time; with automatic launch the page switches itself off when the timer ends.
• Who sees the real site: administrators always; you can add roles, allowed IPs, public pages or a secret preview link.
• Cache: common page caches are purged automatically. Purge your CDN (e.g. Cloudflare) yourself.

Custom login URL

• Enter a new address, e.g. my-door. Log in at example.com/my-door.
• Logged-out visitors to wp-login.php and wp-admin get a 404 (or the home page).
• The new address is emailed to the site admin.
• Emergency: add define( 'TMEDIA_DISABLE_LOGIN_URL', true ); to wp-config.php or rename the plugin folder over FTP.

Login protection

New in 1.2.0. The module protects your login page from password guessing.

• Blocking: after too many wrong passwords (5 by default) an IP address is blocked for 20 minutes; an address that keeps trying is blocked for 24 hours.
• The login page shows how many attempts are left. Passwords from a blocked address are never checked.
• Optional: treat any attempt with the username “admin” as an attack.
• XML-RPC is turned off, because most password-guessing bots use it.
• Log of failed logins and blocks, an Unblock button and an allow-list of IP addresses (e.g. your office).
• An email to the admin when an attack gets a long block. Works behind Cloudflare and other proxies.

Temporary login

• Create a passwordless login link and choose how long it lasts: 1 hour to 30 days.
• Only roles without user, plugin, theme or settings rights are offered, never administrator. Those rights stay blocked even if someone changes the role later.
• Temporary users cannot sign in with a password, reset it or edit their profile.
• Extend, create a new link, revoke (signs the user out at once) or delete with one click, and see when each link was last used.
• Expired users are deleted automatically and their content goes to the person who created the link.
• Works with the custom login URL, and clients with a link see the real site even while Under Construction is on.

WebP images

• PNG uploads are converted to WebP before thumbnails are created; JPEG is optional.
• Animated PNGs are skipped and the original is kept when WebP would be larger.
• Uses GD or Imagick on your server. If WebP is not supported, the settings page tells you and uploads work as usual.
• Existing images are not changed.

Social share

• A “Social Share” box in the editor lets you pick a share image, title and description for every post and page.
• Without a choice it falls back to the featured image, then to the default image for the whole site from the module settings.
• Outputs OpenGraph and X (Twitter) card tags with image size and alt text.
• Pauses itself when an SEO plugin that adds the same tags is active.

XML sitemap

• Available at example.com/sitemap.xml with pages, posts, products, categories and featured images.
• Cached and split for large sites, added to robots.txt, replaces wp-sitemap.xml.
• Pauses when Yoast SEO, Rank Math, All in One SEO, SEOPress, The SEO Framework or Slim SEO is active.

Redirects & 404

New in 1.2.0.

• The 404 log lists every missing address, most visited first, with where visitors came from.
• Click “Redirect” next to an address, enter the new one and save. Types: 301 (permanent), 302 and 307 (temporary) and 410 (gone for good).
• Wildcards: /blog/* → /news/* moves a whole section at once.
• Every redirect has a hit counter, matching is case-insensitive and redirect loops are prevented.
• Hacker-bot probes (.php, .env, wp-admin…) are not logged, so the list stays useful.

Site monitor

• Hourly checks: home page response, database, disk space, SSL expiry, PHP version and memory, updates, fatal errors, cron, uploads folder, search engine visibility and debug output.
• Emails you when a problem appears and when it is resolved.
• Dashboard widget with status and history.
• 24/7 outside monitoring: a private heartbeat address answers TMEDIA-OK for HetrixTools, StatusCake or UptimeRobot.
• Optional: show UptimeRobot uptime in WordPress with an API key.

Duplicate

New in 1.2.0.

• A “Duplicate” link next to every post, page and other content type, in the admin bar and in Bulk actions.
• The copy keeps text, featured image, categories, tags, custom fields and page builder layouts.
• Copies are always saved as drafts, so nothing goes live until you publish it.

Contact buttons

New in 1.2.0.

• Call, WhatsApp, Viber, Telegram and email buttons. Switch on only the ones you use.
• On phones: a sticky bar at the bottom of the screen (Call · WhatsApp · Viber). On computers: a round button that opens a small contact card.
• Optional: a first WhatsApp message, your colour, left or right corner and pages where the buttons are hidden.
• Working hours: outside them show an offline note, hide only the Call button or hide everything.
• While the cookie notice is open, the button moves above it.
• Viber links open the Viber app: on phones that always works, on computers when Viber Desktop is installed.

Cookie notice

• An Accept button, an optional Decline button and a link to your privacy policy.
• Bottom bar or corner box, dark or light theme and your button colour.
• Remembers each visitor’s choice and works with page caching.
• For developers: read the choice with tmedia_cookie_consent() in PHP or the tmedia:consent event in JavaScript.
• The notice does not block analytics or advertising scripts by itself.

Popups

• New in 1.2.0: settings are split into four tabs (Age, Announcement, Coupon, Newsletter), and the On/Off badge on each shows what is active.
• Age verification (e.g. 18+) with “Yes, enter” and “No, leave” buttons. The visitor only confirms their age; it is not a legal identity check.
• Announcement for news, opening hours or a new product.
• Discount coupon with a Copy button and an end date after which it is no longer shown.
• Newsletter with a required consent checkbox and an optional reward coupon. Subscribers are stored in your WordPress database, listed in the plugin and exported as CSV. Export the list before deleting the plugin, because uninstalling removes it.
• Show after a few seconds, after scrolling or when the visitor is about to leave. Choose pages, devices and how often a popup may return.
• Only one marketing popup per page view. You can preview every popup from the admin.

Seasonal effects

New in 1.2.0.

• Christmas: falling snow and a twinkling string of lights. New Year: fireworks and confetti. Easter: painted eggs. Halloween: bats and autumn leaves. Valentine’s Day: hearts.
• Automatic mode follows the calendar, with Orthodox or Western dates for Christmas and Easter. You can also run one theme manually.
• Change the dates of every holiday, e.g. keep the New Year fireworks running until 7 January.
• Optional greeting ribbon (“Happy holidays from our team!”) that visitors can close.
• The script loads only while a holiday is active, draws on a single canvas, pauses in background tabs, uses fewer particles on phones, never blocks clicks and respects “reduce motion”. No images to download.

Troubleshooting

Visitors still see the old site after I turned on Under Construction. Purge your CDN cache (e.g. Cloudflare). The plugin purges the most common caching plugins automatically.

The monitor’s “Home page” check is a warning. Some hosts block a server from loading its own pages. Use the heartbeat address with an outside service instead.

I locked myself out with Login protection. Wait for the block to end (20 minutes by default), or log in from another network, e.g. your phone’s mobile data, and click Unblock on the Login protection page. Add your IP to the allow-list.

Is the cookie notice enough for GDPR? It shows the notice and records the visitor’s choice. Full compliance also means not loading tracking scripts before consent, which depends on your other plugins and settings. We are not lawyers; check your obligations for your country.

Will the seasonal effects slow my site down? No noticeable impact: the script loads only while a holiday is active, draws on a single canvas and pauses when the tab is hidden.

Can’t find an answer? Write to us.