Seven plugins shipping · PHP 8, WordPress 6.0+ · GPL-2.0-or-later

The WordPress essentials, without the bloat.

Speed, privacy compliance, lead capture, search visibility, social proof, sign-in and analytics — eight focused, self-hosted plugins built to the same rules. No upsells, no third-party data sharing, no phone-home.

Get WP Chest See what’s inside

WordPress core APIs only. No third-party PHP libraries, and every plugin uninstalls cleanly.

8

plugins in the bundle

0

database queries on a cache hit

0

cookies in analytics

0

third-party PHP libraries

Statistics dashboard STATISTICS

Visitors, sessions, pageviews, bounce rate and views per session, with period-over-period comparison and top pages and referrers.

1 / 7

The core idea

Eight plugins written to one set of rules.

The usual all-in-one suites arrive with a dashboard takeover, a nag banner and a data-sharing agreement. WP Chest covers the same ground with focused plugins that each do one job, share a house style, and leave nothing behind when removed.

The usual all-in-one suite

Eight hundred files, a premium upsell on every screen, and analytics that route through someone else’s servers.

Uninstall it and the tables stay behind.

WP Chest

WordPress core APIs only, namespaced options and tables, per-plugin menu, capability-gated.

Nothing is sent anywhere you didn’t configure yourself, and every plugin ships an uninstall.php.

Four situations it was built for

Agencies, freelancers and site owners who maintain WordPress for other people.

Standardising a client fleet

The same stack on every site you maintain, so a support call means one set of admin screens you already know.

A privacy review

GDPR, Quebec Law 25 or CCPA in scope, and a consent log plus cookieless analytics you can point at.

A slow site

Pages served from disk before WordPress boots, with a diagnostics tab that tells you whether it’s actually working.

Leads into a CRM

A contact form whose fields map onto real CRM fields, with a consent checkbox that governs opt-in.

The bundle

Eight plugins, grouped by the job they do

Speed and compliance

The two every site needs first

WP Chest Cache

v1.0.0

Stores fully rendered pages on disk and serves them to logged-out visitors, so WordPress never rebuilds the page on a hit.

Drop-in mode serves a hit before WordPress and the database load — zero database queries
Falls back to self-contained plugin mode automatically, and tells you why
Smart auto-purge on edit: the page plus home, its archives and feeds
gzip variants, tracking-parameter stripping, and a diagnostics tab

WP Chest Consent

v1.0.2

A compliant, themeable cookie banner plus the machinery behind it — granular consent, script blocking and an audit log.

Opt-in for GDPR, PIPEDA and Quebec Law 25; opt-out for CCPA/CPRA, VCDPA and CPA
Global Privacy Control honoured automatically; Geo-auto model falls back to the safer opt-in
Google Consent Mode v2 signals, auto-blocking of recognised trackers, manual script tagging
Audit log with consent version, model, region and anonymised IP — exportable to CSV

WP Chest Security

PLANNED

The one plugin still to build: hardening a WordPress instance, reporting on the surface the other plugins already reduce.

Disable XML-RPC, or allowlist methods
Rename the login URL and 404 the originals
Login lockout with an audit log, and configurable security headers
A hardening scorecard, mirroring the Cache plugin’s diagnostics tab

Capture and convert

Leads, visibility and social proof

WP Chest Forms

v1.2.0

A drag-and-drop form builder written from scratch — no jQuery UI, no third-party JS — that maps submitted fields onto your CRM.

Ten field types including a Consent checkbox with a configurable policy link that drives CRM opt-in
CRM connectors fetch your contact lists, so you pick the target list from a dropdown
Email via the WordPress mailer, SendGrid, Brevo or Microsoft 365 through Graph
Five built-in themes, a custom-theme cloner, or inherit — no plugin CSS at all

WP Chest SEO

v1.0.0

The SEO essentials with none of the bloat — roughly eight files instead of eight hundred.

Per-post SEO title, meta description, keywords and a custom slug, de-duplicated on collision
XML sitemap at /sitemap.xml with configurable post types, changefreq and priority
Virtual robots.txt with the sitemap directive appended automatically
Rewrite rules flushed on activation, so the sitemap URL works immediately

WP Chest SocialFeed

v1.0.0

Facebook and Instagram feeds by shortcode. The distinguishing design decision: your Meta app secret never touches WordPress.

A .NET broker API holds the app credentials and brokers every OAuth and Graph call
One central Meta app can therefore serve any number of customer sites
Grid, masonry, carousel or list, with responsive column counts and an on-site lightbox
Posts degrade to plain links with JavaScript disabled

Sign in and measure

Identity, and traffic you can read

WP Chest SSO

v1.2.0

OAuth2 and OpenID Connect single sign-on: Authorization Code flow with PKCE, state, nonce and RS256 ID-token validation against the provider’s JWKS.

Google, Microsoft Entra ID or Custom OIDC presets, several providers side by side
SSO-only mode, with two escape hatches so nobody locks themselves out
Identities linked by issuer and subject, so logins survive an email change at the IdP
Client secrets can be kept out of the database entirely, in wp-config.php

WP Chest Statistics

v1.0.0

Self-hosted, cookieless analytics. All data stays in your own WordPress database and nothing is sent to third parties.

No cookies and no localStorage; the visitor id is a daily-rotating salted hash, unlinkable across days
Geolocation is offline, from bundled datasets — no third-party lookup calls
Dashboard, city-level map, real-time view, conversion goals, UTM and outbound-link tracking
CSV exports, printable PDF reports and scheduled email summaries

Shared house rules

EVERY PLUGIN

The bundle is consistent because every plugin is held to the same constraints, not because they share a framework.

WordPress core APIs only — wp_remote_*, $wpdb, Settings API, REST API, cron
Namespaced options and tables, a per-plugin admin menu, capability-gated
Clean uninstall via uninstall.php; deactivation never destroys data
PHP 8, WordPress 6.0 or later, GPL-2.0-or-later

Self-hosted

Nothing phones home

Every plugin runs on your own server, against your own database. Nothing is sent anywhere you didn’t configure yourself — and where an external service is involved, you own the credentials.

Analytics stay in your database

Cookieless, with offline geolocation and configurable retention.

Your Meta secret never enters WordPress

The broker API holds it, so the plugin only ever talks to your broker.

Secrets can stay out of the database

SSO client secrets can be defined in wp-config.php instead.

Clean uninstall, every time

uninstall.php on all of them; deactivation never destroys data.

One bundle, one price

Eight plugins together rather than eight separate purchases, with no premium tier held back inside each one.

Placeholder pricing and licence terms — confirm before publishing.

Single site

$79 one site

The whole bundle on one WordPress install. Every plugin, every feature, no premium tier inside.

Get WP Chest

FOR AGENCIES

Unlimited sites

$249 all your sites

The same bundle across every site you build or maintain — the case the bundle exists for.

Buy the bundle

GPL-2.0-or-later, self-hosted, no phone-home.

Plugin	Version	In the bundle
WP Chest Cache — full-page disk cache	1.0.0	Yes
WP Chest Consent — GDPR, Law 25, CCPA	1.0.2	Yes
WP Chest Forms — builder + CRM connectors	1.2.0	Yes
WP Chest SEO — meta, sitemap, robots.txt	1.0.0	Yes
WP Chest SocialFeed — Facebook & Instagram	1.0.0	Yes
WP Chest SSO — OAuth2 / OIDC with PKCE	1.2.0	Yes
WP Chest Statistics — cookieless analytics	1.0.0	Yes
WP Chest Security — hardening	—	Planned

Install what you need

Each plugin is independent. Take the two you want now and add the rest later.

GPL, self-hosted

GPL-2.0-or-later, running on your own server against your own database.

Leaving is easy

Every plugin ships an uninstall.php, so removal leaves no tables or options behind.

Questions prospects actually ask

Do I have to install all eight?

No. Each plugin is independent, with its own admin menu, namespaced options and tables. Install the ones you need and add the rest whenever you like.

Is anything sent to your servers?

No. There is no phone-home in any plugin — nothing is sent anywhere you didn’t configure yourself. Analytics stay in your own WordPress database, and geolocation runs offline from bundled datasets.

What happens when I uninstall?

Every plugin ships an uninstall.php that removes its own options and tables. Deactivation never destroys data, so switching a plugin off is always safe.

Will the cache plugin break my site?

Drop-in mode adds an advanced-cache.php file and one WP_CACHE line to wp-config.php, and removes both cleanly when you switch modes or deactivate. If it can’t install those safely it falls back to self-contained plugin mode automatically and tells you why. Logged-in users always bypass the cache, by design.

Does the social feed need my Meta app secret in WordPress?

Never. A .NET broker API holds your Meta credentials and brokers every OAuth and Graph call; the WordPress plugin talks only to the broker. That means one central Meta app can serve any number of customer sites.

If I turn on SSO-only mode, can I lock myself out?

There are two escape hatches. wp-login.php?local=1 always shows the local password form, and defining OIDC_SSO_DISABLE in wp-config.php renders the plugin inert without touching the database. Setting OIDC_SSO_BYPASS_KEY locks the hatch behind a key when you want that surface closed.

Is the Security plugin available?

Not yet — seven of the eight are built and shipping. Security is the one still to come, and the roadmap board is where its scope is being voted on.

Open the chest

Everything a WordPress site needs, on your own server.

Get WP Chest See pricing