Skip to content
Merlin Tools

WordPress tools

Code and configuration generators for people who work with WordPress: salts, wp-config, .htaccess, Custom Post Types, security snippets and more. All in your browser, no data sent.

WordPress vulnerability (wp2shell)

The only one that doesn't generate code but analyses: checks whether your WordPress is exposed to known vulnerabilities.

Salts generator

The eight secret keys for wp-config.php, generated in your browser.

wp-config.php generator

WordPress' configuration file, filled in from your details.

.htaccess generator

Permalinks, HTTPS and security rules for Apache.

robots.txt generator

What to let crawlers see, without blocking what matters.

functions.php snippets

The most common tweaks, ready to paste.

Custom Post Type generator

A full register_post_type, without writing it from memory.

Taxonomy generator

A ready register_taxonomy, linked to your post type.

Shortcode generator

The add_shortcode skeleton, with or without attributes.

WP_Query builder

A query and its loop, built from the fields.

Nav menus generator

register_nav_menus from the locations you list.

add_image_size generator

Custom image sizes, registered correctly.

Plugin header generator

The block WordPress reads to recognise the plugin.

Theme header generator

The opening block of style.css that defines the theme.

Hardening snippets

Close the most-abused doors, with a tick.

REST endpoint generator

register_rest_route with permissions, ready to use.

Maintenance mode snippet

Close the site to visitors, keep admins in.

URL migration (search-replace)

The right WP-CLI command to change domain, without breaking serialized data.

Custom login URL

Hide wp-login.php from the bots that scan for it by default.

WP-CLI backup script

Database + wp-content, ready for cron.

.gitignore + composer.json for WP

Composer-managed WP repo, ready in one shot.