Bani Honar Toolkit

Bani Honar Toolkit is a small, modular plugin. Every feature is a module that you can switch on or off from one dashboard, and developers can add their own modules.

Included modules

• Link Shortener – turn long addresses into short links on your own domain, for example banihonar.com/Ab33.
  • Random codes made of lowercase letters, uppercase letters and numbers. You choose the length, from 1 to 32 characters.
  • Or type your own custom code. Codes are case-sensitive: Ab and ab are different links.
  • Click counter and last-click time for every link, search, edit and delete.
  • Redirect type (302, 307 or 301) and an optional path prefix such as /go/.
  • A short link never hides a real page of your site. It only works when WordPress finds nothing else at that address.
• QR Code Generator – turn a link or any text into a QR code and download it as PNG or SVG.
  • Choose the size, error-correction level, border and colors. Persian text works too.
  • Pick one of your short links, or press the QR button next to a link in the Link Shortener list.
  • The code is created in your browser. Nothing is uploaded to an outside service or stored.
• Visitor Stats (off by default) – see every visit to your website: how many, where from, from which IP address and country, and on which device.
  • Overview with a chart, totals (page views, visitors, visits, online now) and lists of countries, sources, device types, phone and tablet models, operating systems, browsers, campaigns and most viewed pages.
  • Sources are recognised: direct, search engines, social networks and messengers (Instagram, Telegram, Eitaa, Rubika, Bale and more), other websites and utm_ campaigns.
  • Device details: brand and model (for example Samsung Galaxy A54 5G), system and version, browser and version, screen size, language and time zone. Chrome on Android hides the phone model from websites, so it is read through Client Hints; an iPhone model cannot be read by any website, so its family is shown.
  • Visit log with search, filters (click any value to filter by it), details for every visit, and CSV download that opens correctly in Excel.
  • Words visitors typed into the search box of your website, and the member (name and e-mail) behind a visit when the visitor is logged in to your site.
  • Block an IP address or an IPv4 range for an hour, a day, a week, a month or until you remove it. Your own address and logged-in administrators are never blocked.
  • Persian (Jalali) or Gregorian dates, a retention period, and a list of IP addresses that are never counted.
  • Works with page-caching plugins and sets no cookies. Your own visits are not counted while you are logged in as an administrator.
• Post Duplicator – copy any post, page or custom content with one click, and edit a live page safely.
  • “Duplicate” under every title in the lists, in the bulk actions menu, in the admin bar and in a box in the editor. The copy is a draft.
  • Copies the content, excerpt, featured image, categories, tags and other taxonomies (in their saved order), custom fields, page template and post format. Comments, sub-pages (up to 100 posts), password, address, date, author and status are optional.
  • Safe with page builders: backslashes in blocks and Elementor data are kept exactly, edit locks and page-builder caches are not copied, and copying does not put a page in the translation group of Polylang.
  • Edit safely: for a page that is already live, work on a hidden draft while visitors keep seeing the live page, then press “Publish into the live page”. The address, date, status, author and comments of the live page stay, and its old text is saved as a revision. If the live page was changed after the draft was made, you are asked before anything is overwritten.
  • A title pattern with {title}, {n} and {date}, a choice of who may duplicate, the content types it works for, and lists of custom fields and taxonomies that are never copied. Its own tab with a switch that turns it fully on or off.
  • Nobody can copy what they are not allowed to read; people who may not publish get “pending review” copies. WooCommerce products and orders are left to WooCommerce, because they keep data in extra tables.
• Page Shield (off by default) – makes casual copying of your pages harder. It has its own tab with a switch that turns it fully on or off. Every option is off until you tick it, and none of them has any effect on search engines.
  • Blocks the right-click menu (it still works in text fields), F12, Ctrl+U, Ctrl+S and Ctrl+Shift+I / J / C, and dragging images out of the page.
  • Hides WordPress version details from the page head.
  • Can also protect logged-in administrators (off by default, so you can inspect your own site).
  • These are deterrents, not a lock: a browser must receive a page’s HTML, CSS and JavaScript, so a determined person can always read them. Your PHP code never reaches the browser. The Elementor editor is not affected, and search engines see exactly the same page as everyone else. Options that could lower your search ranking, such as blocking text selection or covering the page, are deliberately not offered.
• Contact the IT team – a tab where you can send a suggestion, criticism, a problem report, a security report or a request for a new module to it@banihonarpars.ir. Nothing is sent by your website: each card opens Gmail in a new tab, or the e-mail program of your computer, with a ready subject and text, and has a button that copies the whole message so you can send it from any e-mail service. A problem report adds only the versions of the toolkit, WordPress and PHP, the language and the list of active modules.
• Profile Pictures – every user uploads a profile picture from the WordPress profile screen. No Gravatar account is needed, and nothing is requested from Gravatar.
  • JPG, PNG, GIF and WebP, up to 2 MB. Pictures are cropped to a small square automatically.

Two languages, one switch

The plugin screens can be shown in Persian (RTL) or English (LTR), whatever your site language is. Change it under Bani Honar Toolkit > Settings.

For developers

Extend BHTK_Module and register your module on the bhtk_register_modules action. It gets a dashboard card, an on/off switch and its own section on the Settings screen.

add_action( 'bhtk_register_modules', function ( $plugin ) { $plugin->register_module( new My_Module() ); } );

Use the bhtk_capability filter to change the capability needed to use the toolkit (default: manage_options).

Third-party code

The QR Code Generator uses the MIT-licensed “QR Code Generator for JavaScript” by Kazuhiko Arase (version 2.0.4), included in assets/js/vendor/. QR Code is a registered trademark of DENSO WAVE INCORPORATED.

Privacy and external services

The Post Duplicator stores no personal data. It marks copies and safe-edit drafts with four small custom fields (_bhtk_clone_of, _bhtk_fork_of, _bhtk_open_fork, _bhtk_fork_time) that hold post numbers and a time; they are removed when you delete all toolkit data.

The link shortener stores, for each link: the code, the destination, an optional note, the click count, the time of the last click, who created it and when. Visitors are not identified or logged by it.

The Visitor Stats module is off by default. While it is on, one small request is sent from the visitor’s browser to your own website for every page opened (at most 600 views a minute are recorded for the whole site; developers can change this with the bhtk_visits_max_per_minute filter), and your site stores: the date and time, the IP address (or the address with its last part removed, if you choose so), the country, the page address and title, the referring website, campaign tags (utm_), the browser’s User-Agent text and the device details derived from it, screen size, language and time zone. A random session code lives in the browser’s sessionStorage; no cookies are set. Visits older than the retention period you choose (365 days by default) are deleted automatically, and you can delete everything or download it at any time. An IP address can be personal data in some countries: if your visitors are protected by such a law, mention the counting in your privacy policy.

A visit from a logged-in member also stores that member’s user id; the name and e-mail address are read from the WordPress user when you open the details. Words typed into the search box of your website (?s=) are stored with the visit. Visitor Stats never reads or stores a computer name, a file path or an e-mail address from the visitor’s device: browsers do not allow websites to read them.

The country is read from your CDN or server first (Cloudflare, ArvanCloud, CloudFront and others) and from earlier visits of the same address. The option “Find the country online when the server does not know it” is off by default. Only when you switch it on, and only when the country cannot be read in another way, the visitor IP address is sent to an outside lookup service. See the section “External services” below for what is sent, to whom, and the terms and privacy policy of each service. Without that option no address leaves your server. Nothing else is sent to outside services.

The toolkit adds suggested text to the privacy policy guide (Settings > Privacy), and connects Visitor Stats to the WordPress tools Tools > Export Personal Data and Tools > Erase Personal Data: visits of a member are found by e-mail address. When a user account is deleted, the visits of that user stay as anonymous statistics.

The Contact tab sends nothing from your website; it only opens the e-mail program of the person who presses a button.

فارسی

افزونه چندمنظوره، ماژولار و قابل توسعه برای وردپرس. آمار کامل بازدید وب‌سایت (چند بازدید، از کجا، با چه آدرس IP و از کدام کشور، با چه دستگاه و چه مدلی)، کوتاه‌کننده‌ی لینک با دامنه‌ی خودتان، ساخت کیو آر کد برای لینک و متن، محافظ صفحه با تب و کلید روشن/خاموش جداگانه، تکثیر نوشته و برگه با یک کلیک و «ویرایش امن» صفحه‌های زنده از راه پیش‌نویس پنهان، آپلود مستقیم تصویر پروفایل بدون گراواتار، و رابط فارسی/انگلیسی که از تنظیمات خود افزونه عوض می‌شود.

External services

Bani Honar Toolkit can connect to one kind of outside service, and only if you switch it on: an IP-address-to-country lookup used by the Visitor Stats module. The Link Shortener, QR Code Generator, Post Duplicator, Page Shield and Profile Pictures modules never contact an outside service: QR codes are drawn in the browser and profile pictures are stored on your own site.

IP-address-to-country lookup (Visitor Stats, optional, off by default)

• What it is and what it is for: a free web service that tells which country an IP address belongs to. It is used only to fill in the country of a visit when your CDN or server did not provide it and the address was not already known from an earlier visit.
• When it runs: only after an administrator ticks “Find the country online when the server does not know it” under Bani Honar Toolkit > Visitor Stats > Settings. Then one request is made for a visit from a public IP address whose country is unknown, and an hourly background task retries up to 20 recent addresses whose country is still unknown. If a service fails, lookups pause for ten minutes.
• What is sent: the visitor’s IP address (inside the request address) and the plugin name and version in the User-Agent header, for example BaniHonarToolkit/1.0.0. Like any web request, the service also sees your server’s IP address. No page address, cookie, name, e-mail or other visitor detail is sent. If you also tick “Hide the last part of every IP address”, your site saves only the shortened address, but the full address is still used for that single lookup and is not stored.
• What comes back: a two-letter country code, which is saved with the visit.
• Which service: you choose it in the settings. “Automatic” tries ipwho.is first and then GeoJS.

Services used:

• ipwho.is (free endpoint of the IPWhois API, https://ipwho.is/{ip}): Terms of Service and Privacy Policy.
• GeoJS (https://get.geojs.io/v1/ip/country/{ip}.json): Terms of Service and Privacy Policy.

If you do not want any address to leave your server, leave the option off, or answer from a local database with the bhtk_geo_lookup filter, which skips the online services. If you use the option, mention it in your own privacy policy; the plugin adds suggested text to Settings > Privacy.

Links that open another website only when you click them (for example “Write in Gmail” on the Contact us tab, or the Google Search Console link in Visitor Stats) are ordinary links; the plugin itself sends nothing to those sites.