Apaxon Core
Free · Available nowThe plugin every other Apaxon plugin runs on. Free, and it stays free.
A suite of six plugins usually means six settings screens, six ways of storing an API key, and six chances to get one of them wrong. Core does each of those once — so everything built on it inherits the result, and you configure it all in one place.
- No account required
- GPLv2 or later
- No visitor tracking
The Core dashboard, reporting one finding it will not fix for you
Why it exists
Four things a plugin suite should only do once.
Six plugins usually means six settings screens that behave six ways.One settings screen
Every Apaxon plugin registers its settings with Core, so they look the same, live in the same place, and are sanitised by the same code. A module never writes its own form.
Most plugins gate everything behind “manage_options” — full admin.Delegate a job, not the site
Core adds its own capabilities, so a receptionist can manage bookings without becoming an administrator who can install plugins and edit users.
API keys and SMTP passwords usually sit in the database in plain text.Secrets encrypted before storage
Sealed with libsodium, keyed from your own site’s salts. It does not save a site that is already compromised — it means a stolen database or a stray backup is no longer a set of working credentials.
Security plugins tend to shout, then sell you the fix.Checks that tell you the answer
Licence, scheduled tasks, PHP, HTTPS, the file editor. Each finding names the change to make — “add DISALLOW_FILE_EDIT to wp-config.php” — rather than a button that does something unspecified.
Site health
Core reports. It does not quietly change your site.
The checks are read-only, deliberately. A free plugin that hardens a site on its own can break it in ways nobody asked for — a redirect that stops working, a REST route some other plugin needed. So Core names the finding and the change to make, and leaves the decision with you.
It also grades honestly. The dashboard above says Fair and 80% on a site with one outstanding recommendation. A tool that always says “Good” is a tool you stop reading.
- LicenceWhether this site can reach us, and when it last did
- Scheduled tasksWP-Cron silently not running is invisible until it matters
- PHP versionWhether yours still receives security fixes
- HTTPSWhether passwords and keys travel in plain text
- Plugin and theme editorThe route from a stolen admin account to running PHP
What's in it
All of it, free.
Licence handling for everything
One key covers every Apaxon product you own, permanently. Buy a second plugin and the entitlement appears on the next check — there is no second key and no activation step.
Connected sources
Core reads the plugins you already run, starting with WPForms, so an Apaxon plugin can use that data without asking you to replace anything.
An activity log that admits failure
Including the licence checks that did not work. A log that only records successes is a log nobody can debug with.
Diagnostics you can paste into a ticket
WordPress, PHP, database, memory limit, whether libsodium is available. No licence key, no passwords, no stored secrets — because an export ends up in an email thread.
Scheduled work, wrapped
Core uses Action Scheduler where it exists and WP-Cron where it does not, so no Apaxon plugin ships its own queue engine to get subtly wrong.
Events between plugins
Modules announce what happened rather than calling each other. Commerce works the same whether or not CRM is installed, and neither has to know the other exists.
Requirements
- Version
- 0.13.3
- Requires WordPress
- 6.5 or newer
- Requires PHP
- 8.1 or newer
- Licence
- GPLv2 or later
- Multisite
- Supported
- Price
- Free, permanently
- Visitor tracking
- None
Questions
Do I need a licence key?
No. Settings, permissions, site health, diagnostics and the activity log all work without one, and nothing in Core is held back pending payment. A key is only needed by the paid plugins you buy.
What does Core send to Apaxon?
Nothing at all until you enter a licence key. After that: the key, your site address, and version numbers — so we can validate the licence and warn you about vulnerabilities affecting your setup. Never anything about your visitors.
Does Core update my plugins?
No. WordPress.org does not allow directory plugins to carry their own updater, so update delivery lives in the paid plugins instead. Core handles the licence; each paid plugin checks for and verifies its own releases.
Will it slow my site down?
Core does no work on front-end page loads. Settings are stored non-autoloaded, licence checks run on a schedule rather than per request, and the admin stylesheet loads only on Apaxon screens.
What happens if I deactivate it?
Apaxon plugins that depend on it stop until it is reactivated. Nothing is deleted. Uninstalling removes Core’s own settings and scheduled tasks and leaves every other plugin’s data untouched.
Is it really GPL?
GPLv2 or later, like WordPress itself. You can use, modify and redistribute it. A subscription buys support and the platform around the code, not permission to run it.
Ready to power your WordPress website the smart way?
Start with Apaxon Core — free, GPL, and with nothing to cancel. Add the plugins you need when you need them.