URL Change Lockdown

Freezes existing post and taxonomy slugs unless explicitly unlocked.

Tested up to: 7.0 Stable tag: 2.0.3 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html

What It Does

Preserves established public WordPress routes and provides an explicit, audited migration workflow for necessary corrections.

This is a small WordPress maintenance plugin built for a specific operational problem. It stays focused so the behavior is easy to understand, verify, and keep enabled.

Example: "Protect this site from the maintenance issue this plugin handles." - Install the plugin, verify the expected behavior, and let it keep doing that one job.

The Real Workflow

In practice, the useful path is simple:

1. install and activate the plugin
2. let it establish Canonical Route Contracts for public content
3. audit contracts against observed WordPress routes
4. use preview plus explicit URL Migration only when a public URL must change

The human's job is to decide whether the behavior fits the site. The plugin's job is to apply that behavior consistently.

Why This Feels Different

Most small WordPress maintenance problems get handled manually or with broad plugins that do more than needed.

This plugin is different because it keeps a narrow scope:

• one clear purpose
• predictable behavior
• normal WordPress installation and update flow
• public source and release history

That changes the experience from:

• Remember to handle this manually every time

to:

• Install the focused plugin and verify the result

Before vs After

Before

• the issue depends on manual attention
• behavior can drift between maintenance runs
• fixes are easy to forget when work is repetitive

After

• the site has a focused plugin for the job
• behavior is consistent between maintenance runs
• releases and source are easy to inspect

Who It Is For

This is a good fit for:

• WordPress site owners with the specific maintenance problem this plugin solves
• agencies maintaining many WordPress sites
• operators who prefer focused plugins over broad toolkits
• teams that want public source and release notes before installing a plugin

Documentation

Start with the public plugin page:

• Plugin Page

Start Here

If you are new to the plugin, use this order:

1. Read the plugin page
2. Download the latest release
3. Install it on WordPress
4. Verify the expected behavior
5. Keep it active if the behavior matches the site

Behavior

• Freezes established post/page slugs and page hierarchy on every ordinary update path
• Freezes established taxonomy slugs and hierarchy
• Locks permalink structure, category base and tag base against ordinary changes
• Applies the same invariant to wp-admin, REST, MCP, imports, WP-CLI and plugin writes
• Exposes route audit, migration preview and explicit confirmed migration abilities
• Creates permanent Rank Math redirects, verifies results and records bounded audit evidence
• Does not lock links inside post content
• Does not lock post meta values
• Supports temporary allow constants when you intentionally need to rename slugs

Changelog

2.0.3

• Added fail-closed migration finalization so route-specific adapters can remove self-redirect conflicts or force a full rollback.

2.0.2

• Fixed Rank Math redirect creation to use its required active status and exact-source structure while retaining rollback on failure.

2.0.1

• Added explicit dangerous-action confirmation fields to the post and taxonomy migration schemas for strict MCP compatibility.

2.0.0

• Added Canonical Route Contracts and stable public routes across every ordinary writer.
• Added hierarchy and global permalink-driver protection.
• Added audited, confirmation-gated post/page and taxonomy URL migrations with descendant previews, permanent redirects and rollback.
• Removed automatic wp-admin and constant-based bypasses.

1.4.3

• Fixed manual editing: authorized wp-admin/editor requests can now intentionally change post and term slugs
• Programmatic writes without a verified admin/editor context remain locked unless explicitly allowed

1.4.2

• Docs: expanded the WordPress-standard readme.txt so the published ZIP now includes fuller behavior, installation, use-case, and Devenia link sections

1.4.1

• Clarified behavior: existing slugs are frozen across update paths unless explicitly unlocked
• Moved slug guards to late filter priority to prevent downstream filter overrides
• Documentation now explicitly states that post-content URLs are not locked

1.4.0

• Scope clarified and enforced as slug-only protection
• Removed content URL, metadata URL, and option/permalink guards
• Keeps post and taxonomy slug locks in place for programmatic updates

1.3.0

• Hardened lock scope to deny URL mutations by default across content, meta/custom fields, term URL drivers, and URL settings
• Removed REST/header-based manual allowance from the URL lock path to prevent API bypasses
• Kept non-URL content edits allowed to preserve URL-only scope

1.2.0

• Hardened REST/manual detection by requiring a wp-admin referer in addition to REST nonce
• Added URL-diff locking for post_content and post_excerpt to block programmatic link changes

1.1.2

• Readme tag cleanup (WordPress.org limit)

1.1.1

• Allow manual bulk edits via wp-admin without triggering URL locks

1.1.0

• Block programmatic changes to slugs, parent pages, taxonomies, and permalink settings

1.0.0

• Initial release

Contributing

PRs welcome. Keep changes focused on the plugin's stated WordPress maintenance behavior.

License

GPL-2.0+

Author

Devenia - We've been doing SEO and web development since 1993.

Links

• Plugin Page
• GitHub Releases
• Devenia Plugins

Star and Share

If this plugin helps solve a real WordPress maintenance problem, please:

• star the repo
• share it with people running WordPress sites
• point them to the plugin page so they can see what it does

Why do it?

Because practical WordPress maintenance tools are better when they are easy to find, easy to understand, and easy to verify before use.