← Products / Free plugins

17 pluginsFree to download · by MHRMasum

Free WordPress plugins that do one job well.

These are the plugins I built for my own sites and my clients’ sites, and you can download every one of them for free. Each one has a clean admin screen with tabs, help text on the settings, and capability and nonce checks on every admin action.

Browse the 17 plugins ↓See paid plugins
17 plugins, free to downloadNo license key neededSettings export and import in most plugins“Delete data on uninstall” is off by defaultDark mode in every admin screen
How the download works
  1. 1
    Pick a pluginClick “Get it free” on its card.
  2. 2
    Enter your name and emailTick the box so we can email you the link.
  3. 3
    DownloadThe link is shown right away and also sent to your email. It works for 7 days.
  4. 4
    InstallPlugins → Add New → Upload Plugin, choose the zip, activate.

Free forever. No license key, no trial, nothing locks later.

Forms & leads 3

MHR CF7 Simple Math Captcha

v1.4.2

A simple math question that stops spam bots on Contact Form 7, including old CF7 versions on old PHP.

  • Adds a [mhr_mathcaptcha] form tag (and a required [mhr_mathcaptcha*]) with a tag generator in the CF7 form editor.
  • Each question is signed, expires (1 to 72 hours, default 12) and works for one sent message only. The answer is never put in a hidden field.
  • Can fetch a fresh question on page load, so it keeps working on cached pages, and after each successful send.
2 more features
  • Overview with blocked, passed and replay counters, a live preview of the field, and a log of the last 50 blocked submissions with masked IPs.
  • Set the label, placeholder, error message, sizes and colours. Export, import and reset settings.

Best for: sites on older hosting or old Contact Form 7 versions (it works with CF7 3.3) that need a light captcha without Google or other outside services.

Requires: Contact Form 7. PHP 5.6 or newer. WordPress 4.1 or newer.

⚠ Careful — read before installing

The question is plain text in the page, so it stops generic spam bots, not a bot written for your site. For forms that get heavy spam, add a honeypot or a hosted captcha as well.

Free

MHR Gravity Forms Math Captcha

v1.4.2

A light math captcha field for Gravity Forms, with no PHP sessions and no outside service.

  • Adds a Math Captcha field under Gravity Forms > Advanced Fields, with addition, subtraction and multiplication and easy, medium or hard difficulty.
  • The hidden token holds only a signature, not the answer. Each solved question works once, and its lifetime is 1 to 72 hours (default 6).
  • Optional New Question button, and a fresh question on each form load, which keeps cached pages working.
2 more features
  • Overview lists every form that uses the captcha, with counters and a log of the last 50 blocked submissions.
  • Custom title, subtitle and validation messages. Captcha answers are not saved in your entries.

Best for: Gravity Forms sites that want a simple spam check without reCAPTCHA.

Requires: Gravity Forms. WordPress 5.8+, PHP 7.4+.

⚠ Careful — read before installing

Do not put Conditional Logic on the captcha field, because a hidden field is skipped by Gravity Forms validation. Like any math captcha, it stops generic bots, not targeted ones.

Free

CF7 Database Leads

v1.2.2

Saves every Contact Form 7 enquiry in your WordPress database, so no lead is lost when an email goes missing.

  • Works as soon as it is active: each submission is stored with its fields, date, form name, page and (optional) IP. Email delivery is not changed.
  • Leads screen with totals, filters by form, status and date, search, and a detail view with Reply by email.
  • Unread count on the admin menu. Mark leads read or unread.
2 more features
  • Download all, selected or filtered leads as CSV (opens correctly in Excel, including accents and Bangla).
  • Trash with restore, optional auto-delete after N days, and WordPress Export / Erase Personal Data support.

Best for: small businesses and agencies who want a copy of every CF7 enquiry inside WordPress.

Requires: Contact Form 7. WordPress 5.8+, PHP 7.4+.

⚠ Careful — read before installing

Leads are personal data. Say in your privacy policy how long you keep them. IPs are stored by default (you can turn this off), and leads are kept forever unless you set the auto-delete days.

Free

Content & SEO 6

MHR Table of Contents

v1.4.2

An automatic table of contents built from your headings, with a floating side TOC and reading progress.

  • Auto insert with many positions (before the first heading, top, bottom, after a chosen paragraph or line count), or use [mhr_toc] / [toc].
  • Inline, floating, or both. Nested or flat, numbered or bullets, collapsible, H1 to H6 control and a minimum heading count.
  • Five design presets (Premium, Minimal, Boxed, Gradient, Dark) and an accent colour.
2 more features
  • Active heading highlight, reading progress bar, smooth scroll with sticky-header offset, back-to-top links and copyable heading links.
  • Per-post disable and custom title. Readable heading IDs for Bangla and other non-Latin text. Optional TOC structured data (off by default).

Best for: blogs and long guides where readers need to jump between sections.

Requires: WordPress 5.8+, PHP 7.4+ (uses the mbstring PHP extension).

⚠ Careful — read before installing

Auto insert is on for posts and pages after activation, so check one post first. [toc] is also used by the "Table of Contents Plus" plugin; if both are active, use [mhr_toc].

Free

SEO Friendly Tables Pro

v1.5.2

Responsive tables with clean semantic HTML, and a one-step move from TablePress.

  • Import a TablePress CSV ZIP export (each CSV becomes a table, up to 500 files of 10 MB each) or single CSV files.
  • Spreadsheet-style editor with rich text, drag-and-drop rows and columns, and an unsaved-changes bar.
  • Semantic output: caption, header row and header column with scope, and mobile data labels with a card layout on phones.
2 more features
  • Optional front-end search, sorting (keyboard too), sticky header and three styles. Shortcodes [seo_table id="1"] and [sft_table id="1"].
  • CSV export per table, full JSON backup of all tables, and a 30-day trash that restores the same ID, so shortcodes keep working.

Best for: comparison tables, price lists and spec tables, and anyone leaving TablePress.

Requires: WordPress 5.8+, PHP 7.4+.

⚠ Careful — read before installing

The optional JSON-LD ItemList does not make a table eligible for a Google rich result; turn it off if you do not need it. "Apply these settings to all existing tables" overwrites each table's own design settings and has no undo.

Free

MHR Website Content Exporter DOC TXT

v1.2.2

Crawl a public website and get all its visible text in Word or TXT files, grouped by content type.

  • Exports DOC, TXT, a DOC + TXT ZIP, and DOCX (when the PHP ZipArchive extension is present).
  • Sections: page index, titles and meta descriptions, headings, paragraphs, lists, tables, links, image alt text, full visible text and skipped URLs.
  • Same-domain crawl, robots.txt respected by default, request delay and page limit. Can start from the XML sitemap and skip URLs that contain words you set.
2 more features
  • Stop and resume a scan. CSV page index for SEO audits: title and meta lengths, canonical, H1, word counts, links, images and missing alt.
  • It never creates or changes content on your site; it only makes files to download.

Best for: content audits, redesign planning and saving a client's copy before a rebuild.

Requires: WordPress 5.8+, PHP 7.4+.

⚠ Careful — read before installing

It sees only what a logged-out visitor sees, so drafts and private pages are not included. It cannot crawl sites on private or local addresses (except the site it is installed on). On Nginx servers, add a deny rule for uploads/mhr-content-exporter/ if your scans are sensitive.

Free

AI Format Cleaner PRO

v1.5.2

Clean ChatGPT-style formatting out of your WordPress drafts: assistant phrases, Markdown leftovers and robotic patterns.

  • Removes assistant phrases and Markdown leftovers (## headings, **bold**, - bullets) and turns them into real headings, bold text and lists.
  • Shows a 0 to 100 AI-formatting risk score per post, with what it found.
  • Preview changes side by side before cleaning, and Undo last clean afterwards.
2 more features
  • Content Editor for pasted drafts, Quick Clean by post ID, optional clean-on-save and a front-end filter.
  • Leaves links, images, block markup, shortcodes and code alone. No API key, nothing is sent outside your site.

Best for: writers and SEOs who draft with ChatGPT or other AI tools and publish in WordPress.

Requires: WordPress 5.9+, PHP 7.4+.

⚠ Careful — read before installing

It is a formatting cleaner, not an AI detector, and it does not rewrite your text. There is no bulk clean: posts are cleaned one at a time. Use Preview first.

Free

MHR Global Translator

v3.0.0

Your site in any of 100+ languages with the Google Translate website widget. Pick the languages in Settings, no API key.

  • Choose the site language and any of the 100+ languages the Google widget offers from a searchable list, or add the popular ones in one click.
  • Five switcher styles: a premium globe button with a searchable language card (a bottom sheet on phones), a dropdown, flags with names, a code pill and text links. Use it as a floating button, a theme menu item or the [mhr_lang_switcher] shortcode.
  • A one-time invitation in the visitor's own language when their browser language is one of yours, or optional automatic translation on the first visit.
2 more features
  • ?lang=fr links for ads and emails, /es/ and /fr/ links switch the page, and the visitor's choice is remembered as they browse.
  • Never translate list for brand names and CSS selectors, a per-page language setting, and Google's script loads only after a visitor picks another language.

Best for: sites with visitors who speak other languages and need a quick, good-looking switcher, not a full multilingual setup. Formerly MHR Spanish Translator: updating keeps your settings.

Requires: WordPress 5.8+, PHP 7.4+.

⚠ Careful — read before installing

Translation happens in the visitor's browser, so translated pages are not indexed by Google, and content inside third-party iframes is not translated. Visitors who choose another language load a script from translate.google.com (mention it in your cookie policy).

Free

Speed 1

MHR Simple Safe Cache

v1.1.2

Safe headers and light WordPress cleanup for sites that already have server-level cache.

  • Security headers (including HSTS on HTTPS and X-Frame-Options: SAMEORIGIN) and a short public cache header only on pages that are safe to cache for logged-out visitors.
  • Removes extra head tags, emoji scripts and the wp-embed script.
  • Optional .htaccess rules for static file browser cache, GZIP and Brotli where supported. .htaccess is backed up before every change and can be restored with one click.
2 more features
  • Live header check shows what visitors receive (Cache-Control, Expires, compression, security and CDN headers).
  • No CSS/JS combining, delayed JavaScript or remove-unused-CSS, on purpose.

Best for: sites on hosts with Nginx or Apache server cache that only need safe extras, not a second cache plugin.

Requires: WordPress 5.8+.

⚠ Careful — read before installing

It is not a page cache. The .htaccess rules work on Apache and LiteSpeed only (Nginx ignores them). If your site must be shown inside a frame on another domain, X-Frame-Options will block it. Images get a one-year cache, so a replaced image with the same file name may stay old for returning visitors. Do not run it with another full cache plugin.

Free

Security & access 3

MHR Secure Cleanup

v1.8.3

Hide your login page, block brute-force attacks and auto-delete spam comment leftovers.

  • Moves wp-login and wp-admin to a secret URL (default /mhr-secure-login/, you can change it). Others get a 404, a 403 or a redirect.
  • IP whitelist with IPv4, IPv6 and CIDR, an optional strict admin lock, and trusted devices you can revoke.
  • Brute-force lockout (default: 8 failures in 15 minutes gives a 30-minute ban), rate limit on the secret login, and a login honeypot.
2 more features
  • XML-RPC off, and guest REST writes blocked with an allow-list that keeps Contact Form 7 and WooCommerce checkout working.
  • Daily cleanup of pending and trashed comments (optionally spam, revisions, expired transients and table optimise), with a preview of what will be deleted.

Best for: small sites that get login attacks and comment spam and want one simple plugin for both.

Requires: WordPress 5.8+, PHP 7.4+.

⚠ Careful — read before installing

Your login moves to the secret URL as soon as you activate it, so bookmark it and copy the emergency bypass URL. The comment cleanup is on by default and deletes pending and trashed comments older than 7 days permanently. Check both settings right after activation. Hiding the login is not a replacement for strong passwords. Deleting the plugin removes all of its data.

Free

WP Site Pass Access

v1.3.2

Put your whole site behind a branded password screen for client previews, launches or maintenance.

  • Multiple passwords with labels and expiry dates, and private links with a label and a duration of 1 to 365 days. Delete or revoke each one.
  • IP whitelist, public page and path exclusions, and a bypass for chosen logged-in roles.
  • Branded access screen (logo, background, colours, custom CSS) with an admin preview. HTTP status 200, 401 or 503 with Retry-After.
2 more features
  • Lockout after failed tries (default 5 in 15 minutes), access logs with CSV export, and Sign out all visitors.
  • Keeps WooCommerce payment callbacks and webhooks working, and blocks the REST API, logged-out AJAX and XML-RPC for visitors while the site is private. Search engines get noindex.

Best for: agencies showing a site to a client before launch, and private or members-only sites.

Requires: WordPress 5.8+, PHP 7.4+.

⚠ Careful — read before installing

Protection is off after activation until you turn it on. Files in /wp-content/uploads stay reachable by direct URL. If your site is behind Cloudflare, set "Read visitor IP from" to Cloudflare. If a payment gateway uses admin-ajax as a logged-out visitor, add its action under "Allowed AJAX actions".

Free

MHR Staging Gate

v1.3.2

Show visitors a 'this is a staging site' page, while you and your client see the real site.

  • Branded staging page with your badge, headline, message and a link to the live site.
  • Admins and chosen roles (default: administrator and editor) see the real site. Others get in with a preview password or a secret link with a copy button.
  • Blocks indexing and sitemaps, the REST API, logged-out admin-ajax (with an allow-list) and XML-RPC while the gate is on.
2 more features
  • Access log of unlocks, secret-link visits, wrong passwords and lockouts (6 tries per 15 minutes). Settings export never includes the password or secret link.
  • Reset staging site tool to wipe the staging copy after the project goes live, with a dry-run count and a typed DELETE confirmation.

Best for: developers and agencies with a staging copy of a client site.

Requires: WordPress 5.7+, PHP 7.4+.

⚠ Careful — read before installing

For staging sites only. The gate is on as soon as you activate it. Change the live-site link and the text in Settings > Staging Gate. Files in uploads are served by the web server and are not gated. The reset tool deletes the staging site's content; lock it with MHR_STAGING_RESET_LOCK in wp-config.php if you never need it.

Free

Site tools 4

MHR Code Snippet Manager Pro

v1.2.2

Add PHP, CSS and JS snippets and header/footer scripts, with protection that switches off a snippet that breaks your site.

  • PHP, CSS and JS snippets with hook and priority, for front end, admin or both, in a syntax-highlighting editor.
  • Conditions: logged in or out, user roles, device, post IDs, post types, WooCommerce pages, and URL contains / excludes.
  • A real PHP syntax check before saving, auto-disable of a snippet that causes a fatal error, and a private emergency safe-mode URL.
2 more features
  • Risk scanner that flags functions such as eval, shell_exec, base64_decode and request data used without a nonce check.
  • Import from Code Snippets, WPCode, Insert Headers and Footers and Simple Custom CSS (imported disabled for review). JSON import/export, 10 automatic backups, trash, duplicate, activity and error logs.

Best for: site owners and developers who add small code changes without editing the theme.

Requires: WordPress 5.8+, PHP 7.4+.

⚠ Careful — read before installing

PHP snippets run real code with admin rights, so only add code you understand. Keep the emergency safe-mode URL private and regenerate it if it leaks. Page, post-type and WooCommerce conditions do not work on early hooks such as init or plugins_loaded.

Free

WP Search & Replace Pro Safe

v1.1.2

Search and replace text across your WordPress content, with a preview first and an undo after.

  • Scopes: posts, pages and custom post types, post meta, taxonomy text, SEO plugin tables of this site, and options you name.
  • Safe with serialized data, including serialized data inside serialized data, and with page-builder JSON.
  • Regex, whole-word and case-sensitive matching. Plain mode treats $1 and \1 as normal text.
2 more features
  • Preview with a before/after view, which can be required before every run, plus an 'I have a current backup' check and a typed REPLACE confirmation.
  • Run history of the last 25 runs and Undo last run.

Best for: domain moves, HTTP to HTTPS changes, and fixing a repeated phrase or link across many posts.

Requires: WordPress 6.0+, PHP 7.4+.

⚠ Careful — read before installing

Take a full database backup first. Undo restores the earlier field values and overwrites edits made after the run; runs larger than 3 MB or 5,000 fields cannot be undone. On very large sites one run can hit PHP time or memory limits. To match URLs inside JSON, search for the escaped form (https:\/\/old.com).

Free

MHR WP Reset & Cleanup Manager

v1.2.2

Reset or clean a WordPress site in a few clicks, with a database snapshot before every run.

  • Presets: Content Only, Blog Posts Only, Pages Only, Media Only, Database Cleanup, Full Clean Reset. Preview counts shows exactly what each tool will touch.
  • Database cleanup: revisions, auto drafts, trashed posts, spam and trashed comments, transients, orphaned meta, and table optimise.
  • WooCommerce cleanup (products, orders, coupons, sessions, transients), plugin and theme cleanup, customizer reset, and delete users with content reassignment.
2 more features
  • Database snapshots with download, restore, a keep-at-most-N setting and a safety snapshot before each restore. Snapshot files get random names in a protected folder.
  • Typed confirmations (RESET SITE, RESTORE, DELETE) and a full history log.

Best for: developers and agencies resetting staging or demo sites, and owners cleaning an old database.

Requires: WordPress 5.8+, PHP 7.4+.

⚠ Careful — read before installing

Reset tools delete data permanently. A snapshot covers the database only; deleted media files and plugin or theme folders cannot be brought back from it, so take a full hosting backup first. With WooCommerce HPOS on, "Delete Orders" does not remove orders stored in the HPOS tables. Plugin and theme deletion is off on multisite.

Free

MHR Delete Unused Images

v1.7.2

Find images you no longer use and move them to Trash, with a live re-check before anything is removed.

  • Checks post content, post meta, options, user and term meta, comments, image sizes, featured images, WooCommerce galleries, the site icon and logo, gallery shortcodes and page-builder ID lists.
  • Can also search the tables of slider and builder plugins (on by default).
  • Dry-run report per image with the reason an image is protected, and CSV export of candidates.
2 more features
  • Re-checks each image right before Trash and before permanent delete; permanent delete only works on images this plugin trashed (type DELETE).
  • Trash tab with restore and the days left before WordPress empties Trash, saved exclude keywords, and an activity log.

Best for: sites with a large media library full of old uploads.

Requires: WordPress 5.8+, PHP 7.4+. WordPress Trash must be enabled.

⚠ Careful — read before installing

Images used only in theme or plugin files, CSS or outside services cannot be found in the database, so add exclude keywords for theme images. Review the list and keep a backup before deleting. WordPress empties Trash after 30 days by default, and that deletes the files too.

Free
FAQ

Questions about the free plugins

Straight answers from how the plugins actually work.

Are these plugins really free?

Yes. You download them for free, there is no license key, and no feature locks after a trial.

Why do I need to enter my email?

So the download link can be sent to you as well as shown on the page. The link works for 7 days.

How do I get updates?

Updates show in your WordPress Dashboard → Updates like any other plugin, and you update with one click. Your settings are kept. We also email you when a new version is out, unless you unsubscribe. Plugins downloaded before 25 October 2026 need one manual update first: download again here and upload it over the old one.

Some names say “Pro”. Is there a paid version?

No. SEO Friendly Tables Pro, MHR Code Snippet Manager Pro, WP Search & Replace Pro Safe and MHR WP External Link Pro were paid before and are now free with all their features. The names are kept so existing users recognise them.

What happens to my data if I delete a plugin?

Most plugins keep their settings when you delete them, unless you turn on “Delete data on uninstall” in that plugin’s settings (off by default). Three work differently: MHR Secure Cleanup always removes all its data, MHR Staging Gate removes its own settings and log, and MHR Simple Safe Cache always removes its .htaccess block.

Need more?

Paid plugins with a 7-day free trial.

SEO reporting, page cache, content audits, image optimization and backups — every paid plugin has a free trial and free staging sites.

See all products →