Destino Access Audit

Destino Access Audit adds a single admin page (Tools → Destino Access Audit) that centralizes the answer to one question: who, and what, currently has access to this site?

The page is read-only audit information except for one deliberate action — revoking an Application Password — which delegates entirely to WordPress core’s own API. Destino Access Audit never creates, modifies, or stores any remote-management connection itself.

What it shows

• Application Passwords — every active Application Password on the site (all users), with creation date, last used date, last IP, and a one-click Revoke button (AJAX, no page reload) plus a CSV export.
• Administrator Users — a plain list of every user with the administrator role, with a direct link to edit each one. Useful for spotting an admin account you don’t recognize.
• UpdraftPlus / UpdraftCentral — whether UpdraftPlus is installed/active, a direct link to its settings screen, whether it is connected to an UpdraftCentral dashboard (including which WordPress user made that connection), and whether UpdraftPlus’s own password-protected “Lock Settings” feature is currently hiding that screen.
• MainWP Child — whether MainWP Child is installed/active, a direct link to its settings screen, whether it is paired with a MainWP Dashboard, and which WordPress user established that pairing.
• ManageWP Worker — installed/active status. ManageWP Worker pairs with its dashboard through an OpenSSL key exchange with no locally readable “connected” flag, so this block documents that limitation instead of guessing.
• InfiniteWP Client — installed/active status, with the same honest limitation note as ManageWP Worker.

Security notes

• Every write action (revoking a key) is protected by a nonce, a manage_options capability check, and a second capability check (edit_user) specific to the user who owns the key.
• The CSV export is generated server-side and neutralizes fields that could be interpreted as spreadsheet formulas (CSV/Excel formula injection).
• The dashboard itself requires the manage_options capability to view.