OikoFree WP plugins
5 plugins live — Guard · Sessions · Boost · Fields · Forms

Secure by design.
Always simple.
Always free.

Oiko builds free WordPress plugins that do one job well — and do it securely by default. One standard, no upsells, nothing phoning home.

From the team behind WP HealthKit and BuiltByGo.

£0every plugin, every feature0trackers, ads or upsellsPHP 8.3+· WP 6.7+ baseline100%open source
The plugins

Five jobs, done properly.

Each Oiko plugin does one thing, ships from the same audited boilerplate, and is free on WordPress.org — no pro tier, no nags.

Login security

Oiko Guard

Login hardening and two-factor auth in one lean plugin — replacing the three or four most sites stitch together.

  • Brute-force lockout plus TOTP 2FA, with one-time recovery codes
  • Turnstile or reCAPTCHA — and a honeypot that filters bots first
  • XML-RPC and user-enumeration closed; optional custom login URL
  • Login audit log, session control, new-device alerts
Access control

Oiko Sessions

See who holds a session, end the ones that shouldn't — and flip a site-wide lockdown when you need it.

  • Force logout — one user, selected users, a whole role, or everyone
  • Last-login and online columns, sortable on the users list
  • Access lockdown switch with a persistent admin banner
  • Presence in its own indexed table — no drag on busy sites
Performance

Oiko Boost

The full Perfmatters-style toolkit — script manager, lazy load, speculative loading — free, and built to run beside your cache.

  • Per-page script & style manager, straight from the admin bar
  • Lazy load and delayed JS, aware of Save-Data and slow connections
  • Local fonts, bloat removal, database cleanup, speculative loading
  • Real-visitor data drives preloads; BFCache and CrUX reporting built in
Custom fields

Oiko Fields

The free ACF and Meta Box alternative — 19 field types, options pages and conditional logic, none of it behind a paid tier.

  • 19 field types, including repeaters and nested groups
  • Options pages and conditional logic — paid extras elsewhere, free here
  • ACF-compatible template API — get_field(), have_rows(), the_row()
  • Field-group JSON export/import, GDPR export & erasure built in
Form builder

Oiko Forms

A real drag-and-drop form builder, secure by default — entries, spam defenses and GDPR tools, none of it behind a paid tier.

  • Real drag-and-drop canvas — nine field types, no shortcode-guessing
  • Entries stored with CSV export, hardened file uploads
  • Honeypot, time-trap and rate-limiting always on — Turnstile optional
  • GDPR consent capture, personal-data export and erasure built in