Custom WordPress plugins and internal tools

WordPress plugin

2024 – Present

HTTP Security Header is a WordPress.org plugin by Mohit Goyal in PHP that adds CSP, HSTS and security headers from a settings screen, now at 1,000+ installs. It exists so that site owners can pass a security header scan without editing server configuration they are rightly afraid to touch. Most WordPress sites fail security header scans. The fix is well known, but adding headers means editing .htaccess or the server config. Site owners will not touch that, and many agencies would rather not be responsible for it. The result is that sites stay exposed to clickjacking, content sniffing and cross-site scripting that a few response headers would mitigate. I wrote this plugin so that anyone can turn on the important headers from Settings > Security Headers, with sensible defaults and validation, and without a trip into the hosting panel. The plugin covers Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, X-Permitted-Cross-Domain-Policies and Feature-Policy. Each header has its own settings with defaults that are safe to switch on, and the values are validated before they are saved. The part I care most about is the fallbacks. A bad Content-Security-Policy or a mistyped frame option cannot lock an admin out of their own site, because the plugin falls back to a working value rather than serving a header that breaks the dashboard. I published it to WordPress.org in November 2024 and have shipped updates through version 3.1. It is built in PHP for WordPress 5.0 and above. It sends headers from WordPress itself rather than from the web server, which makes it portable across Apache, Nginx and managed hosts where the owner has no config access. The settings screen uses the standard WordPress settings API, so it behaves like core and is easy to audit. Around the plugin I wrote a 15-article explainer series covering each header in turn. The series doubles as documentation and as the content that brings people to the plugin. I also built a companion online scanner on inspiredmonks.com that grades a site from A+ to F, so an owner can see the problem before installing the fix. At the time of writing the plugin reports more than 1,000 active installs, about 6,900 downloads and a 5 out of 5 rating on WordPress.org. Site owners who could never have edited a server file can now pass a header audit in a few minutes. Agencies I work with install it as a standard part of a build. The lesson from maintaining it has been that safe defaults and fallbacks matter more than coverage. A plugin that cannot break a site gets left switched on. Need a WordPress plugin built or hardened for your own site or product? Send me the requirements and I will reply with a plan.

E-commerce

2025

WooCommerce online ordering for Whitfield Service Station in Dover, built by Mohit Goyal with a custom delivery radius plugin and cloud receipt printing. Three food brands on one forecourt now sell online for delivery and collection, and every order prints automatically in the kitchen. Whitfield Service Station is a forecourt in Dover that runs a Budgens store, a Fireaway pizza outlet and a doner and gyros kitchen. The owner wanted all three selling online without three separate systems. The catch was operational. Delivery had to stop at a sensible radius, fees had to reflect distance, orders had to reach the kitchen without staff watching a screen, and the store needed to switch ordering off when it closed. I built it on WordPress with Bricks Builder and WooCommerce. The shop has a three-brand landing with cards, per-brand category pages with a vertical category sidebar, a Budgens offers grid, combos, a My Account dashboard and a login and signup popup. Checkout is a multi-step Fluid Checkout with Stripe, Apple Pay and Google Pay. After the May 2025 feedback round I made the homepage e-commerce first, with dynamic featured, promotion and bestseller sections and brand cards with real product photography and Order Now buttons. I also audited the Fireaway and doner catalogues against their Just Eat menus. My custom Delivery Restriction Checker plugin geocodes the customer's address with the Google Maps API, hides delivery beyond 10 miles, charges a distance-based fee and falls back to pickup or dine-in. The delivery fee later became a flat fee, and cash on delivery was disabled. WooCommerce Product Add-Ons handle toppings and variations. A CSV import template with tutorial videos lets staff manage the menu. An 18+ confirmation covers alcohol and vapes, an opening-hours popup and WhatsApp float sit on the front end, and the owner can close the store or set hours from the admin. Food hygiene ratings and GDPR, privacy and terms pages round it out. The point-of-sale link is the piece that makes it work day to day. Orders print automatically to an Epson receipt printer through PrintNode, with order alerts in the WooCommerce mobile app, so the kitchen never has to check a dashboard. Writing the delivery logic as my own plugin rather than configuring a shipping extension was deliberate. The geocoding, radius and fee rules were specific enough that a bespoke plugin was smaller and easier to change than a general product, as the later switch to a flat fee showed. Bricks keeps the theme light, WP Rocket handles caching, and All in One SEO covers search. A W3C validation and performance report closed phase one in August 2025, with staff documentation covering price changes, reports, reprinting receipts, cancelling orders and hours. The platform is live at whitfieldservicestation.co.uk. The three outlets take online orders through one checkout, and staff manage the menu and the printer without a developer. The project confirmed that in food ordering the printer integration is the feature that decides whether the system gets used. Planning a similar online ordering store for a takeaway or forecourt? Send me your next project and I will reply with a plan.

WordPress plugin

2025 – Present

Geo Targeting for Bricks Builder is a WordPress.org plugin by Mohit Goyal that shows or hides Bricks elements by visitor country, resolved via IPinfo Lite. I published it in November 2025 and maintain it alongside my HTTP Security Header plugin. It is currently at version 1.5.1 and tested up to WordPress 6.9. Bricks Builder has a conditions system but no way to vary content by location. Agencies serving several countries were duplicating pages: one for each region, with the same layout and different prices, phone numbers or offers. That is slow to build and worse to maintain. The goal was a country condition that any Bricks element could carry, with the lookup done in a way that did not flash the wrong content first or store anything about the visitor. The plugin adds a country condition to any Bricks element. Site owners add their IPinfo token in the plugin settings, then pick countries to include or exclude on an element: pricing in the right currency, local phone numbers, region-specific offers. The lookup runs on the server through IPinfo Lite, so there is no client-side flicker and no personal data stored. I wrote the companion guide on getting an IPinfo API token, so a site owner can go from install to a working condition without leaving the documentation. The stack is PHP and WordPress, built against the Bricks Builder conditions API and the IPinfo REST API, and distributed through WordPress.org. Resolving the country on the server was the central decision. A client-side lookup would render the default content first and swap it after the request returned, which is visible to the visitor and bad for layout stability. Doing it in PHP before the page renders avoids that. Nothing is written to the database, so the plugin has no personal data to protect. It requires WordPress 6.0 or later and PHP 7.4 or later. The plugin is young and has a small install base; no usage metrics beyond that are measured. Bricks site owners can now keep one page per layout and let the country condition decide what each visitor sees, with no duplicate pages to keep in sync. It is live on WordPress.org at wordpress.org/plugins/geo-targeting-for-bricks-builder. Need a Bricks Builder or WordPress plugin built for a gap in your workflow? Send me the idea and I will reply with a plan.