Locking Piklist

Being a framework, it is important that Piklist not be deactivated by accident. In most cases, Piklist is providing core functionality to a website, and deactivating it would remove that functionality possibly rendering the site useless.

Kevin and I have gone back and forth on this quite a bit. The mu-plugins folder was an option, but we just didn’t think it was the right one. If installed in mu-plugins, Piklist could not take advantage of automatic upgrades, and if a user really wanted to disable Piklist, it would not be that easy.  Even the WordPress MU Domain Mapping plugin, which is core to any site running it, specifies using Network Activation over mu-plugins in it’s installation instructions.

A few weeks ago in our support Forums, @kattagami, mentioned that Piklist did not even work correctly in mu-plugins. At this point, Kevin and I needed to make a decision. Do we support mu-plugins, or figure out another way to lock down Piklist?

Then last week, in the same forum thread, @emzo reminded us of a post Mark Jaquith wrote when he built “Have Baby. Need Stuff!”. In this post, Mark shared some code to stop plugins from being deactivated. Though Marks code was designed for the mu-plugins folder, it gave us an idea (and some rock solid code), on how to implement something similar for Piklist. So here’s what we got:

On the Piklist settings page there is an option for Piklist Deactivation.

You have two choices:

  1. Allow Deactivation
  2. Lock

If you select, “Allow Deactivation”, nothing changes.  Piklist can be deactivated like any other plugin.

However, if you select “Lock”, then two things happen.  First, Piklist is locked down and cannot be deactivated, thanks to the WordPress filter option_active_plugins. Second, Piklist replaces it’s own “Deactivate” link, with a link to it’s “Settings” page. If the user clicks on this link, they are brought to the Piklist settings page where they are warned about deactivating Piklist. There are also instructions on how to deactivate if they wish.

Piklist LOCKED: Deactivation link has been replaced with a Settings link.


Piklist Deactivation Warning, and Instructions.


A site Administrator should have complete control over their site. However, pressing a Deactivate link is way too easy, and with Piklist it can cause havoc.  This new setting makes deactivating Piklist a four-click process, instead of one.  The Administrator can deactivate Pikist if they choose, but they are presented with a warning first.

We’re not sure this is the best solution, and would love your feedback.  This setting is in Piklist v0.7.0 and does not yet work for Network Activation. Let us know what you think in the comments.

The setting to deactivate Piklist is no longer included. If you cannot deactivate Piklist it is because:

  1. You have a plugin that is activated and relies on Piklist.
  2. Your theme has a /piklist/ folder.

Deactivate your plugin, or change themes to allow Piklist to be deactivated.

12 thoughts on “Locking Piklist

  1. Tim says:

    elegant solution :)

    1. Steve says:

      Awesome! Glad you like.

  2. As long as it’s an option (and not default behaviour), I like it.

    1. Steve says:

      Then you like it. ;)

  3. Metrey says:

    Yes, Lock feature is required… we need to use it for WP MU so a solution require for that.

  4. I definitely like this option. :)

    Contratulations, GREAT Job!

    A question: are you going to make a paid version? I’d like to have looooots of other fields (like Google Web Fonts selection, sliders, date/time, etc).

    1. Steve says:

      We’re glad you like the locking feature. Can you be more specific in the types of fields you would like to see?

  5. Leonard says:

    What I’d like to see with Piklist is the ability to have it run from your theme folder rather then as a plugin. This would help negate the issue of accidental de-activation.

    To elaborate a little, as Piklist is required by the theme it makes far more sense (to me) when developing a theme to keep it as part of the theme package and ensure it’s always to hand. I tried to add Piklist to my theme this way and use functions.php to call it and though installs, as it uses plugins_url() to set certain paths it’s breaking the CSS/JS/IMG requests. Beyond that it may work just fine but I’ve not investigated this further.

    Without the ability to use it in the theme I’m a bit more hesitant to commit Piklist to my standard process.

  6. hddolginoff says:

    Wordfence is warning me that my piklist/readme.txt file has been modified from the original and is advising me to uninstall/reinstall piklist. My Version is Piklist appears to be locked on the installed plugins page and the only option available to me on the settings page is to allow users to be assigned multiple roles. How do I uninstall piklist so that I can reinstall it? Or, more appropriately, how do I remedy this problem. Thank you.

    1. Steve says:

      @hddolginoff– If Piklist is locked, it means you have an active plugin or theme that is using Piklist. Deactivate any plugins that are using Piklist, or change your theme. The “deactivate” link should appear.

      Let us know if you still have the notice with WordFence after you reinstall.

  7. Darien says:

    I would like to deactivate Piklist from my WordPress account. It is currently locked (I was never given an option, it was installed and was immediately locked). The instructions above will not work because when I go to the Piklist settings page in WordPress there is no option to “Allow Deacativation” or “Lock.” The only option in the Settings page is to allow multiple user roles. There are no options for anything else at all. Please advise.

    1. Steve says:

      I added an update to the bottom of this post to explain what to do. Let us know if you still need help.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>