User Meta Inspector on Profile Screens
Shows administrators a read-only table of every stored user meta value at the bottom of user profile screens, with session tokens and other secrets masked.
Opens WPIDE on
Code
// Meta keys whose values are never shown.
$wpide_masked_meta = array( 'session_tokens', '_application_passwords', 'wp_user-settings', 'default_password_nag' );
$wpide_user_meta_table = function ( $user ) use ( $wpide_masked_meta ) {
if ( ! current_user_can( 'manage_options' ) ) {
return;
}
$meta = get_user_meta( $user->ID );
ksort( $meta );
echo '<h2>User meta</h2><table class="widefat striped" style="table-layout:fixed;max-width:1000px"><thead><tr><th style="width:30%">Key</th><th>Value</th></tr></thead><tbody>';
foreach ( $meta as $key => $values ) {
$masked = in_array( $key, $wpide_masked_meta, true ) || false !== stripos( $key, 'token' ) || false !== stripos( $key, 'secret' ) || false !== stripos( $key, 'pass' );
foreach ( $values as $value ) {
$display = $masked ? '(hidden)' : ( is_serialized( $value ) ? print_r( maybe_unserialize( $value ), true ) : $value );
printf( '<tr><td><code>%s</code></td><td><code style="white-space:pre-wrap;word-break:break-all">%s</code></td></tr>', esc_html( $key ), esc_html( mb_strimwidth( (string) $display, 0, 400, '...' ) ) );
}
}
echo '</tbody></table>';
};
add_action( 'show_user_profile', $wpide_user_meta_table, 99 );
add_action( 'edit_user_profile', $wpide_user_meta_table, 99 );
Notes
Add other sensitive keys to $wpide_masked_meta to keep them hidden.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.