About this plugin
Keel adds a menu of sensible defaults to any WordPress install, each one a switch under Settings → Site Defaults . Nothing is hidden and nothing is all-or-nothing — you can see exactly what the plugin does to your site and turn any switch on or off. See and install the security patch for your own WordPress release line. Keel tells you when WordPress.org flags the installed core version as insecure, names the patched release on the same line instead of pushing you toward a major upgrade, shows the releases WordPress is offering and marks the one core would select. An authorized administrator can deliberately install the same-line patch through WordPress’s own upgrader with rollback enabled. The target is checked again on the server; no setting changes, and nothing installs unless you click the button. Disabling something means it is actually disabled. When you switch comments off, they are off below the presentation layer, not merely hidden by the theme template and the REST route — ask the database directly with get_comments() and there is nothing to hand back. The same care runs through the rest: closing the REST API also removes the link advertising it, and disabling comments also stops the comment feed from answering requests. Site Health shows you the whole posture , read-only: every default and its current state on one screen, so you can see what the site is actually doing without clicking through tabs. It also reports when another plugin is controlling the same settings, which otherwise fails silently. Outgoing email stops at the edge of production. An unsanitized database copied down from production carries real customer addresses and whatever mail service production was using, so a cron run or a bulk action can email real people from a staging site or a laptop. Keel suppresses outgoing mail on any environment that is not production by default. It does nothing on production, and Keel says so in an admin notice so no admin is left wondering why a password reset never arrived. Keel works the same on a Multisite network. Activated across multisite, Keel seeds every existing site and every site created afterwards, so a later change to a default cannot apply to some sites and not others. A Super Admin can see and change any setting for the whole network under Network Admin → Settings → Network Policy. Sub-sites on the network see those settings as locked, with their own saved values untouched underneath, so lifting a policy returns each site to exactly what it had. External services When the Require strong passwords default is enabled, Keel screens new passwords against the Have I Been Pwned Pwned Passwords range API ( https://api.pwnedpasswords.com ) to reject passwords found in known breaches. This uses k-anonymity: only the first five characters of the password’s SHA-1 hash are ever sent — never the password, and never the full hash. No personal data is transmitted. The check runs only when a password is being set or changed and the default is on. It can be disabled with define( 'KEEL_DISABLE_HIBP', true ); in wp-config.php , with the keel_disable_hibp filter, or by turning off the strong-password default. If the API is unreachable, or answers with a truncated or malformed response, the check is skipped and the password is allowed — a breach-data outage never blocks a password change. It is not skipped silently: the failure is recorded and reported under Site Health, so a site whose screening has stopped working can tell. Only the kind of failure and when it happened are stored — never the password, and never the hash prefix. Have I Been Pwned is operated by Troy Hunt; see https://haveibeenpwned.com/Privacy and https://haveibeenpwned.com/API/v3 for its terms and privacy policy. Keel also asks WordPress.org whether the installed version of WordPress has known vulnerabilities, using the core stable-check API ( https://api.wordpress.org/core/stable-check/1.0/ ). This is WordPress.org’s own service, on the same host core already contacts for updates and translations; core itself never queries it. The request carries no site data beyond the user-agent, which identifies the plugin and the site’s home URL in the same way core’s own update requests identify the site. The response maps the WordPress releases it lists to their current status; Keel keeps it for a day. If WordPress.org is unreachable or answers with something unusable, the failure is remembered for five minutes so an outage does not add a network wait to every admin screen, and Site Health reports that the status could not be determined rather than implying the site is fine. WordPress.org’s privacy policy is at https://wordpress.org/about/privacy/. Recommended wp-config.php hardening A few defences live best in wp-config.php , outside any plugin: they apply before plugins load and cannot be switched off from the dashboard. These are optional and independent of Keel — add the ones that fit your site. define( 'DISALLOW_FILE_EDIT', true ); — removes the built-in plugin and theme code editors, so a compromised admin account or foolhardy admin cannot edit PHP from the dashboard. define( 'WP_POST_REVISIONS', 10 ); — caps stored post revisions so the database does not grow without bound. Keel's **Post Revision Retention** control can govern the same policy after plugins load; a numeric or false constant remains the higher-level operator choice and locks that control. define( 'AUTOSAVE_INTERVAL', 120 ); — lengthens the editor autosave interval. This is independent of Keel's Heartbeat throttle: both influence how often the editor saves in the background, but neither replaces or overrides the other.<h3>Credits</h3> Austin Ginder of Anchor Hosting ( anchor.host · @anchorhost ) reviewed Keel for security, and the plugin is better for it. Thank you, Austin. Keel is a de-branded evolution of Better by Default, the WordPress defaults plugin by WPYEG (a teaching version for the Edmonton WordPress meetup): https://github.com/WPYEG/Better-by-Default Better by Default is published under the GPL-3.0-or-later; its sole author, who also wrote Keel (@dknauss), additionally licenses the portions carried over here under the GPL-2.0-or-later. Keel keeps Better by Default’s core architecture — a single schema array that drives both the settings screen and the bootstrap, where each default is one array entry plus one hook — and adds further hardening and admin defaults adapted from the Pixel Managed Platform plugin (GPL-2.0-or-later). The Pixel version is itself a hard fork of the 10up Experience plugin by 10up (GPL-2.0-or-later): https://github.com/10up/10up-experience — so several of Keel’s adapted defaults ultimately descend from code first written for 10up Experience. Copyright in that work is retained by 10up and its contributors, and 10up retains its marks; Keel is not affiliated with or endorsed by 10up. See LICENSE for the full GPL-2.0 text. Support This Plugin Keel is free and will stay free. If it saves you an afternoon of hardening a new site, or keeps a staging server from emailing your client’s customers, you can support its maintenance through GitHub Sponsors . Bug reports and feature requests are welcome on the issue tracker: https://github.com/dknauss/keel/issues . If you have found a security problem, please report it privately rather than in a public issue — SECURITY.md ships with the plugin and says how.