You decide what changes on this site.<\/p>\n\n
Adminkeep is a set of tools under that one idea. Site Lock<\/strong> stops things changing behind\nyour back \u2014 no new comment, no new plugin, no new user. Content<\/strong> makes the changes you do want\nsafe to make.<\/p>\n\n Every feature is a single switch, off until you turn it on. Switching one off never leaves you\nrepair work<\/strong>: the locks work purely through WordPress filters, so your site is exactly as it was,\nand what you made with the Content features stays where you put it.<\/p>\n\n A feature you have not enabled registers zero hooks and loads zero assets.<\/p>\n\n Everything on the Adminkeep settings screen, plus the Custom CSS and SMTP screens, can be done from a shell with Run Or with WP-CLI:<\/p>\n\n Not unless you ask it to. Turning Disable Comments on only hides them \u2014 a test asserts the comment\nrows are untouched after a full enable-and-disable cycle.<\/p>\n\n There is a separate cleanup button that does delete, and it deletes spam and trashed comments\nonly<\/strong> unless you tick the box to include approved ones. It shows the exact count, asks you to\nconfirm, and cannot be undone.<\/p><\/dd>\n Yes, instantly. There is never a migration to run or a repair step to find.<\/p>\n\n The locks work purely through WordPress filters, so nothing was written to your database to undo \u2014\nswitch one off and your site is exactly as it was. The Content features are deliberately different:\nthey write the things you asked them to write. A copy you made, an order you saved, a file you\nreplaced, a redirect recorded when you renamed a page \u2014 switching the feature off stops it doing\nany more, and leaves what it already did alone. Work you did on purpose should not disappear\nbecause you unticked a checkbox.<\/p><\/dd>\n Yes. Bots usually POST straight to Not exactly, and it would be dishonest to say otherwise. It is enforced in PHP, so anyone with\nfilesystem, database or WP-CLI access can bypass it. It reliably stops accidents and casual\nchanges \u2014 a client uploading a plugin zip from who knows where, or overwriting an installed plugin with one. Treat it\nas a policy guard, not a security boundary.<\/p><\/dd>\n Because it cannot be switched off from the admin. Once it is in Gmail and Google Workspace: yes, with an app password. Microsoft 365 and Outlook.com: no \u2014 Microsoft now requires signing in through Microsoft (OAuth) for SMTP, which this feature does not support. A dedicated SMTP plugin is the better choice there.<\/p><\/dd>\n Encrypted in your site's database, which protects it in database backups. For the strongest setup define ADMINKEEP_SMTP_PASS (and the other ADMINKEEP_SMTP_* constants) in wp-config.php: values set there are not saved to the database, and the settings form does not display them.<\/p><\/dd>\n They are removed before an email is stored, along with sign-in and account-activation links. The\ncommon link formats are covered, not every possible one, so treat it as a safeguard rather than a\nguarantee. If you would rather not store email content at all, Email Log has a setting to keep\nonly the envelope \u2014 sender, recipient, subject and status \u2014 and switch content storage off.<\/p><\/dd>\n Switching it off stops logging. What is already logged stays until you switch it back on, delete\nit, or uninstall. While it is off nothing new is recorded and the entries are not aged out, so if\nyou want the log emptied, empty it first \u2014 from Tools \u2192 Email Log, or with\n wp adminkeep email-log purge --all \u2014 and then switch the feature off.<\/p><\/dd>\n Yes, since 1.5.0. Site Lock<\/h4>\n\n
\n
xmlrpc.php<\/code> completely, including pingbacks and system.multicall<\/code>. Guide<\/a><\/li>\nContent<\/h4>\n\n
\n
Appearance<\/h4>\n\n
\n
Admin<\/h4>\n\n
\n
Email<\/h4>\n\n
\n
Performance<\/h4>\n\n
Links<\/h4>\n\n
\n
WP-CLI<\/h3>\n\n
wp adminkeep<\/code>.<\/p>\n\nwp adminkeep feature list \u2014 every feature and whether it is on\nwp adminkeep feature enable disable_comments \u2014 switch a feature on (or `disable` it)\nwp adminkeep feature set order post_types=post,page \u2014 change a feature's settings\nwp adminkeep comments purge \u2014 delete spam and trashed comments, in batches\nwp adminkeep css set site.css \u2014 replace the Custom CSS from a file\nwp adminkeep smtp set --host=smtp.example.com --port=587 \u2014 configure SMTP\nwp adminkeep smtp test you@example.com \u2014 send a test email and see the server's reply\n<\/code><\/pre>\n\nwp help adminkeep<\/code> for the full reference. A change made here is cleaned and checked exactly as it is on the screen, and a mistyped value is refused rather than guessed at.<\/p>\n\n\n\n
wp plugin install adminkeep --activate\n<\/code><\/pre>\n\n\n\n
Will this delete my comments?<\/h3><\/dt>\n
Can I turn it back off?<\/h3><\/dt>\n
Does this actually stop comment spam bots?<\/h3><\/dt>\n
wp-comments-post.php<\/code> without ever loading your page, so\nhiding the comment form does nothing. Adminkeep refuses those requests with a 403 before\nWordPress processes them, and refuses comment creation through the REST API as well.<\/p><\/dd>\nIs Installation Lockdown a security feature?<\/h3><\/dt>\n
Why not just use the DISALLOW_FILE_MODS constant?<\/h3><\/dt>\n
wp-config.php<\/code> you need file\naccess to undo it, which strands people. Installation Lockdown filters capabilities instead, so\nyou can always turn it off from the settings screen. If you want the harder version, the constant\nis still there and this plugin does not interfere with it.<\/p><\/dd>\nDoes the SMTP feature work with Gmail or Microsoft 365?<\/h3><\/dt>\n
Where is my SMTP password kept?<\/h3><\/dt>\n
Does the email log store password-reset links?<\/h3><\/dt>\n
What happens to the email log if I switch the feature off?<\/h3><\/dt>\n
Can I manage Adminkeep with WP-CLI?<\/h3><\/dt>\n
wp adminkeep feature list<\/code> shows every feature, and wp help adminkeep<\/code> lists the commands for switching features, changing their settings, cleaning up comments, replacing the Custom CSS, configuring SMTP and choosing whether the settings screen hides unused features for a user. If Installation Lockdown has locked you out of the admin, wp adminkeep feature disable install_lock<\/code> is the way back in.<\/p><\/dd>\n\n<\/dl>\n\n\n1.8.0<\/h4>\n\n
\n
wp adminkeep view get|hide-unused|show-all --user=<user><\/code> read and set whether the settings screen hides unused features for that user.<\/li>\n<\/ul>\n\n1.7.0<\/h4>\n\n
\n
wp adminkeep email-log list|get|count|purge<\/code>.<\/li>\nwp adminkeep email-log import email-log<\/code>. Emails are stored the way Adminkeep would have stored them (links removed, the retention setting respected), running it again only adds what is new, and the other plugin's log is left as it was.<\/li>\nwp adminkeep smtp set<\/code> already did.<\/li>\n<\/ul>\n\n1.6.0<\/h4>\n\n
\n
1.5.0<\/h4>\n\n
\n
wp adminkeep<\/code> switches features on and off, changes their settings, cleans up comments, replaces the Custom CSS, configures SMTP and sends a test email. Run wp help adminkeep<\/code> to see every command.<\/li>\n<\/ul>\n\n1.4.0<\/h4>\n\n
\n
1.3.0<\/h4>\n\n
\n
1.2.0<\/h4>\n\n
\n
1.1.0<\/h4>\n\n
\n