Keel Defaults

A new WordPress site leaves a lot of small decisions to you: how strong passwords must be, when updates happen, what the outside world can see, what a copied test site is allowed to do. Keel Defaults makes those decisions sensibly from the start and puts all 44 defaults on one screen, in plain language, where you can change any of them.

Try Keel live in WordPress Playground — a temporary WordPress site opens in your browser with the current release of Keel already switched on. No hosting, installation, or account required.

What Keel does for you

• Tells you when WordPress itself needs attention. If WordPress.org flags your version of WordPress as insecure, Keel says so in Site Health. When a secure fix exists for your version, Keel names it and gives an administrator a button to install it. If no fix exists yet, it tells you that too.
• Makes safer settings routine. Better password protection, less exposed to the outside world, and practical choices for updates and revisions, without a collection of small single-purpose plugins.
• Stops test sites emailing real people. Staging and local copies of your site send no email by default, so a copied database cannot email your customers, members, or clients by surprise.
• Makes update policy plain. The Updates screen says which WordPress release line the site follows, where that policy comes from, and links straight to the setting. Plugin and theme auto-updates get their own controls, which leave WordPress’s per-item choices alone unless you decide otherwise.
• Explains normal WordPress.org update checks. Site Health Info summarizes the categories core normally sends, without collecting or displaying this site’s values or making extra requests.
• Offers optional list-table compaction. Choose Leave unchanged, Tidy existing tables, or Tidy + helper columns. Tidy uses consistent dates and times. Saved Screen Options remain yours.
• Shows you exactly what it is doing. One Site Health page lists every setting and its current state, points out likely overlaps with other plugins, checks that Keel’s own protections are still registered, and lists plugins that change who may run WordPress abilities.
• Hands support a clean report. An administrator can download a sanitized JSON report of Keel’s settings and diagnostics, with no user data, site identifiers, option values or file paths in it.
• Keeps a multisite network consistent. A Super Admin can set chosen defaults for every site from one Network Policy screen. Each site’s own choices are kept underneath and come back when the policy is lifted.

Who it is for

Keel is especially useful if you build or look after many sites, as a freelancer, an agency, or the owner of a multisite network. It is just as useful if you have one site that matters too much to leave its basic safeguards to memory.

Safe to try, easy to undo

Each setting has a control and an explanation under Settings → Site Defaults. Some settings depend on others or are managed by configuration or network policy. Keel does not edit or delete your existing posts, pages, media, or comments. The one change it makes to files by default is giving new uploads lowercase filenames. Turn a setting off and that behavior returns to WordPress; uninstall Keel and its settings are removed.

Good to know before you activate

Out of the box, Keel turns off comments, trackbacks, and pingbacks, hides public author archives, and stops other sites displaying yours inside a frame. Nothing is deleted, and each of these is a switch you can turn back. The FAQ below explains each one.

External services

Keel contacts two outside services. Neither is sent personal data.

Have I Been Pwned: checking passwords against known breaches

When the Require strong passwords default is enabled, Keel screens new passwords against the Have I Been Pwned Pwned Passwords range API (https://api.pwnedpasswords.com) and rejects passwords found in known breaches. It also re-checks existing passwords when people log in, and warns without blocking.

• What is sent. Only the first five characters of the password’s SHA-1 hash, a method called k-anonymity. Never the password, never the full hash, and no personal data.
• When. Only while the default is on: when a password is being set or changed, and at most once every 30 days per account when someone logs in with a username or email and password (filter: keel_password_rescreen_interval). Every role is checked; to leave subscribers out, use add_filter( 'keel_password_rescreen_skip_roles', fn() => array( 'subscriber' ) );. Application passwords, XML-RPC and REST logins are not re-checked.
• What is stored about a login re-check. Two user meta timestamps: when the password was last checked, and when it was found in a breach. Both are deleted when the password changes and when the plugin is uninstalled.
• How to turn it off. Turn off the strong-password default, add define( 'KEEL_DISABLE_HIBP', true ); to wp-config.php, or use the keel_disable_hibp filter.
• Bounded checks and local storage. Fresh lookups share an allowance per site, or per network on multisite: initially 10 requests, then one additional credit per minute, with at most two active admission leases. Valid cached checks still work when fresh checks are limited. Up to 64 range responses are stored in non-autoloaded database rows and used for up to 12 hours, with fixed size limits; expired data may remain until its slot is replaced or the plugin is uninstalled; raw passwords and full hashes are never stored.
• If a fresh check cannot run. An unreachable service, invalid response, exhausted allowance or busy lookup slot produces an unknown breach verdict. It does not block a password change; the other local password rules still apply. Site Health reports sampled unavailability and historical live-response evidence. Samples are rate-limited, not counts of every skipped check. Diagnostics contain only the reason and timestamps, never the password or hash prefix. Network managers can review shared evidence; individual site administrators see a generic coverage notice.

Have I Been Pwned is operated by Troy Hunt; see https://haveibeenpwned.com/Privacy and https://haveibeenpwned.com/API/v3 for its terms and privacy policy.

WordPress.org: checking whether your WordPress version is vulnerable

Keel asks WordPress.org whether the installed version of WordPress has known vulnerabilities, using the core stable-check API (https://api.wordpress.org/core/stable-check/1.0/). This is WordPress.org’s own service, on the same host WordPress already contacts for updates and translations, although WordPress itself never queries it.

• What is sent. No site data beyond the user-agent, which identifies the plugin and the site’s home URL in the same way WordPress’s own update requests identify the site.
• How often. Keel keeps the answer for a day. It asks again sooner only when WordPress’s own update check offers a release that answer does not list yet, so a new security release is reported the day it ships.
• If the service cannot be reached. If WordPress.org is unreachable or answers with something unusable, the failure is remembered for five minutes so an outage does not slow down every admin screen, and Site Health reports that the status could not be determined rather than implying the site is fine.

WordPress.org’s privacy policy is at https://wordpress.org/about/privacy/.

Credits

Austin Ginder of Anchor Hosting (anchor.host · @anchorhost) reviewed Keel for security, and the plugin is better for it. Thank you, Austin.

Keel grew out of Better by Default, a WordPress defaults plugin written by the same author (@dknauss) as a teaching version for the Edmonton WordPress meetup, WPYEG: https://github.com/WPYEG/Better-by-Default

Better by Default is published under the GPL-3.0-or-later; its sole author additionally licenses the portions carried over here under the GPL-2.0-or-later. Keel keeps its core architecture and adds further hardening and admin defaults adapted from the Agency Experience plugin (GPL-2.0-or-later).

Agency Experience is itself a hard fork of the 10up Experience plugin by 10up (GPL-2.0-or-later): https://github.com/10up/10up-experience — so several of Keel’s adapted defaults ultimately descend from code first written for 10up Experience. Copyright in that work is retained by 10up and its contributors, and 10up retains its marks; Keel is not affiliated with or endorsed by 10up. See LICENSE for the full GPL-2.0 text.

Support This Plugin

Keel is free and will stay free. If it saves you an afternoon of securing a new site, or keeps a staging server from emailing your client’s customers, you can support its maintenance through GitHub Sponsors.

Bug reports and feature requests are welcome on the issue tracker: https://github.com/dknauss/keel/issues. If you have found a security problem, please report it privately rather than in a public issue — SECURITY.md ships with the plugin and says how.