by
Dan Knauss
1 (0 reviews)
Keel Defaults
39 sane WordPress defaults, each one a switch you can see and turn off — security, updates, privacy, UX, and performance.
Keel Defaults ranks #65,015 among WordPress.org plugins with 1+ active installations, is #2,643 of 4,589 in the Security category, a 1/5 rating from 0 reviews, and was last updated Aug 26, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1
v0.5.9
Current Version v0.5.9
Updated 4 weeks ago
Last Update on 26 Aug, 2026
Refreshed 8 hours ago
Last Refreshed on
#2,643 of 4,589 in Security
Downloads -81.4% this week
Actively maintained
Rank
#65,015
—
No change
Active Installs
1+
—
No change
KW Avg Position
N/A
—
No change
Downloads
389
+2 today
Support Resolved
0%
—
No change
Rating
20%
Review 1 out of 5
1
(0 reviews)
Next Milestone 10
0+
10+
64,069
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 9 more installs to reach 10+
Rank Changes
Current
#65,015
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
1.0
0 reviews
Overall
20%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 0.5.9
- Last Updated
- Aug 26, 2026
- Requires WP
- 6.4+
- Tested Up To
- 7.1
- PHP Version
- 7.4 or higher
- Author
- Dan Knauss
Support & Rating
- Rating
- ★ ☆ ☆ ☆ ☆ 1
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,758
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,008
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security - Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#17
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#37
Frequently Asked Questions
Common questions about Keel Defaults
Sixteen of the thirty-nine defaults are on out of the box, and nine more settings that are not simple switches apply a starting value. Nothing is written to your content and nothing is deleted; every one of them is a switch on Settings → Keel you can turn off, and turning it off puts WordPress back exactly as it shipped. Most of it is quiet. Users stop being listed to anonymous REST requests, new passwords have to be long and must not appear in a known breach, raw HTML and JavaScript are limited to Administrators, baseline security headers are sent, AI provider connectors are switched off, translations keep auto-updating, uploads get lowercase filenames, attachment screens show which image sizes were generated, and the site warns you if its own email looks misconfigured. Three are visible straight away and are the ones to know about. Comments, trackbacks and pingbacks are switched off everywhere, including for existing posts — nothing is deleted, and turning the setting off brings every comment back. Author archives stop resolving, so /author/name/ no longer returns a page. And X-Frame-Options: SAMEORIGIN is sent, which stops other sites displaying yours in an iframe; if something is meant to embed this site, set Frame options to "Leave unchanged". Two more change things you may not see immediately: attachment pages redirect to the parent post, and self-pingbacks and the emoji detection script are gone. The starting values are conservative. Core auto-updates are set to minor — maintenance and security releases install themselves, major versions do not — ten post revisions are kept, logins last two days or fourteen with "Remember me", and subscribers are exempt from the password rules. The admin menu width, the front-end admin bar and the login logo are all left as WordPress has them until you choose otherwise. One default is on but does nothing on a live site: outgoing email is blocked on any environment that is not production, so a database copied to staging or a laptop cannot email real people. On production it never acts.
The defaults that are on out of the box are low-risk, with one exception worth naming: X-Frame-Options: SAMEORIGIN is sent by default, and it stops other sites embedding yours in an iframe. Set Frame options to "Leave unchanged" if the site is meant to be embedded, because a blocked frame fails silently as a blank box. Everything else that can break something is off and opt-in, and each says on the settings screen what it will cost you — for example that blocking the XML-RPC endpoint also stops apps and services that publish through it. Requiring authentication for REST is the one place Keel spends a little of that strictness back: oembed/1.0 stays reachable, so other sites can still embed your posts when every other route is closed.
One thing, and only when the strong-password default is on: the first five characters of a password's SHA-1 hash, to check it against known breaches. Never the password, never the full hash, no personal data. See External services above for the full description and how to switch it off.
Because Keel switched it off, deliberately, and there is an admin notice on the site saying so. The Non-Production Email default suppresses outgoing mail on any environment that is not production, so a database copied down from production cannot email real customers from a staging site or a laptop. It does nothing on production, so it cannot be left on by mistake. To send from a non-production site anyway, turn the default off under Settings → Keel, define KEEL_ALLOW_NONPRODUCTION_MAIL in wp-config.php, or use the keel_suppress_nonproduction_mail filter. A mail catcher can still record what would have been sent by hooking keel_outgoing_mail_suppressed. The environment is read the same way the admin-bar environment indicator reads it: WP_ENVIRONMENT_TYPE, whether set as a constant or an environment variable, and a host-name fallback for local development tools when neither is set.
No. Disabling comments hides them and closes the forms; nothing is removed from the database, and turning the default off brings every comment back. The same holds for the other content defaults.
Yes. Every default reads its value through the plugin's own option, and the behaviours are filterable — keel_weak_roles, keel_disable_hibp, keel_comment_blocks, keel_allowed_comment_types and others. A wp-config.php constant always wins over the settings screen where one applies; the screen says so when it is being overridden.
The setting is stored per site; the effect is not. WordPress keeps one user table for the whole network, so a password is checked against whichever site it is being set on — and once set, it is that person's password everywhere. Exempting a role on one subsite decides what happens when a password is changed there; it does not exempt those accounts from another site's policy. In practice the strictest site on the network sets the floor for anyone who changes their password on it. Keel can now govern it as well as document it. Under Network Admin → Settings → Keel Defaults, a Super Admin can decide any setting for the whole network; sites see it as locked and cannot change it. Tick the password rules there and the network has one policy instead of a floor set by whichever site is strictest. Nothing is written into your sites. A network value is applied when a setting is read, so a site's own saved settings are untouched — untick a setting later and every site returns to exactly the value it had. Settings left unticked stay each site's own business.
You can, but you probably should not, and Keel will tell you when it matters. Some settings are applied through WordPress filters that transform a value in priority order — session length is the clearest example. Another callback on the same filter does not prove a conflict: two plugins may reach the same outcome or govern different parts of a structured result. Keel reports a structural overlap only when it is registered on an authoritative policy hook and a callback attributable to another active plugin is registered there too. It never executes the other plugin's callback to diagnose the overlap. The notice appears on the Plugins screen, on Settings → Keel, and on the dashboard, where it can be dismissed until the overlap changes. The full detail is under Tools → Site Health. That evidence confirms shared ownership of a hook, not that the plugins' configured outcomes disagree. Keel asks you to compare their settings and never recommends deactivation from callback presence alone. Mail, authentication, comment-query, capability, and unattributable overlaps stay unconfirmed and informational. There is a limit worth knowing. WordPress ships tiny helper callbacks such as __return_false; the callback belongs to WordPress, not the plugin that registered it. Keel labels that limitation unconfirmed instead of guessing from source code or naming a plugin without evidence. Keel also stays out of the fight where it has nothing to say: when a setting is still at the value WordPress itself uses, Keel does not register the filter at all, so it cannot override a deliberate choice another plugin has made — and it will not report a conflict on a setting it is not itself setting.
WordPress ships one, but it is JavaScript: it advises the person typing and cannot refuse anything, so a password set over the REST API, WP-CLI, or a form with scripts disabled never meets it. Keel enforces length, breach screening, a blocklist and a personal-context check server-side instead, where they cannot be bypassed. See the Help tab on the settings screen.
