by Dan Knauss 0 (0 reviews)

Keel Defaults

Name: Keel Defaults
Author: Dan Knauss

44 sane WordPress defaults, a warning when your core version is vulnerable, and the option to install the same-branch secure fix.

Keel Defaults ranks #31,535 among WordPress.org plugins with 10+ active installations, is #1,834 of 5,058 in the Security category, and was last updated Oct 28, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1.4

v0.9.0 Current Version v0.9.0

Updated 1 week ago Last Update on 28 Oct, 2026

Refreshed 1 week ago Last Refreshed on

#1,834 of 5,058 in Security Top 50% by installs Downloads -69.4% this week Actively maintained

View on WordPress.org

Rank

#31,535

— No change

Active Installs

10+

+400%

KW Avg Position

171

2 worse

Downloads

937

+4 today

Support Resolved

— No change

Rating

Review 0 out of 5

0 (0 reviews)

Next Milestone 20

Total Progress 80%

10+ 20+

8,362

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 2 more installs to reach 20+

Rank Changes

Current #31,535

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

0.0

0 reviews

Overall 0%

0 (0%)

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 0.9.0
Last Updated: Oct 28, 2026
Requires WP: 6.4+
Tested Up To: 7.1.4
PHP Version: 7.4 or higher
Author: Dan Knauss

Support & Rating

Rating: ☆ ☆ ☆ ☆ ☆ 0
Reviews: 0
Support Threads: 0
Resolved: 0%

Keywords

defaults hardening security site health updates

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

Akismet Anti-spam: Spam Protection

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

5M+ installs

#11

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

View all Security-and-spam-protection plugins

Frequently Asked Questions

Common questions about Keel Defaults

Keel applies its starting choices and gives you one screen to review them. Comments, trackbacks, and pingbacks are turned off; public author archives are hidden; other sites cannot put yours inside a frame; and new uploads get lowercase filenames. Settings that could affect another service you rely on are left off until you enable them. Nothing is deleted. Keel does not edit or remove your posts, pages, media, users, or comments. Disabling comments hides them and closes the forms; turning the setting off brings them back. Uninstalling removes only Keel's own settings. Everything Keel does is visible and reversible, and each setting explains its practical effect before you change it. The default most likely to surprise you is frame protection: if another site or service is meant to display yours in a frame, that frame will usually show as a blank box. Set Frame options to "Leave unchanged" to allow it. Also review the settings after activation if a service publishes to your site through XML-RPC or depends on a feature you intend to turn off.

Read the message in Site Health. Keel tells you whether a secure fix is available for the version of WordPress you are on, whether WordPress is offering it, and whether something is preventing automatic updates. If the install button is offered, an authorized administrator can use it to install that fix. If there is no secure fix, Keel says so clearly; plan an upgrade to a newer version rather than assuming one exists.

Keel blocks outgoing email outside production by default. This protects real customers and clients when a live database is copied to staging or a local machine. It does not block email on your live site. Turn Non-Production Email off in Settings → Site Defaults when your test site needs to send email.

Yes. Keel is built for independent sites, agencies, freelancers, and multisite networks. On a network, a Super Admin uses Network Admin → Settings → Network Policy to choose which defaults apply everywhere. The policy is visible and locked on each site, but it does not destroy the local choices underneath it; remove a policy later and each site returns to its own saved choice. Passwords are the one setting that works differently on a network. The setting is stored per site, but WordPress keeps one list of users for the whole network, so a password set on any site becomes that person's password everywhere. For one rule across the network, set the password policy in Network Policy.

Usually, yes, but choose one plugin to own any particular setting. Keel helps by showing likely overlaps in Site Health, so you can compare the two instead of discovering a disagreement later.

Yes. Separate plugin and theme controls offer Enabled, Disabled, and Leave unchanged. Both default to Leave unchanged, preserving WordPress's per-item choices and other filters. Explicit choices do not rewrite those per-item settings; later filters and global update restrictions still apply. There is no minor-only channel for plugin or theme releases. On multisite, network policy wins, otherwise the main site's Keel setting decides for the shared files. Site Health → Status, under Update diagnostics, reports the cached filter decisions, not installation guarantees.

WordPress's strength meter advises the person typing but cannot refuse a password, and passwords set through the REST API, WP-CLI, or a form without scripts never meet it. Keel instead checks length, known breaches, a blocklist, and personal details such as your own name on the server, where the checks cannot be bypassed.

Yes. Go to Settings → Site Defaults and use Download JSON under Export Settings and Diagnostics. The authenticated download includes validated policy choices and cached diagnostic summaries, with unknown evidence marked explicitly. It excludes site/user identifiers, raw option records, callback paths and full plugin/theme inventories. On multisite, network-management authority is required. Review the file before sharing it; downloading does not refresh diagnostics or run update checks.

Yes. Many defaults can be set with a wp-config.php constant or a filter, for example KEEL_DISABLE_HIBP or KEEL_ALLOW_NONPRODUCTION_MAIL. A constant wins over the settings screen, and the screen shows when a setting is being overridden. The full list is in the plugin's documentation on GitHub.