Adminkeep – Email Log, Custom CSS, Disable Comments, Site Lockdown & Admin Enhancements

Not unless you ask it to. Turning Disable Comments on only hides them — a test asserts the comment rows are untouched after a full enable-and-disable cycle. There is a separate cleanup button that does delete, and it deletes spam and trashed comments only unless you tick the box to include approved ones. It shows the exact count, asks you to confirm, and cannot be undone.

Yes, instantly. There is never a migration to run or a repair step to find. The locks work purely through WordPress filters, so nothing was written to your database to undo — switch one off and your site is exactly as it was. The Content features are deliberately different: they write the things you asked them to write. A copy you made, an order you saved, a file you replaced, a redirect recorded when you renamed a page — switching the feature off stops it doing any more, and leaves what it already did alone. Work you did on purpose should not disappear because you unticked a checkbox.

Yes. Bots usually POST straight to wp-comments-post.php without ever loading your page, so hiding the comment form does nothing. Adminkeep refuses those requests with a 403 before WordPress processes them, and refuses comment creation through the REST API as well.

Not exactly, and it would be dishonest to say otherwise. It is enforced in PHP, so anyone with filesystem, database or WP-CLI access can bypass it. It reliably stops accidents and casual changes — a client uploading a plugin zip from who knows where, or overwriting an installed plugin with one. Treat it as a policy guard, not a security boundary.

Because it cannot be switched off from the admin. Once it is in wp-config.php you need file access to undo it, which strands people. Installation Lockdown filters capabilities instead, so you can always turn it off from the settings screen. If you want the harder version, the constant is still there and this plugin does not interfere with it.

Gmail and Google Workspace: yes, with an app password. Microsoft 365 and Outlook.com: no — Microsoft now requires signing in through Microsoft (OAuth) for SMTP, which this feature does not support. A dedicated SMTP plugin is the better choice there.

Encrypted in your site's database, which protects it in database backups. For the strongest setup define ADMINKEEP_SMTP_PASS (and the other ADMINKEEP_SMTP_* constants) in wp-config.php: values set there are not saved to the database, and the settings form does not display them.

They are removed before an email is stored, along with sign-in and account-activation links. The common link formats are covered, not every possible one, so treat it as a safeguard rather than a guarantee. If you would rather not store email content at all, Email Log has a setting to keep only the envelope — sender, recipient, subject and status — and switch content storage off.

Switching it off stops logging. What is already logged stays until you switch it back on, delete it, or uninstall. While it is off nothing new is recorded and the entries are not aged out, so if you want the log emptied, empty it first — from Tools → Email Log, or with wp adminkeep email-log purge --all — and then switch the feature off.

Yes, since 1.5.0. wp adminkeep feature list shows every feature, and wp help adminkeep lists the commands for switching features, changing their settings, cleaning up comments, replacing the Custom CSS, configuring SMTP and choosing whether the settings screen hides unused features for a user. If Installation Lockdown has locked you out of the admin, wp adminkeep feature disable install_lock is the way back in.