Adminkeep – Site Lockdown & Admin Enhancements

Not unless you ask it to. Turning Disable Comments on only hides them — a test asserts the comment rows are untouched after a full enable-and-disable cycle. There is a separate cleanup button that does delete, and it deletes spam and trashed comments only unless you tick the box to include approved ones. It shows the exact count, asks you to confirm, and cannot be undone.

Yes, instantly. There is never a migration to run or a repair step to find. The locks work through WordPress filters, so nothing was written to your database to undo — switch one off and your site is exactly as it was. The one exception is Two-Factor Login, which remembers trusted devices in user meta so they keep skipping the code. Switching it off leaves those entries where they are, doing nothing, and makes its recovery link stop working; deleting the plugin with "Delete all Adminkeep data when the plugin is deleted" switched on removes them. The Content features are deliberately different: they write the things you asked them to write. A copy you made, an order you saved, a file you replaced, a redirect recorded when you renamed a page — switching the feature off stops it doing any more, and leaves what it already did alone. Work you did on purpose should not disappear because you unticked a checkbox.

Yes. Bots usually POST straight to wp-comments-post.php without ever loading your page, so hiding the comment form does nothing. Adminkeep refuses those requests with a 403 before WordPress processes them, and refuses comment creation through the REST API as well.

Not exactly, and it would be dishonest to say otherwise. It is enforced in PHP, so anyone with filesystem, database or WP-CLI access can bypass it. It reliably stops accidents and casual changes — a client uploading a plugin zip from who knows where, or overwriting an installed plugin with one. Treat it as a policy guard, not a security boundary.

Because it cannot be switched off from the admin. Once it is in wp-config.php you need file access to undo it, which strands people. Installation Lockdown filters capabilities instead, so you can always turn it off from the settings screen. If you want the harder version, the constant is still there and this plugin does not interfere with it.

Gmail and Google Workspace: yes, with an app password. Microsoft 365 and Outlook.com: no — Microsoft now requires signing in through Microsoft (OAuth) for SMTP, which this feature does not support. A dedicated SMTP plugin is the better choice there.

Encrypted in your site's database, which protects it in database backups. For the strongest setup define ADMINKEEP_SMTP_PASS (and the other ADMINKEEP_SMTP_* constants) in wp-config.php: values set there are not saved to the database, and the settings form does not display them.

They are removed before an email is stored, along with sign-in and account-activation links. The common link formats are covered, not every possible one, so treat it as a safeguard rather than a guarantee. If you would rather not store email content at all, Email Log has a setting to keep only the envelope — sender, recipient, subject and status — and switch content storage off. Two-Factor Login's code emails are always stored that way, whatever the setting.

Switching it off stops logging. What is already logged stays until you delete it, or delete the plugin with "Delete all Adminkeep data when the plugin is deleted" switched on. While it is off nothing new is recorded and the entries are not aged out, so if you want the log emptied, empty it first — from the Email Log screen, or with wp adminkeep email-log purge --all — and then switch the feature off.

They stay, unless you ask otherwise. Deleting the plugin keeps its settings, your Custom CSS and Header & Footer Code, the SMTP and contact form settings, the email log, the Keep URL redirects and the devices Two-Factor Login remembers and its recovery link, so installing it again brings everything back. To remove all of it when the plugin is deleted, switch on "Delete all Adminkeep data when the plugin is deleted" under Settings → Adminkeep → Plugin settings, or run wp adminkeep setting set delete_data=true. Deactivating never deletes anything.

On the front end of your site, on every page. The Head box goes inside <head>, before your theme's own styles and scripts. The Body open box goes just after <body> opens, on themes that support it (current themes do). The Footer box goes at the end of the page, after WordPress's own footer scripts. None of it is added to the admin, the login page, feeds or the REST API. Each box holds up to 64 KB. A snippet from an analytics or chat service is a few kilobytes; for anything larger, upload the script as a file and load it with <script src="…"></script>. The code is printed exactly as you saved it, so check a snippet on a test page if you are unsure of it. Switching the feature off stops it printing and keeps the code.

The form itself stores nothing: each message is emailed to you and that is all. If Email Log is on, it keeps a copy for its retention period, with whether the email went out, and WordPress's own personal data export and erase tools find those copies by the visitor's email address.

It is hidden only while Cloudflare Turnstile or Google reCAPTCHA v3 is chosen without both of its keys saved. Open Settings → Contact Form and save them, or choose WordPress Nonce, which needs none. Until then, administrators see a note where the form will appear and visitors see nothing. If the screen says the last submission failed, it names the reason, such as a secret key the provider refused.

Not with the default spam protection, WordPress Nonce. A nonce expires within a day, so a page served from a cache for longer carries an expired one, and every message sent from it is refused. On a site with a caching plugin, a host-level cache or a CDN that caches pages, choose Cloudflare Turnstile or Google reCAPTCHA v3 under Settings → Contact Form. With either of those, yes. The form's markup is then the same for every visitor and carries no nonce or session, so a cached page keeps working. The spam check runs afresh on every send, and the message goes out through a REST request that is not cached.

No. The form carries its own small style and script, printed right after it, so there is no extra file to load on pages without the form, which suits page builders. Cloudflare's or Google's script is added only on pages that show the form.

After the password, the code screen shows the account's email address, partly hidden, and sends the code there when you press Email me the code, so you can tell the person who reads that mailbox before it arrives. The code is sent with wp_mail(), the same way WordPress sends password resets, so the SMTP feature delivers it. It always goes out in the Nice Default Emails layout, whether that feature is on or not. If password resets do not arrive either, the site cannot send email. Nobody in the chosen roles is signed in without the code, so a site whose email is down locks those users out until Two-Factor Login is switched off or email is fixed. See the next question for the ways back in. A code works once, for up to ten minutes from when it is sent, and a login attempt ends 30 minutes after the password at the latest; after either, the login starts again from the password form. Five wrong codes lock the code step for that account for 15 minutes, and each lock after that doubles the wait, up to six hours. Typing the password again does not get round it, and a device remembered with "Remember this device" is not affected. Asking for a new code does not give back tries already used.

There are three ways, and none of them needs you to log in first.

1. The recovery link. When you switch Two-Factor Login on, a recovery link is emailed to you (to the site's administration email address when it is switched on with WP-CLI). The settings screen shows which address it went to, partly hidden, and tells you if the email could not be sent, so you can fix email before you log out. Opening the link shows a page with one button, Turn off Two-Factor Login; pressing it switches the feature off and keeps the roles you chose. The link does not expire, works once, and is replaced by a new one each time Two-Factor Login is switched on, so keep the newest email. Anyone who has the link can switch Two-Factor Login off, so treat that email like a password. When the link is used, every administrator of the site is emailed the time and the IP address it was used from.
2. WP-CLI: wp adminkeep feature disable two_factor.
3. wp-config.php: add define( 'ADMINKEEP_DISABLE_TWO_FACTOR', true );.

The main login screen, wp-login.php, which is where the code screen appears. Other login forms that use WordPress's own sign-in, such as WooCommerce's My Account or a custom form, cannot show the code screen, so they refuse users who owe a code and point them to the main login screen. A plugin that only moves the login screen to a different address works as usual. If a plugin replaces the login screen with its own form, the code screen cannot be reached on that site, so keep the recovery email: its link is then the way to switch Two-Factor Login off. On multisite, super admins are asked whenever administrators are, since they hold more power than any administrator of a site. The REST API, application passwords and XML-RPC are not asked for a code, because the apps and services that use them have no screen to type one into. An application password still works on its own. Disable XML-RPC is a separate feature.

Yes, since 1.5.0. wp adminkeep feature list shows every feature, and wp help adminkeep lists the commands for switching features, changing their settings, cleaning up comments, replacing the Custom CSS or the Header & Footer Code, configuring SMTP and the contact form, and choosing whether the settings screen hides unused features for a user. If Installation Lockdown has locked you out of the admin, wp adminkeep feature disable install_lock is the way back in.