You decide what changes on this site.<\/p>\n\n
Adminkeep is two sets of tools under that one idea. Site Lock<\/strong> stops things changing behind\nyour back \u2014 no new comment, no new plugin, no new user. Content<\/strong> makes the changes you do want\nsafe to make.<\/p>\n\n Every feature is a single switch, off until you turn it on. Switching one off never leaves you\nrepair work<\/strong>: the locks work purely through WordPress filters, so your site is exactly as it was,\nand what you made with the Content features stays where you put it.<\/p>\n\n A feature you have not enabled registers zero hooks and loads zero assets.<\/p>\n\n Or with WP-CLI:<\/p>\n\n Not unless you ask it to. Turning Disable Comments on only hides them \u2014 a test asserts the comment\nrows are untouched after a full enable-and-disable cycle.<\/p>\n\n There is a separate cleanup button that does delete, and it deletes spam and trashed comments\nonly<\/strong> unless you tick the box to include approved ones. It shows the exact count, asks you to\nconfirm, and cannot be undone.<\/p><\/dd>\n Yes, instantly. There is never a migration to run or a repair step to find.<\/p>\n\n The locks work purely through WordPress filters, so nothing was written to your database to undo \u2014\nswitch one off and your site is exactly as it was. The Content features are deliberately different:\nthey write the things you asked them to write. A copy you made, an order you saved, a file you\nreplaced, a redirect recorded when you renamed a page \u2014 switching the feature off stops it doing\nany more, and leaves what it already did alone. Work you did on purpose should not disappear\nbecause you unticked a checkbox.<\/p><\/dd>\n Yes. Bots usually POST straight to Not exactly, and it would be dishonest to say otherwise. It is enforced in PHP, so anyone with\nfilesystem, database or WP-CLI access can bypass it. It reliably stops accidents and casual\nchanges \u2014 a client installing something on a whim, or uploading a plugin zip from who knows where. Treat it\nas a policy guard, not a security boundary.<\/p><\/dd>\n Because it cannot be switched off from the admin. Once it is in Site Lock<\/h4>\n\n
\n
xmlrpc.php<\/code> completely, including pingbacks and system.multicall<\/code>. Guide<\/a><\/li>\nContent<\/h4>\n\n
\n
Performance<\/h4>\n\n
Links<\/h4>\n\n
\n
\n
wp plugin install adminkeep --activate\n<\/code><\/pre>\n\n\n\n
Will this delete my comments?<\/h3><\/dt>\n
Can I turn it back off?<\/h3><\/dt>\n
Does this actually stop comment spam bots?<\/h3><\/dt>\n
wp-comments-post.php<\/code> without ever loading your page, so\nhiding the comment form does nothing. Adminkeep refuses those requests with a 403 before\nWordPress processes them, and refuses comment creation through the REST API as well.<\/p><\/dd>\nIs Installation Lockdown a security feature?<\/h3><\/dt>\n
Why not just use the DISALLOW_FILE_MODS constant?<\/h3><\/dt>\n
wp-config.php<\/code> you need file\naccess to undo it, which strands people. Installation Lockdown filters capabilities instead, so\nyou can always turn it off from the settings screen. If you want the harder version, the constant\nis still there and this plugin does not interfere with it.<\/p><\/dd>\n\n<\/dl>\n\n\n1.1.0<\/h4>\n\n
\n