Keel Defaults

Keel gives WordPress site owners a sensible starting point: 39 clear controls for security, updates, privacy, content, email, media, and the admin experience. Every choice lives under Settings → Site Defaults, says what it does, and can be changed independently.

Try Keel live in WordPress Playground — a temporary WordPress site opens in your browser with the current release of Keel already enabled. No hosting, installation, or account required.

Keel is especially useful when you build, manage, or maintain many sites — or when one site matters too much to leave its basic safeguards to memory.

• Know when core needs attention. Keel warns when WordPress.org flags the installed WordPress version as insecure. When a safe patch for the same version line is available, it names that patch and lets an authorized administrator install it deliberately. You get a clear answer even when no secure patch is available yet.
• Make safer defaults routine. Reduce unnecessary exposure, set practical update and revision policies, improve password protection, and keep site settings consistent without a collection of small single-purpose plugins.
• Avoid expensive staging mistakes. Keel stops outgoing mail on non-production copies by default, so a copied database cannot unexpectedly email customers, members, or clients.
• See what is really active. Site Health summarizes Keel’s current settings in one place and highlights likely overlaps with other plugins.
• Manage a network without flattening it. On multisite, a Super Admin can decide selected defaults for every site from one Network Policy screen. Sites can still keep their own choices underneath; the policy is visible and locked while it applies, and lifting it brings those choices back.

Keel does not edit or delete your existing posts, pages, media, or comments; the one file-level change it makes by default is lowercasing the filenames of new uploads. Turning off a Keel setting returns that behavior to WordPress; uninstalling removes Keel’s settings.

External services

When the Require strong passwords default is enabled, Keel screens new passwords against the Have I Been Pwned Pwned Passwords range API (https://api.pwnedpasswords.com) to reject passwords found in known breaches. This uses k-anonymity: only the first five characters of the password’s SHA-1 hash are ever sent — never the password, and never the full hash. No personal data is transmitted. The check runs only when a password is being set or changed and the default is on. It can be disabled with define( 'KEEL_DISABLE_HIBP', true ); in wp-config.php, with the keel_disable_hibp filter, or by turning off the strong-password default. If the API is unreachable, or answers with a truncated or malformed response, the check is skipped and the password is allowed — a breach-data outage never blocks a password change. It is not skipped silently: the failure is recorded and reported under Site Health, so a site whose screening has stopped working can tell. Only the kind of failure and when it happened are stored — never the password, and never the hash prefix. Have I Been Pwned is operated by Troy Hunt; see https://haveibeenpwned.com/Privacy and https://haveibeenpwned.com/API/v3 for its terms and privacy policy.

Keel also asks WordPress.org whether the installed version of WordPress has known vulnerabilities, using the core stable-check API (https://api.wordpress.org/core/stable-check/1.0/). This is WordPress.org’s own service, on the same host core already contacts for updates and translations; core itself never queries it. The request carries no site data beyond the user-agent, which identifies the plugin and the site’s home URL in the same way core’s own update requests identify the site. The response maps the WordPress releases it lists to their current status; Keel keeps it for a day, and asks again sooner only when WordPress’s own update check offers a release that answer does not list yet, so a new security release is reported the day it ships. If WordPress.org is unreachable or answers with something unusable, the failure is remembered for five minutes so an outage does not add a network wait to every admin screen, and Site Health reports that the status could not be determined rather than implying the site is fine. WordPress.org’s privacy policy is at https://wordpress.org/about/privacy/.

Credits

Austin Ginder of Anchor Hosting (anchor.host · @anchorhost) reviewed Keel for security, and the plugin is better for it. Thank you, Austin.

Keel is a de-branded evolution of Better by Default, the WordPress defaults plugin by WPYEG (a teaching version for the Edmonton WordPress meetup): https://github.com/WPYEG/Better-by-Default

Better by Default is published under the GPL-3.0-or-later; its sole author, who also wrote Keel (@dknauss), additionally licenses the portions carried over here under the GPL-2.0-or-later. Keel keeps Better by Default’s core architecture — a single schema array that drives both the settings screen and the bootstrap, where each default is one array entry plus one hook — and adds further hardening and admin defaults adapted from the Pixel Managed Platform plugin (GPL-2.0-or-later).

The Pixel version is itself a hard fork of the 10up Experience plugin by 10up (GPL-2.0-or-later): https://github.com/10up/10up-experience — so several of Keel’s adapted defaults ultimately descend from code first written for 10up Experience. Copyright in that work is retained by 10up and its contributors, and 10up retains its marks; Keel is not affiliated with or endorsed by 10up. See LICENSE for the full GPL-2.0 text.

Support This Plugin

Keel is free and will stay free. If it saves you an afternoon of hardening a new site, or keeps a staging server from emailing your client’s customers, you can support its maintenance through GitHub Sponsors.

Bug reports and feature requests are welcome on the issue tracker: https://github.com/dknauss/keel/issues. If you have found a security problem, please report it privately rather than in a public issue — SECURITY.md ships with the plugin and says how.