Keel Defaults

Who it is for

Keel is especially useful if you build or look after many sites, as a freelancer, an agency, or the owner of a multisite network. It is just as useful if you have one site that matters too much to leave its basic safeguards to memory.

Safe to try, easy to undo

Each setting has a control and an explanation under Settings → Site Defaults . Some settings depend on others or are managed by configuration or network policy. Keel does not edit or delete your existing posts, pages, media, or comments. The one change it makes to files by default is giving new uploads lowercase filenames. Turn a setting off and that behavior returns to WordPress; uninstall Keel and its settings are removed.

Good to know before you activate

Out of the box, Keel turns off comments, trackbacks, and pingbacks, hides public author archives, and stops other sites displaying yours inside a frame. Nothing is deleted, and each of these is a switch you can turn back. The FAQ below explains each one.

External services

Keel contacts two outside services. Neither is sent personal data.

Have I Been Pwned: checking passwords against known breaches

When the Require strong passwords default is enabled, Keel screens new passwords against the Have I Been Pwned Pwned Passwords range API ( https://api.pwnedpasswords.com ) and rejects passwords found in known breaches. It also re-checks existing passwords when people log in, and warns without blocking.

• What is sent. Only the first five characters of the password’s SHA-1 hash, a method called k-anonymity. Never the password, never the full hash, and no personal data.
• When. Only while the default is on: when a password is being set or changed, and at most once every 30 days per account when someone logs in with a username or email and password (filter: keel_password_rescreen_interval ). Every role is checked; to leave subscribers out, use add_filter( 'keel_password_rescreen_skip_roles', fn() => array( 'subscriber' ) ); . Application passwords, XML-RPC and REST logins are not re-checked.
• What is stored about a login re-check. Two user meta timestamps: when the password was last checked, and when it was found in a breach. Both are deleted when the password changes and when the plugin is uninstalled.
• How to turn it off. Turn off the strong-password default, add define( 'KEEL_DISABLE_HIBP', true ); to wp-config.php , or use the keel_disable_hibp filter.
• Bounded checks and local storage. Lookups share an allowance per site, or per network on multisite: initially 10 requests, then one additional credit per minute, with at most two lookup slots in use at a time. Half of the allowance is kept for accounts that can write content or manage the site, so those accounts can still be checked when the rest is used up. A reply from the service answers the check that asked for it and is then discarded. No password, hash, hash prefix or reply is stored. The one stored record is a non-autoloaded database row holding the allowance’s counters and the diagnostic timestamps described below. Rows that earlier versions used to keep replies are deleted after the update.
• If a check cannot run. An unreachable service, invalid response, exhausted allowance or busy lookup slot produces an unknown breach verdict. It does not block a password change; the other local password rules still apply. Site Health reports sampled unavailability and historical live-response evidence. Samples are rate-limited, not counts of every skipped check. Diagnostics contain only the reason and timestamps, never the password or hash prefix. Network managers can review shared evidence; individual site administrators see a generic coverage notice.

Have I Been Pwned is operated by Troy Hunt; see https://haveibeenpwned.com/Privacy and https://haveibeenpwned.com/API/v3 for its terms and privacy policy.

WordPress.org: checking whether your WordPress version is vulnerable

Keel asks WordPress.org whether the installed version of WordPress has known vulnerabilities, using the core stable-check API ( https://api.wordpress.org/core/stable-check/1.0/ ). This is WordPress.org’s own service, on the same host WordPress already contacts for updates and translations, although WordPress itself never queries it.

• What is sent. No site data beyond the user-agent, which identifies the plugin and the site’s home URL in the same way WordPress’s own update requests identify the site.
• How often. Keel keeps the answer for a day. It asks again sooner only when WordPress’s own update check offers a release that answer does not list yet, so a new security release is reported the day it ships.
• If the service cannot be reached. If WordPress.org is unreachable or answers with something unusable, the failure is remembered for five minutes so an outage does not slow down every admin screen, and Site Health reports that the status could not be determined rather than implying the site is fine.

WordPress.org’s privacy policy is at https://wordpress.org/about/privacy/.

Credits

Austin Ginder of Anchor Hosting ( anchor.host · @anchorhost ) reviewed Keel for security, and the plugin is better for it. Thank you, Austin.

Keel grew out of Better by Default, a WordPress defaults plugin written by the same author (@dknauss) as a teaching version for the Edmonton WordPress meetup, WPYEG: https://github.com/WPYEG/Better-by-Default

Better by Default is published under the GPL-3.0-or-later; its sole author additionally licenses the portions carried over here under the GPL-2.0-or-later. Keel keeps its core architecture and adds further hardening and admin defaults adapted from the Agency Experience plugin (GPL-2.0-or-later).

Agency Experience is itself a hard fork of the 10up Experience plugin by 10up (GPL-2.0-or-later): https://github.com/10up/10up-experience — so several of Keel’s adapted defaults ultimately descend from code first written for 10up Experience. Copyright in that work is retained by 10up and its contributors, and 10up retains its marks; Keel is not affiliated with or endorsed by 10up. See LICENSE for the full GPL-2.0 text.

Support This Plugin

Keel is free and will stay free. If it saves you an afternoon of securing a new site, or keeps a staging server from emailing your client’s customers, you can support its maintenance through GitHub Sponsors .

Bug reports and feature requests are welcome on the issue tracker: https://github.com/dknauss/keel/issues . If you have found a security problem, please report it privately rather than in a public issue — SECURITY.md ships with the plugin and says how.