A clear, maintainable baseline for secure WordPress sites. Keel provides 39 independent defaults for security, updates, privacy, content, email, media, and wp-admin. It is designed for people responsible for many sites, or for sites where predictable operations matter.
Current release: 0.6.6.
No install or hosting required: WordPress Playground opens a disposable WordPress site with Keel enabled and a sample post ready to inspect.
- Try the current stable release — the published plugin package.
- Try the current
mainbuild — the rolling build for testing changes before a release.
The stable demo follows each release; the rolling demo is rebuilt after successful pushes to main. See the Playground blueprint notes for their contracts and a quick availability check.
Keel exposes each choice under Settings → Site Defaults, explains it in place, and reports the effective posture in Tools → Site Health. It does not edit or delete existing content (new uploads do get lowercase filenames), and each default can be switched off independently.
- Reduce accidental exposure: anonymous user discovery, author archives, comments, pingbacks, attachment pages, raw HTML, security headers, AI connectors, and more.
- Make routine maintenance safer: conservative core update settings, visible update blockers, email-delivery checks, revision retention, and upload filename normalization.
- Protect non-production copies: outgoing mail is suppressed outside production by default, preventing a staging or local copy from sending to real recipients.
- Make operations legible: Site Health lists the active state of every default and flags attributable policy overlaps with other plugins.
- Run a network without flattening every site: a Super Admin can decide selected defaults for the whole network, while each site keeps its own choices underneath. Enforced settings are visibly locked, and lifting the policy restores every saved local choice.
Keel independently checks WordPress.org's stable-check status for the installed core version. If a release line has a known vulnerability and a same-line fix exists, Keel names that exact patch, explains what WordPress's Updates screen is offering, and lets an authorized administrator deliberately install only that patch through WordPress's upgrader with rollback enabled.
This is intentionally distinct from asking whether a newer major release exists. A secure same-line patch may be hidden as an automatic-update offer, absent from the Updates screen, or unavailable because WordPress.org has not published one. Keel reports the uncertainty or blocker rather than implying that an update is available when it is not. Details: core update and stable-check behavior.
keel_defaults_schema() is the configuration source of truth. It drives the settings UI, validation, Site Health, and the bootstrap hooks that apply enabled defaults. Settings are per-site; network policy and selected wp-config.php constants are evaluated as higher-priority effective values, without overwriting the stored site configuration.
Keel avoids cosmetic-only controls. For example, disabling comments also closes query and feed surfaces, while a closed REST API stops advertising itself but retains oEmbed so other sites can still embed posts. The per-setting reference documents the behavior, scope, tradeoffs, constants, and filters for every setting.
- Requirements: WordPress 6.4+, PHP 7.4+.
- External services: optional password breach screening uses HIBP's k-anonymous range API; the core security-status check uses WordPress.org's stable-check API. See the WordPress.org listing for full disclosures.
- Configuration: prefer the settings screen. Deployment-level constants and documented filters are available when code ownership is appropriate; see the reference.
- Multisite: a Super Admin uses Network Admin → Settings → Network Policy to decide individual settings for every site. Policy is read-time and visibly locked on sites; it never rewrites stored site settings, so removing it restores each site's previous choice.
- Compatibility: Keel identifies attributable shared policy hooks without executing third-party callbacks. Treat a reported overlap as a prompt to compare configuration, not as proof that another plugin must be removed.
The test suite is standalone PHP scripts in tests/, run with php tests/<name>.php. On every push and pull request, CI runs syntax, coding-standards, and PHP-compatibility checks, plus the unit tests on each PHP version from 7.4 through 8.5; pushes to main also build the plugin zip for the rolling Playground demo. A separate scheduled matrix exercises live WordPress installer and backport paths. The release package is built with bash bin/build-zip.sh build.
Useful references:
- Contributing
- Default behavior and technical reference
- Environment detection
- Competitive behavioral probes
- Security policy
- Release roadmap
Install from the WordPress.org directory, or place the plugin folder in wp-content/plugins/ and activate it. Then visit Settings → Site Defaults.
GPL-2.0-or-later. Keel is a de-branded evolution of Better by Default, with additional defaults adapted from the Pixel Managed Platform plugin, itself a fork of 10up Experience. See the WordPress.org readme for complete attribution.