內容簡介
Adminkeep 是一款針對 WordPress 的網站鎖定與管理增強外掛，讓使用者能夠控制網站的變更。透過鎖定功能，防止未經授權的變更，同時提供安全的管理增強選項，確保網站運行穩定。
【主要功能】
• 網站鎖定功能，防止未經授權的變更
• 禁用評論，阻止垃圾評論進入資料庫
• 註冊鎖定，阻止新帳號創建
• 禁用 XML-RPC，關閉相關功能
• 禁用檔案編輯，移除內建編輯器
• 雙因素登入，增強帳號安全性
外掛標籤
開發者團隊
② 後台搜尋「Adminkeep – Site Lockdown & Admin Enhancements」→ 直接安裝（推薦）
📦 歷史版本下載
原文外掛簡介
Site lockdown and admin enhancements for WordPress, under one idea: you decide what changes on this site.
Site Lock stops things changing behind your back — no new comment, no new plugin, no new user, no new account with admin rights. The rest are admin enhancements that make the changes you do want safe to make: an email log, custom CSS, header and footer code, SMTP, a contact form, duplicate and reorder posts, replace a file in place.
Every feature is a single switch, off until you turn it on. Switching one off never leaves you repair work: the locks work through WordPress filters, so your site is exactly as it was (the devices Two-Factor Login remembers stay behind, doing nothing), and what you made with the Content features stays where you put it.
Site Lock
Disable Comments — comments off everywhere, including direct POSTs from spam bots and the REST API. Nothing is written to your database, so switching it off brings every comment back. An optional cleanup button deletes spam and trashed comments, after showing you the exact count. Guide
Registration Lockdown — stops new accounts being created, and refuses creation of or promotion to administrator. Blocked attempts are logged. Guide
Disable XML-RPC — closes xmlrpc.php completely, including pingbacks and system.multicall. Guide
Disable File Editing — removes the built-in plugin and theme file editors, reversibly.
Installation Lockdown — no new plugins or themes, from WordPress.org or a ZIP, and no replacing one by uploading a ZIP, for anyone. Updates keep working, so security releases still reach your site. Guide
Username Privacy — keeps your usernames out of public view. Author pages, the ?author=1 probe, the REST users list, author sitemaps and embed previews stop naming your accounts to visitors; anyone logged in sees everything as before. Nothing is written, so switching it off reopens it all. Guide
Two-Factor Login — users in the roles you choose enter a six-digit code emailed to them after their password, so a stolen password alone no longer opens the account. The code screen emails the code when the user presses its button, so they can warn whoever reads that mailbox first, and the code works once, for up to ten minutes. Five wrong codes lock the code step for that account for 15 minutes, doubling on repeat. At most five code emails go to one user in ten minutes, and wrong codes are reported as failed logins, so login-limiting plugins count them. “Remember this device” skips the code on that browser for 30 days, or the number you set. On multisite, super admins are asked whenever administrators are. The code is asked for on the main login screen; other login forms, such as WooCommerce’s My Account, send these users there. The REST API, application passwords and XML-RPC are not asked. Switching it on emails you a recovery link that turns Two-Factor Login off without logging in, in case you are ever locked out.
Appearance
Custom CSS — CSS that belongs to your site instead of your theme. Edit it under Appearance with WordPress’s own code editor, or open Edit CSS from the admin bar on any page and watch the page restyle as you type, the way the Customizer’s CSS box used to. It stays when you switch themes, and your theme’s Additional CSS is left alone.
Header & Footer Code — a home for the snippets services ask you to paste into your site: analytics and verification tags in the head, a tag manager’s fallback just after the body opens, chat widgets and scripts in the footer. Three boxes under Appearance with WordPress’s code editor, printed on the front end exactly as you saved them, and kept when you change or update your theme. Each box shows who last changed it and when. Only administrators allowed to post unfiltered HTML can edit them.
SMTP — Send your site’s email through an SMTP server so password resets and form messages arrive. Presets for Amazon SES, Brevo, Mailgun, SendGrid, Postmark, Zoho and Gmail; a test email that shows the server’s own error; settings can live in wp-config.php. Moving from WP Mail SMTP? One click copies its SMTP connection settings. Guide
Email Log — Email Log, in its own item in the admin menu by default (or under Tools, if you prefer), lists the email your site sends, with recipient, subject and whether it was sent or failed, plus filters by status and date and a search. Open any email to see its sender and headers, and the email itself the way it looked when it went out, with remote images blocked. Content storage can be switched off to keep only the envelope. Password-reset and sign-in links are removed before an email is stored, and a Two-Factor Login code email keeps only its envelope. Works with or without the SMTP feature, and with other SMTP plugins too.
Nice Default Emails — WordPress’s own plain-text emails (password resets, new-user and comment notices, update reports, personal data requests, and multisite sign-ups), and Adminkeep’s own contact form, go out in one clean HTML layout headed by your site’s name, with links you can click. WooCommerce and other plugins’ emails, and anything already sent as HTML, are left exactly as they are. No settings. wp adminkeep emails send --all [email protected] shows every one of them in your own inbox.
Contact Form — one simple form for any page: name, email and message, as a block or the [adminkeep_contact_form] shortcode. Messages are emailed to you through WordPress’s own mailer, so the SMTP feature delivers them and Email Log shows whether each one went out, with the server’s error if it did not. Works out of the box, protected by a WordPress nonce that needs no keys (not for sites that cache their pages), or by Cloudflare Turnstile or Google reCAPTCHA v3 with your own free keys. Nothing is stored. The form prints its own small style and script with itself, so nothing extra loads on other pages, and the spam check’s script loads only on pages that show the form.
Admin
User Registration Date — a sortable Registered column on the Users screen. WordPress records when every account was created but never shows it; this does, for every existing user, and newest-first sorting makes a wave of spam signups easy to spot. Guide
Content
Duplicate — copy any post or page as a draft. Custom fields, taxonomies, the featured image and page builder layouts (Elementor, ACF) come along intact, and the original is never modified. Guide
Live Draft — rework a published page in a private working copy, then publish it over the original. Same ID, same URL, and the old version is kept as a revision. Guide
Keep URL — rename or move a page and its old address keeps working, child pages included. Fills the gaps WordPress leaves for pages and leaves posts to core. Guide
Order — drag posts into the order you want on a dedicated Sort screen, one post type at a time. Lists that already ask for their own order, such as WooCommerce products and search results, are left alone. Guide
Replace Media — upload a new version of a file over the old one. Same file type keeps the same URL; a different type updates the posts that use it and redirects the old address. Guide
Performance
A feature you have not enabled registers zero hooks and loads zero assets.
Links
Website
Documentation
Guides
External services
Adminkeep connects to no outside service unless you switch on a feature that needs one and set it up. Two features can: SMTP sends your site’s email through the mail server you enter, and the Contact Form uses the spam check you choose (its WordPress nonce option uses none). Nothing is sent to Adminkeep.
Cloudflare Turnstile (Contact Form, when you choose it). On pages that show the form, the visitor’s browser loads Cloudflare’s script from challenges.cloudflare.com, which receives the visitor’s IP address and browser details in order to tell people from bots. When the visitor presses Send, your site sends Cloudflare your secret key and the check’s one-time token, and nothing else, to confirm it. Terms: https://www.cloudflare.com/website-terms/ — Privacy policy: https://www.cloudflare.com/privacypolicy/
Google reCAPTCHA v3 (Contact Form, when you choose it). On pages that show the form, the visitor’s browser loads Google’s script from www.google.com (and the code it needs from www.gstatic.com), which receive the visitor’s IP address and browser details in order to score the visit. When the visitor presses Send, your site sends Google your secret key and the check’s one-time token, and nothing else, to confirm it. Terms: https://policies.google.com/terms — Privacy policy: https://policies.google.com/privacy
WP-CLI
Everything on the Adminkeep settings screen, plus the Custom CSS, Header & Footer Code, SMTP and Contact Form screens, can be done from a shell with wp adminkeep.
wp adminkeep feature list — every feature and whether it is on
wp adminkeep feature enable disable_comments — switch a feature on (or `disable` it)
wp adminkeep feature set order post_types=post,page — change a feature's settings
wp adminkeep feature set two_factor roles=administrator,editor — choose who is asked for a login code
wp adminkeep feature disable two_factor — a way back in if the site cannot send email
wp adminkeep feature enable two_factor — switches it on and says where the recovery link was emailed
wp adminkeep setting set hide_unused=true — change a plugin-level setting
wp adminkeep comments purge — delete spam and trashed comments, in batches
wp adminkeep css set site.css — replace the Custom CSS from a file
wp adminkeep code set head analytics.html — replace one Header & Footer Code box (head, body or footer) from a file
wp adminkeep smtp set --host=smtp.example.com --port=587 — configure SMTP
wp adminkeep smtp test [email protected] — send a test email and see the server's reply
wp adminkeep emails send --all [email protected] — see WordPress's own emails in the Nice Default Emails layout
wp adminkeep smtp import wp-mail-smtp — copy the SMTP connection settings from WP Mail SMTP
wp adminkeep contact-form set --provider=turnstile --turnstile-site-key=
wp adminkeep contact-form get — the contact form's settings, and whether it is live
Run wp help adminkeep for the full reference. A change made here is cleaned and checked exactly as it is on the screen, and a mistyped value is refused rather than guessed at.
