內容簡介
Keel Defaults 外掛為 WordPress 安裝提供了一系列合理的預設選項，讓使用者可以輕鬆管理網站的各項設定。所有的預設選項都能在設定頁面中清楚顯示，並可隨時開關，確保網站功能的透明性與可控性。
【主要功能】
• 提供39項可調整的預設選項
• 確保關閉功能真正生效
• 直觀的網站健康狀態顯示
• 阻止非生產環境的外發郵件
• 支援多站點網路的設定管理
外掛標籤
開發者團隊
原文外掛簡介
Keel adds a menu of sensible defaults to any WordPress install, each one a switch under Settings → Site Defaults. Nothing is hidden and nothing is all-or-nothing — you can see exactly what the plugin does to your site and turn any switch on or off. All 39 defaults are declared in a single schema array that drives both the settings screen and the code that wires them to WordPress.
Disabling something means it is actually disabled. When you switch comments off, they are off below the presentation layer, not merely hidden by the theme template and the REST route — ask the database directly with get_comments() and there is nothing to hand back. The same care runs through the rest: closing the REST API also removes the link advertising it, and disabling comments also stops the comment feed from answering requests.
Site Health shows you the whole posture, read-only: every default and its current state on one screen, so you can see what the site is actually doing without clicking through tabs. It also reports when another plugin is controlling the same settings, which otherwise fails silently.
Outgoing email stops at the edge of production. An unsanitized database copied down from production carries real customer addresses and whatever mail service production was using, so a cron run or a bulk action can email real people from a staging site or a laptop. Keel suppresses outgoing mail on any environment that is not production by default. It does nothing on production, and Keel says so in an admin notice so no admin is left wondering why a password reset never arrived.
Keel works the same on a Multisite network. Activated across multisite, Keel seeds every existing site and every site created afterwards, so a later change to a default cannot apply to some sites and not others. A Super Admin can see and change any setting for the whole network under Network Admin → Settings → Network Policy. Sub-sites on the network see those settings as locked, with their own saved values untouched underneath, so lifting a policy returns each site to exactly what it had.
External services
When the Require strong passwords default is enabled, Keel screens new passwords against the Have I Been Pwned Pwned Passwords range API (https://api.pwnedpasswords.com) to reject passwords found in known breaches. This uses k-anonymity: only the first five characters of the password’s SHA-1 hash are ever sent — never the password, and never the full hash. No personal data is transmitted. The check runs only when a password is being set or changed and the default is on. It can be disabled with define( 'KEEL_DISABLE_HIBP', true ); in wp-config.php, with the keel_disable_hibp filter, or by turning off the strong-password default. If the API is unreachable, or answers with a truncated or malformed response, the check is skipped and the password is allowed — a breach-data outage never blocks a password change. It is not skipped silently: the failure is recorded and reported under Site Health, so a site whose screening has stopped working can tell. Only the kind of failure and when it happened are stored — never the password, and never the hash prefix. Have I Been Pwned is operated by Troy Hunt; see https://haveibeenpwned.com/Privacy and https://haveibeenpwned.com/API/v3 for its terms and privacy policy.
Recommended wp-config.php hardening
A few defences live best in wp-config.php, outside any plugin: they apply before plugins load and cannot be switched off from the dashboard. These are optional and independent of Keel — add the ones that fit your site.
define( 'DISALLOW_FILE_EDIT', true ); — removes the built-in plugin and theme code editors, so a compromised admin account or foolhardy admin cannot edit PHP from the dashboard.
define( 'WP_POST_REVISIONS', 10 ); — caps stored post revisions so the database does not grow without bound. Keel's **Post Revision Retention** control can govern the same policy after plugins load; a numeric or false constant remains the higher-level operator choice and locks that control.
define( 'AUTOSAVE_INTERVAL', 120 ); — lengthens the editor autosave interval. This is independent of Keel's Heartbeat throttle: both influence how often the editor saves in the background, but neither replaces or overrides the other.
Credits
Keel is a de-branded evolution of Better by Default, the WordPress defaults plugin by WPYEG (a teaching version for the Edmonton WordPress meetup): https://github.com/WPYEG/Better-by-Default
Better by Default is published under the GPL-3.0-or-later; its sole author, who also wrote Keel (@dknauss), additionally licenses the portions carried over here under the GPL-2.0-or-later. Keel keeps Better by Default’s core architecture — a single schema array that drives both the settings screen and the bootstrap, where each default is one array entry plus one hook — and adds further hardening and admin defaults adapted from the Pixel Managed Platform plugin (GPL-2.0-or-later).
The Pixel version is itself a hard fork of the 10up Experience plugin by 10up (GPL-2.0-or-later): https://github.com/10up/10up-experience — so several of Keel’s adapted defaults ultimately descend from code first written for 10up Experience. Copyright in that work is retained by 10up and its contributors, and 10up retains its marks; Keel is not affiliated with or endorsed by 10up. See LICENSE for the full GPL-2.0 text.
Support This Plugin
Keel is free and will stay free. If it saves you an afternoon of hardening a new site, or keeps a staging server from emailing your client’s customers, you can support its maintenance through GitHub Sponsors.
Bug reports and feature requests are welcome on the issue tracker: https://github.com/dknauss/keel/issues. If you have found a security problem, please report it privately rather than in a public issue — SECURITY.md ships with the plugin and says how.
