內容簡介
Keel Defaults 是一款幫助 WordPress 使用者簡化設定的外掛，提供 40 項預設選項，讓使用者能夠輕鬆管理網站安全性、更新及隱私設定，確保網站運行安全且高效。
【主要功能】
• 提供 40 項預設設定選項
• 自動檢測 WordPress 安全性問題
• 防止測試網站發送真實郵件
• 顯示所有設定及其狀態
• 支援多站點網路的一致性管理
外掛標籤
開發者團隊
原文外掛簡介
A new WordPress site leaves a lot of small decisions to you: how strong passwords must be, when updates happen, what the outside world can see, what a copied test site is allowed to do. Keel Defaults makes those decisions sensibly from the start and puts all 40 defaults on one screen, in plain language, where you can change any of them.
Try Keel live in WordPress Playground — a temporary WordPress site opens in your browser with the current release of Keel already switched on. No hosting, installation, or account required.
What Keel does for you
Tells you when WordPress itself needs attention. If WordPress.org flags your version of WordPress as insecure, Keel says so in Site Health. When a secure fix exists for your version, Keel names it and gives an administrator a button to install it. If no fix exists yet, it tells you that too.
Makes safer settings routine. Better password protection, less exposed to the outside world, and practical choices for updates and revisions, without a collection of small single-purpose plugins.
Stops test sites emailing real people. Staging and local copies of your site send no email by default, so a copied database cannot email your customers, members, or clients by surprise.
Shows you exactly what it is doing. One Site Health page lists every setting and its current state, and points out likely overlaps with other plugins.
Keeps a multisite network consistent. A Super Admin can set chosen defaults for every site from one Network Policy screen. Each site’s own choices are kept underneath and come back when the policy is lifted.
Who it is for
Keel is especially useful if you build or look after many sites, as a freelancer, an agency, or the owner of a multisite network. It is just as useful if you have one site that matters too much to leave its basic safeguards to memory.
Safe to try, easy to undo
Every setting is one switch with the reason for it written beside it, under Settings → Site Defaults. Keel does not edit or delete your existing posts, pages, media, or comments. The one change it makes to files by default is giving new uploads lowercase filenames. Turn a setting off and that behavior returns to WordPress; uninstall Keel and its settings are removed.
Good to know before you activate
Out of the box, Keel turns off comments, trackbacks, and pingbacks, hides public author archives, and stops other sites displaying yours inside a frame. Nothing is deleted, and each of these is a switch you can turn back. The FAQ below explains each one.
External services
Keel contacts two outside services. Neither is sent personal data.
Have I Been Pwned: checking passwords against known breaches
When the Require strong passwords default is enabled, Keel screens new passwords against the Have I Been Pwned Pwned Passwords range API (https://api.pwnedpasswords.com) and rejects passwords found in known breaches.
What is sent. Only the first five characters of the password’s SHA-1 hash, a method called k-anonymity. Never the password, never the full hash, and no personal data.
When. Only when a password is being set or changed and the default is on.
How to turn it off. Turn off the strong-password default, add define( 'KEEL_DISABLE_HIBP', true ); to wp-config.php, or use the keel_disable_hibp filter.
If the service cannot be reached. If the API is unreachable, or answers with a truncated or malformed response, the check is skipped and the password is allowed, so a breach-data outage never blocks a password change. It is not skipped silently: the failure is recorded and reported under Site Health. Only the kind of failure and when it happened are stored, never the password or the hash prefix.
Have I Been Pwned is operated by Troy Hunt; see https://haveibeenpwned.com/Privacy and https://haveibeenpwned.com/API/v3 for its terms and privacy policy.
WordPress.org: checking whether your WordPress version is vulnerable
Keel asks WordPress.org whether the installed version of WordPress has known vulnerabilities, using the core stable-check API (https://api.wordpress.org/core/stable-check/1.0/). This is WordPress.org’s own service, on the same host WordPress already contacts for updates and translations, although WordPress itself never queries it.
What is sent. No site data beyond the user-agent, which identifies the plugin and the site’s home URL in the same way WordPress’s own update requests identify the site.
How often. Keel keeps the answer for a day. It asks again sooner only when WordPress’s own update check offers a release that answer does not list yet, so a new security release is reported the day it ships.
If the service cannot be reached. If WordPress.org is unreachable or answers with something unusable, the failure is remembered for five minutes so an outage does not slow down every admin screen, and Site Health reports that the status could not be determined rather than implying the site is fine.
WordPress.org’s privacy policy is at https://wordpress.org/about/privacy/.
Credits
Austin Ginder of Anchor Hosting (anchor.host · @anchorhost) reviewed Keel for security, and the plugin is better for it. Thank you, Austin.
Keel grew out of Better by Default, a WordPress defaults plugin written by the same author (@dknauss) as a teaching version for the Edmonton WordPress meetup, WPYEG: https://github.com/WPYEG/Better-by-Default
Better by Default is published under the GPL-3.0-or-later; its sole author additionally licenses the portions carried over here under the GPL-2.0-or-later. Keel keeps its core architecture and adds further hardening and admin defaults adapted from the Agency Experience plugin (GPL-2.0-or-later).
Agency Experience is itself a hard fork of the 10up Experience plugin by 10up (GPL-2.0-or-later): https://github.com/10up/10up-experience — so several of Keel’s adapted defaults ultimately descend from code first written for 10up Experience. Copyright in that work is retained by 10up and its contributors, and 10up retains its marks; Keel is not affiliated with or endorsed by 10up. See LICENSE for the full GPL-2.0 text.
Support This Plugin
Keel is free and will stay free. If it saves you an afternoon of securing a new site, or keeps a staging server from emailing your client’s customers, you can support its maintenance through GitHub Sponsors.
Bug reports and feature requests are welcome on the issue tracker: https://github.com/dknauss/keel/issues. If you have found a security problem, please report it privately rather than in a public issue — SECURITY.md ships with the plugin and says how.
