Changelog

Two-Factor Login: an emailed code after the password

A new Site Lock switch asks the roles you choose for a six-digit code, emailed to them, after their password. Switching it on emails you a recovery link, so a site whose email stops working does not keep you out.

• New: Two-Factor Login, in Site Lock. Users in the roles you choose (administrators by default) enter a six-digit code, emailed to the address on their account, after their password on the main login screen. Nothing is emailed until the user presses "Email me the code". A code works once, for up to ten minutes, and a login waiting on its code ends 30 minutes after the password at the latest. On multisite, super admins are asked whenever administrators are.
• New: "Remember this device" on the code screen skips the code in that browser for 30 days, or the number you set.
• New: five wrong codes lock the code step for that account for 15 minutes, doubling each time it happens again, up to six hours. A remembered device is not affected, and the right code clears the count. At most five code emails go to one user in ten minutes, and wrong codes are reported as failed logins, so plugins that limit login attempts count them.
• New: switching Two-Factor Login on emails you a recovery link (from WP-CLI it goes to the site's administration email address). Opening it shows a page with one button that turns Two-Factor Login off without logging in and keeps the roles you chose. The link works once, is replaced each time the feature is switched on, and every administrator is emailed the time and IP address when it is used. The settings screen shows which address holds the current link, or says that the email could not be sent.
• New: two more ways back in if you are locked out: wp adminkeep feature disable two_factor, or define( 'ADMINKEEP_DISABLE_TWO_FACTOR', true ); in wp-config.php.
• New: other login forms, such as WooCommerce's My Account, refuse users in the chosen roles and point them to the main login screen. The REST API, application passwords and XML-RPC are not asked for a code.
• New: the code and recovery emails go out in the Nice Default Emails layout, whether or not that feature is on, and through the SMTP feature when it is on.
• Changed: the Email Log keeps only the envelope of a login code or recovery link email, never its body.
• Changed: deleting the plugin with "Delete all Adminkeep data when the plugin is deleted" switched on also removes remembered devices, any login waiting on its code, any wrong-code lock and the recovery link.

A page-cache warning for the nonce, and the Live Preview shows emails again

Settings → Contact Form now says when a caching plugin looks active while WordPress Nonce is the spam protection, since the nonce does not work on cached pages. The Email Log preview works in the wordpress.org Live Preview again, and every WP-CLI help page shows a whole summary.

• New: Settings → Contact Form warns when WordPress Nonce is chosen on a site where a caching plugin looks active, since the nonce does not work on cached pages. The feature's state on the Adminkeep settings panel reads "Live, page cache detected". A new adminkeep_contact_form_page_cache_detected filter overrides the detection either way.
• Fixed: the Email Log preview was empty in the wordpress.org Live Preview.
• Fixed: the help for wp adminkeep setting, contact-form and email-log list no longer shows a summary cut off mid-sentence.

The contact form works out of the box

The Contact Form works as soon as you switch it on, protected by a WordPress nonce that needs no keys and no outside service. Sites that cache their pages choose Cloudflare Turnstile or Google reCAPTCHA v3 instead.

• New: the Contact Form works out of the box, protected by a WordPress nonce: no keys and no outside service. Not for sites that cache their pages; choose Cloudflare Turnstile or Google reCAPTCHA there.
• Changed: the Contact Form's "None (form hidden)" choice is gone. To take the form down, remove its block or shortcode, or switch the feature off.
• Improved: the contact form's fields have a clean look of their own on themes that do not style form fields, such as Twenty Twenty-Five. Themes that do still win.
• Improved: the contact form's email says which page it was sent from on any page of the site, archives and author pages included.
• Changed: Settings → Contact Form shows how to place the form in a side box, and warns only when the form is hidden.
• Fixed: after switching the contact form's spam protection, the screen no longer shows the old provider's last error.

A contact form, without a form plugin

Adminkeep gets a simple contact form: Name, Email and Message, emailed to you and stored nowhere, protected by Cloudflare Turnstile or Google reCAPTCHA v3.

• New: Contact Form, in the Email group. Switch it on and Settings → Contact Form holds the settings. Add the Contact Form block (under Widgets) to a page, or use the [adminkeep_contact_form] shortcode. Each message is emailed to the address you choose (the admin email by default), with the visitor as Reply-To, and nothing is stored on your site. With Email Log on, you can see each message and whether it was sent.
• New: spam protection is required. Choose Cloudflare Turnstile or Google reCAPTCHA v3 and save its keys; until then the form is hidden from visitors, and administrators see a note where it will appear. Secret keys are stored encrypted and never shown again, or can be set in wp-config.php as ADMINKEEP_TURNSTILE_SITE_KEY, ADMINKEEP_TURNSTILE_SECRET, ADMINKEEP_RECAPTCHA_SITE_KEY and ADMINKEEP_RECAPTCHA_SECRET.
• New: settings for Send to, a Subject prefix, the success and error messages and, for reCAPTCHA, a score threshold (0.5 by default). When a message cannot be sent for a reason on your side, the screen shows a "Last submission failed" line naming the cause.
• New WP-CLI commands: wp adminkeep contact-form get and wp adminkeep contact-form set.
• Changed: Adminkeep now connects to an outside service only for the two features you switch on and set up: SMTP (your own mail server) and the Contact Form spam check (Cloudflare or Google). On a page that shows the form, the provider's script loads in the visitor's browser. Nothing is sent to us, and pages without the form load nothing extra. The privacy page has the details.

Deleting the plugin keeps your data, and Header & Footer Code over REST

Deleting Adminkeep no longer takes your settings with it, Header & Footer Code gets the REST route Custom CSS already had, and both code screens save without a reload.

• Changed: deleting Adminkeep now keeps its settings and data (your Custom CSS and Header & Footer Code, the SMTP settings, the email log and the Keep URL redirects), so installing it again brings everything back. To remove all of it when the plugin is deleted, switch on "Delete all Adminkeep data when the plugin is deleted" in the new Plugin settings tab under Settings → Adminkeep, or run wp adminkeep setting set delete_data=true. Until this release, deleting the plugin always removed its data.
• New: Header & Footer Code can be read and saved over the REST API at adminkeep/v1/header-footer-code, so a site reached with an application password can have its tags updated without logging in to wp-admin. Send any of head, body and footer; boxes left out are kept, and an empty string clears one. The same permissions and checks apply as on the screen.
• Improved: Appearance → Custom CSS and Appearance → Header & Footer Code save without reloading the page. The usual "saved" message appears under the heading, and if a save is refused, what you typed stays where it is.
• Fixed: deleting the plugin now also clears the clean-up Live Draft schedules after a merge, and, with data deletion switched on, the marker it leaves on a merged copy.

Edit Custom CSS on your live site

Custom CSS gets a live editor: a code panel beside your site that restyles the page as you type, the way the Customizer's CSS box did. Plus a REST route for the CSS and one feature order everywhere.

• New: edit Custom CSS on your live site. Edit CSS in the admin bar opens a code panel beside the page, and the page restyles as you type. Nothing is saved until you press Save. The panel stays open while you browse to other pages, until you close it. Appearance → Custom CSS opens it too, from its Live preview box.
• New: a Custom CSS setting, "Show Edit CSS in the admin bar", on by default. Untick it to hide the admin bar item; the panel still opens from Appearance → Custom CSS.
• New: Custom CSS can be read and saved over the REST API at adminkeep/v1/custom-css, so a site reached with an application password can have its CSS updated without logging in to wp-admin. The same permissions and checks apply as on the Custom CSS screen.
• Changed: the settings now list the feature groups as Site Lock, Appearance, Email, Admin and Content.

Header & Footer Code, and Email Log in the admin menu

A home for the snippets services ask you to paste into your site, and Email Log moves up to an item of its own in the admin menu.

• New: Header & Footer Code, in the Appearance group. Three boxes (Head, Body open and Footer) for analytics and verification tags, tag managers and chat widgets, printed on the front end of every page exactly as saved, and kept when you change themes. Each box shows who last changed it and when, and holds up to 64 KB. Only administrators who are allowed to post unfiltered HTML can open it.
• New WP-CLI commands: wp adminkeep code get <head|body|footer> prints one box, and wp adminkeep code set <head|body|footer> [<file>] replaces it from a file or standard input.
• Changed: Email Log now has its own item in the admin menu, right below where the Email Log plugin puts its own, with a different envelope icon so the two can be told apart. To keep it under Tools, tick "Show Email Log under the Tools menu" in the Email Log settings. Old Tools → Email Log links still work.
• Changed: the Adminkeep logo beside each feature screen's heading (Email Log, SMTP, Custom CSS, Header & Footer Code, Sort, Replace file) opens that feature's own settings instead of the settings overview.
• Changed: wp adminkeep css get prints the CSS exactly as stored, with no newline added, so its output can be piped back into css set unchanged.
• Fixed: Custom CSS that starts with a blank line keeps it when saved from the screen.

Nice Default Emails and a copy from WP Mail SMTP

WordPress's own emails get a clean HTML layout, SMTP settings can be copied across from WP Mail SMTP, and Disable File Editing now covers multisite super admins.

• New: Nice Default Emails, in the Email group. WordPress's own plain-text emails (password resets, new-user and comment notices, update reports, personal data requests, and the multisite sign-up emails) go out in one clean HTML layout headed by your site's name, with links you can click. WooCommerce and other plugins' emails, and anything already sent as HTML, are left as they are. No settings.
• New WP-CLI commands: wp adminkeep emails list|send. list shows the core emails Nice Default Emails covers; send <id>... --to=<email> (or --all) sends them to one address so you can see how they look in a real inbox.
• New: moving from WP Mail SMTP? When it has an SMTP server set up, Settings → SMTP shows a "Copy from WP Mail SMTP" box that copies the server, port, encryption, username, password, and the From address and name. wp adminkeep smtp import wp-mail-smtp [--dry-run] does the same from a shell. Values held in wp-config.php are kept. WP Mail SMTP set to an API mailer such as SendLayer or the Gmail API has no SMTP connection to copy.
• Fixed: Disable File Editing now applies to super admins on a multisite network.

Username Privacy

A new Site Lock switch keeps your usernames out of public view.

• New: Username Privacy, in Site Lock. Author pages and the ?author=1 probe answer "not found" to visitors, the REST users list is closed to them, authors are left out of the sitemap (WordPress's own and Yoast SEO's) and out of embed previews, and author names in your theme stop linking to author pages. Logged-in users see everything as before; nothing is written.

Hide unused features, site-wide

The "Hide unused features" switch now applies to the whole site instead of one administrator at a time, and WP-CLI gets a setting command for plugin-level settings.

• Changed: "Hide unused features" is one setting for the whole site instead of one per administrator. If any administrator had it on, it stays on after the update.
• Changed: WP-CLI wp adminkeep view is replaced by wp adminkeep setting get [<key>] and wp adminkeep setting set key=value, the same shape as feature set. wp adminkeep setting set hide_unused=true does what view hide-unused --user=<user> did, for the whole site.

Plugin details under Installation Lockdown

Plugin details open again while Installation Lockdown is on, and the settings screen view gets a WP-CLI command.

• Fixed: with Installation Lockdown on, "View details" for a plugin (from an update notice or a "Requires:" line) opened on an error. It now opens; installing from it, from the directory or from a ZIP, and replacing a plugin or theme with a ZIP all stay blocked. Multisite super admins are not affected.
• New WP-CLI commands: wp adminkeep view get|hide-unused|show-all --user=<user> read and set whether the settings screen hides unused features for that user. (Replaced in 1.8.1 by wp adminkeep setting set hide_unused=true|false, site-wide.)

Email Log

See every email your site sends, whether it went out, and what it said. Plus a move to Settings → Adminkeep and a fix for SMTP settings held in wp-config.php.

• New: Email Log. Tools → Email Log lists the email your site sends, with recipient, subject and whether it was sent or failed, plus filters by status and date and a search; the sender, headers and content are one click away in the preview.
• New: Email Log filters sit in the list's top bar, with a Period filter (1 hour to 30 days, or a custom date range), and Screen Options shows or hides columns, including a From column that starts hidden.
• New: Preview a logged email in a window, rendered as it was sent, with its source a tab away. Scripts and remote images are blocked in the preview. Emails that carry both HTML and plain text show each in its own tab.
• The log records the sender an SMTP plugin really used, even one that sets it at send time such as FluentSMTP, with the sender's name.
• Password-reset, sign-in and activation links are removed before an email is stored, and you can switch content storage off.
• Old entries are deleted automatically (30 days by default; choose from 7 days up to 2 years) and the log is trimmed to the newest 10,000.
• New WP-CLI commands: wp adminkeep email-log list|get|count|purge.
• New: bring your history across from the Email Log plugin with wp adminkeep email-log import email-log. Emails are stored the way Adminkeep would have stored them (links removed, the retention setting respected), running it again only adds what is new, and the other plugin's log is left as it was.
• New: while the Email Log plugin is active, Tools → Email Log shows a "Copy from Email Log" button that does the same import from the screen, and says how many emails it copied and skipped.
• Works with or without the SMTP feature, and only administrators can open the log.
• Changed: Adminkeep's settings moved from their own top-level menu to Settings → Adminkeep. Old links and bookmarks still work, and the Plugins screen now has a Settings link.
• Fixed: saving the SMTP screen while ADMINKEEP_SMTP_* constants were set in wp-config.php cleared the saved values for those fields, so removing the constants later left SMTP without a host or password. The saved values are now kept, as wp adminkeep smtp set already did.

Hide unused features

A settings page that shows your setup, not the whole catalogue. Plus a round of fixes to the settings, SMTP and Users screens.

• New: Hide unused features — a switch on the settings page. Turn it on and the menu lists only the features you use. Search still finds the rest. (Per administrator until 1.8.1 made it site-wide.)
• Improved: the Overview lists the features you have switched on first, and its "features enabled" count updates as soon as you save.
• Improved: the Registered column on the Users screen is narrower and shows a short month (Jan 10, 2024).
• Fixed: the SMTP test email was sent twice.
• Fixed: notices from other plugins were squeezed into the Adminkeep header on the settings page. They now sit above it.
• Fixed: after switching on Custom CSS or SMTP, the link to its screen appears as soon as you save, without reloading.
• Fixed: the settings filter only searched the first group.

WP-CLI

Everything on the settings screens, from the command line. Set up a new site from a script, apply the same settings to many sites, or hand the job to an AI agent.

• New: WP-CLI — wp adminkeep switches features on and off, changes their settings, counts and cleans up comments, replaces the Custom CSS, configures SMTP and sends a test email.
• New: wp help adminkeep is the complete reference, and feature list, feature get and smtp get take --format=json. A mistake exits 1 and writes nothing.

SMTP

Password resets and form messages that actually arrive. This release sends your site's email through a real mail server, in a new Email group.

• New: SMTP — send your site's email through any SMTP server. Presets for Amazon SES, Brevo, Mailgun, SendGrid, Postmark, Zoho and Gmail; a test email that shows the server's own reply; settings that can live in wp-config.php.
• Changed: screens Adminkeep adds elsewhere in the admin (SMTP, Custom CSS, Order, Replace file) now open their heading with a small Adminkeep mark that links to the Adminkeep settings. The settings page shows the mark too.

User Registration Date

WordPress records when every account was created and never shows it. This release does: a Registered column on the Users screen, in a new Admin group.

• New: User Registration Date — a sortable Registered column on Users → All Users. It uses the date WordPress already stores, so every existing user has one. Click the heading to see the newest accounts first.
• Changed: the switch on each panel now reads "Enable this feature" — most features are not locks.
• Removed: the Overview note about Version Lock leaving in 1.1.0.

Custom CSS

CSS that belongs to your site instead of your theme, in a new Appearance group.

• New: Custom CSS — site-level front-end CSS under Appearance → Custom CSS, in WordPress's own code editor. It stays when you switch themes, and your theme's Additional CSS is left alone.
• Changed: internal names now match the plugin name. Settings and redirects are carried over automatically.
• Changed: plugin and author links now point to adminkeep.com.

Adminkeep arrives on wordpress.org

The first release in the WordPress plugin directory. Ten features in two groups — Site Lock and Content — every one of them off until you turn it on. Install it from Plugins → Add New Plugin, and updates come through WordPress from here on.