Frequently asked questions

Not unless you ask it to. Turning Disable Comments on only hides them — a test asserts the comment rows are untouched after a full enable-and-disable cycle.

There is a separate cleanup button that does delete, and it deletes spam and trashed comments only unless you tick the box to include approved ones. It shows the exact count, asks you to confirm, and cannot be undone.

Yes, instantly. Switch a feature off and your site behaves exactly as it did before. Its saved settings stay, and so does anything Email Log has already logged, so switching it back on picks up where you left off.

They stay, unless you ask otherwise. Since 2.2.0, deleting the plugin keeps its settings, your Custom CSS and Header & Footer Code, the SMTP and Contact Form settings, the email log, the Keep URL redirects, and the devices Two-Factor Login remembers with its recovery link, so installing it again brings everything back. Deactivating never deletes anything.

To remove all of it when the plugin is deleted, switch on "Delete all Adminkeep data when the plugin is deleted" under Settings → Adminkeep → Plugin settings before you delete it, or run wp adminkeep setting set delete_data=true.

Yes. Bots usually POST straight to wp-comments-post.php without ever loading your page, so hiding the comment form does nothing. Adminkeep refuses those requests with a 403 before WordPress processes them, and refuses comment creation through the REST API as well.

Not exactly, and it would be dishonest to say otherwise. The setting (Installation Lockdown in the plugin) is enforced in PHP, so anyone with filesystem, database or WP-CLI access can bypass it.

It reliably stops accidents and casual changes — a client installing something on a whim, or uploading a plugin zip from who knows where. Treat it as a policy guard, not a security boundary.

Because it cannot be switched off from the admin, and it blocks updates as well as installs. Once it is in wp-config.php you need file access to undo it, which strands people. Adminkeep's switch for blocking plugin and theme installs (Installation Lockdown on the settings screen) filters capabilities instead, leaves updates working, and can always be turned off from the settings screen.

If you want the harder version, the constant is still there and this plugin does not interfere with it.

Yes. In your WordPress admin go to Plugins → Add New Plugin, search for "Adminkeep" and install it from there. Updates arrive through the normal WordPress Updates screen.

Adminkeep was called WP Pro Admin before it joined the directory. It is the same plugin under a new name.

Gmail and Google Workspace: yes, with an app password.

Microsoft 365 and Outlook.com: no. Microsoft now requires signing in through Microsoft (OAuth) for SMTP, which this feature does not support. A dedicated SMTP plugin is the better choice there.

For many sites, yes. Its SMTP feature sends your site's email through the mail server you choose, with presets for Amazon SES, Brevo, Mailgun, SendGrid, Postmark, Zoho and Gmail (or any other server you type in), a test email that shows what the server said, and wp-config.php constants for the server, login and sender.

It does not cover Microsoft 365 or Outlook.com, which require signing in through Microsoft (OAuth). A dedicated SMTP plugin is the better choice there.

The Email Log works with or without SMTP. It records what WordPress was asked to send, whether the mail goes out through Adminkeep's SMTP, another SMTP plugin or no SMTP setup at all. If another plugin takes over sending, its emails may show as Unconfirmed, because WordPress never hears back whether they went out.

Yes, since 1.10.0, when WP Mail SMTP sends through an SMTP server. Switch on SMTP in Adminkeep and open Settings → SMTP: a Copy from WP Mail SMTP box copies the server, port, encryption, username, password, and the From address and name. Values you hold in wp-config.php are kept. From a shell, wp adminkeep smtp import wp-mail-smtp does the same.

API mailers such as SendLayer or the Gmail API are not SMTP connections, so there is nothing to copy from them. If the password cannot be read, the screen says so and you enter it after copying. Then send a test email and deactivate WP Mail SMTP, so only one plugin configures the mailer.

Encrypted in your site's database, which protects it in database backups, and it is not shown again once saved.

For the strongest setup, define ADMINKEEP_SMTP_PASS and the other ADMINKEEP_SMTP_* constants in wp-config.php: values set there are not saved to the database, and the settings form does not display them.

Yes, since 1.5.0. wp adminkeep switches features on and off, changes their settings, cleans up comments, replaces the Custom CSS, configures SMTP and sends a test email. That covers everything on the settings screens. Since 1.7.0, wp adminkeep email-log also reads, counts, purges and imports the email log, since 1.8.1 wp adminkeep setting reads and changes plugin-level settings such as hide_unused, the "Hide unused features" switch, for the whole site, since 1.10.0 wp adminkeep emails sends WordPress's own emails to one address and wp adminkeep smtp import copies SMTP settings from WP Mail SMTP, since 2.0.0 wp adminkeep code get and code set read and replace the Header & Footer Code boxes, and since 2.2.0 wp adminkeep setting set delete_data=true makes deleting the plugin remove its data.

Run wp help adminkeep for the full reference, or read the WP-CLI commands page in the docs. Lists and settings can be printed as JSON, so scripts and AI agents can use it too.

For some jobs. Adminkeep is a smaller plugin: 19 features, each off until you switch it on. They are an email log, custom CSS, header and footer code, SMTP, an HTML layout for WordPress's own emails, a contact form, content tools (duplicate, post ordering, edit a published page without unpublishing, replace media, keep old page addresses working), a user registration date column, and hardening switches: disable comments, disable XML-RPC, disable the file editor, block plugin and theme installs, disable user registration, hide usernames from visitors, and two-factor login with an emailed code.

The two overlap in places: ASE's wordpress.org description lists duplicate post, post order, email via SMTP, custom CSS, disabling comments, disabling XML-RPC and media replacement, and ASE and Adminkeep both have a place for header and footer code. ASE also covers many admin customisations Adminkeep does not, such as an admin menu editor, image resizing and disabling the block editor. Which fits depends on the jobs you need done.

By email, since 2.6.0. After the password, a second screen shows the account's email address, partly hidden, and sends a six-digit code there when you press "Email me the code". The code works once, for up to ten minutes. It is sent the same way WordPress sends a password reset, so Adminkeep's SMTP feature delivers it, and Email Log shows whether it went out without keeping the code itself.

Nobody in the chosen roles is signed in without the code. If password resets from your site do not arrive either, the site cannot send email, and those users are locked out until email is fixed or Two-Factor Login is switched off. The next question covers how. Five wrong codes lock the code step for that account for 15 minutes, and each lock after that doubles the wait, up to six hours.

There are three ways, and none of them needs you to log in first. The recovery link: switching Two-Factor Login on emails one to you, and the settings screen shows which address it went to. Opening it shows a page with one button, "Turn off Two-Factor Login", which switches the feature off and keeps the roles you chose. WP-CLI: wp adminkeep feature disable two_factor. Or wp-config.php: add define( 'ADMINKEEP_DISABLE_TWO_FACTOR', true );

The recovery link does not sign anyone in, so your password is still needed. It works once, and a new one replaces it each time Two-Factor Login is switched on, so keep the newest email. Anyone who has the link can switch Two-Factor Login off, so treat that email like a password. When it is used, every administrator is emailed the time and the IP address.

The code is asked for on the main WordPress login screen. Other forms that sign people in, such as WooCommerce's My Account or a custom form, cannot show the code screen, so they refuse users in the chosen roles and link them to the main login screen. Customers are not in those roles and log in at My Account as before. A plugin that only moves the login screen to another address works as usual; one that replaces the login screen with its own form cannot show the code screen, so keep the recovery email.

The REST API, application passwords and XML-RPC are not asked for a code, because the apps that use them have no screen to type one into. Authenticator apps, backup codes and passkeys are not part of the feature: the code is emailed.

Nowhere. Each message is emailed to the address you set under Settings → Contact Form, or to the admin email if you leave it empty, and the form keeps no copy. There is no entries screen.

If Email Log is switched on, it keeps a copy of the email with its status (Sent, Failed or Unconfirmed) for the retention period you choose. That is the way to see whether a message was sent.

Since 2.4.0 the form works as soon as the feature is on, protected by a WordPress nonce that needs no keys. It is hidden only while Cloudflare Turnstile or Google reCAPTCHA v3 is chosen under Settings → Contact Form without both of its keys saved. Save them, or choose WordPress Nonce. Until then visitors see nothing where the form goes, and administrators see a note linked to the settings screen.

If you placed the form with the shortcode and it shows as plain text, the Contact Form feature is switched off. Switch it on in Settings → Adminkeep, or use the Contact Form block, which shows nothing when the feature is off.

No. It covers only the emails WordPress core writes itself: password resets, new-user notices, password and email change notices, comment notifications, automatic update reports, the recovery mode email, personal data request emails and, on multisite, the sign-up and activation emails. 25 in all, 19 on a single site.

Emails from WooCommerce, form plugins and every other plugin are left exactly as they are, and so is any email that is already HTML. Each core email is recognised as WordPress builds it, not guessed from its subject. To see all of them in your own inbox, run wp adminkeep emails send --all [email protected].

The one exception is Adminkeep's own Contact Form (2.3.0): with Nice Default Emails on, its notification uses the same layout.

Yes, since 2.0.0. Switch on Header & Footer Code, in the Appearance group, and open Appearance → Header & Footer Code. The Google tag for GA4, or Tag Manager's main snippet, goes in the Head box; Tag Manager's noscript snippet goes in the Body open box. The code prints on every front-end page exactly as you pasted it, and stays when you change themes.

Adminkeep prints the snippets; the tags themselves are set up in Google Analytics or Tag Manager. The guide to adding Google Tag Manager to WordPress walks through both snippets and how to check they are live.

On the front end of your site, on every page. The Head box goes near the top of the head, before your theme's styles and scripts. The Body open box goes just after the body opens, on themes that support it (current themes do). The Footer box goes at the end of the page, after WordPress's own footer scripts. None of it is added to the admin, the login page, feeds or the REST API.

Editing needs both manage_options and unfiltered_html: administrators on a single site, super admins only on multisite, and nobody when DISALLOW_UNFILTERED_HTML is set. Each box holds up to 64 KB and shows who last changed it and when. Switching the feature off stops the code printing and keeps it.

Yes, since 2.1.0. With Custom CSS switched on, click Edit CSS in the admin bar on any page of your site. A code panel opens beside the page, and the page restyles as you type. Only you see the change until you press Save, and the panel stays open as you browse to other pages.

It works the same on classic and block themes. On a phone, where WordPress hides the admin bar items, open it from Appearance → Custom CSS → Open live editor.

Yes. Custom CSS has a route at /wp-json/adminkeep/v1/custom-css since 2.1.0, and Header & Footer Code one at /wp-json/adminkeep/v1/header-footer-code since 2.2.0. Both answer GET and POST, and work with a WordPress application password, so a script or an AI agent can update a site without logging in to wp-admin or having SSH access.

They apply the same permissions and checks as the screens: HTML is refused in CSS, and each code box holds up to 64 KB. The Custom CSS and Header & Footer Code docs have examples.

No. Password-reset, sign-in and activation links are taken out before an email is stored — it catches the common link formats. If a site sends sign-in links in an unusual shape, switch content storage off.

You can also switch off content storage entirely and keep only the envelope: who, when, subject and status.