Keel ⚓

Keel flips a menu of sensible security, update, privacy, UX, and performance defaults onto any WordPress install — each one a switch under Settings → Keel. Nothing is hidden and nothing is all-or-nothing: you can see exactly what the plugin does to your site, in one place, and turn any piece off.

The consistency is the point. Closing the REST API also removes the discovery link that advertises it; disabling comments also stops the comment feed answering. Where a trade is deliberate it is documented rather than papered over — oEmbed stays reachable when the REST gate is closed, alone among the four measured plugins that close REST outright, so other sites can still embed your posts instead of silently degrading them to bare links.

One array — keel_defaults_schema() — is the single source of truth, driving both the settings screen and the bootstrap that wires each enabled default to its WordPress hook. Adding a default is one array entry plus one if-block; there is no new settings-page code to write.

Two things it does that a settings screen usually does not: Site Health reports the posture read-only, so the site’s actual configuration is legible without clicking through tabs; and it notices when another plugin is setting the same defaults. Two plugins can both set a session length, WordPress keeps whichever ran last, and the loser’s settings screen goes on displaying a value the site does not use with no error anywhere. Keel reports the collision and names what is contesting what — it does not tell you which plugin to keep, because a plugin answering that is arguing for its own retention.