Keel ⚓

Keel adds 39 sane WordPress defaults for security, updates, privacy, content, media, email, UX, and performance — each one visible under Settings → Site Defaults and independently switchable. Nothing is hidden and deactivation returns WordPress to its prior behaviour.

The 0.6 release line closes a gap in WordPress core-update reporting. Keel asks WordPress.org whether the installed release is known to be vulnerable, names the patched tip on the site’s own release line, shows every offered release and marks the one core would choose. An authorized administrator can deliberately install the same-line patch through WordPress’s own upgrader with rollback enabled. The target and compatibility checks run again on the server, and nothing installs without a click.

The consistency is the point. Closing the REST API also removes the discovery link that advertises it; disabling comments also stops the comment feed and direct get_comments() queries. Where a trade is deliberate, Keel documents it instead of making a broader claim than the code can support.

Site Health reports the posture read-only: every default and its effective state, update operability, service failures, and traceable policy overlaps. If another plugin controls the same setting, Keel names the evidence it can establish and labels what it cannot attribute instead of guessing.