=== Adminkeep – Disable Comments, Duplicate Posts & Site Lockdown ===
Contributors: sajib1223
Tags: disable comments, duplicate post, lockdown, replace media
Requires at least: 6.9
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.6.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Disable comments, freeze plugin installs, duplicate posts and rewrite published pages safely. Every feature is one switch, off until you turn it on.

== Description ==

You decide what changes on this site.

Adminkeep is a set of tools under that one idea. **Site Lock** stops things changing behind
your back — no new comment, no new plugin, no new user. **Content** makes the changes you do want
safe to make.

Every feature is a single switch, off until you turn it on. **Switching one off never leaves you
repair work**: the locks work purely through WordPress filters, so your site is exactly as it was,
and what you made with the Content features stays where you put it.

= Site Lock =

* **Disable Comments** — comments off everywhere, including direct POSTs from spam bots and the REST API. Nothing is written to your database, so switching it off brings every comment back. An optional cleanup button deletes spam and trashed comments, after showing you the exact count. [Guide](https://adminkeep.com/guides/disable-comments-wordpress/)
* **Registration Lockdown** — stops new accounts being created, and refuses creation of or promotion to administrator. Blocked attempts are logged. [Guide](https://adminkeep.com/guides/stop-spam-user-registration-wordpress/)
* **Disable XML-RPC** — closes `xmlrpc.php` completely, including pingbacks and `system.multicall`. [Guide](https://adminkeep.com/guides/disable-xmlrpc-wordpress/)
* **Disable File Editing** — removes the built-in plugin and theme file editors, reversibly.
* **Installation Lockdown** — no new plugins or themes, no uploads, for anyone. Updates keep working, so security releases still reach your site. [Guide](https://adminkeep.com/guides/block-plugin-installs-wordpress/)

= Content =

* **Duplicate** — copy any post or page as a draft. Custom fields, taxonomies, the featured image and page builder layouts (Elementor, ACF) come along intact, and the original is never modified. [Guide](https://adminkeep.com/guides/duplicate-page-wordpress/)
* **Live Draft** — rework a published page in a private working copy, then publish it over the original. Same ID, same URL, and the old version is kept as a revision. [Guide](https://adminkeep.com/guides/edit-published-page-without-unpublishing/)
* **Keep URL** — rename or move a page and its old address keeps working, child pages included. Fills the gaps WordPress leaves for pages and leaves posts to core. [Guide](https://adminkeep.com/guides/change-wordpress-slug-redirect/)
* **Order** — drag posts into the order you want on a dedicated Sort screen, one post type at a time. Lists that already ask for their own order, such as WooCommerce products and search results, are left alone. [Guide](https://adminkeep.com/guides/reorder-wordpress-posts/)
* **Replace Media** — upload a new version of a file over the old one. Same file type keeps the same URL; a different type updates the posts that use it and redirects the old address. [Guide](https://adminkeep.com/guides/replace-image-wordpress-same-url/)

= Appearance =

* **Custom CSS** — CSS that belongs to your site instead of your theme. Edit it under Appearance with WordPress's own code editor; it stays when you switch themes, and your theme's Additional CSS is left alone.

= Admin =

* **User Registration Date** — a sortable Registered column on the Users screen. WordPress records when every account was created but never shows it; this does, for every existing user, and newest-first sorting makes a wave of spam signups easy to spot. [Guide](https://adminkeep.com/guides/wordpress-user-registration-date/)

= Email =

* **SMTP** — Send your site's email through an SMTP server so password resets and form messages arrive. Presets for Amazon SES, Brevo, Mailgun, SendGrid, Postmark, Zoho and Gmail; a test email that shows the server's own error; settings can live in wp-config.php. [Guide](https://adminkeep.com/guides/wordpress-smtp-settings/)

= Performance =

A feature you have not enabled registers zero hooks and loads zero assets.

= Links =

* [Website](https://adminkeep.com/)
* [Documentation](https://adminkeep.com/docs/)
* [Guides](https://adminkeep.com/guides/)

== Installation ==

1. In your WordPress admin, go to **Plugins → Add New Plugin**, search for "Adminkeep" and click **Install Now**, then **Activate**.
2. Open the new **Adminkeep** menu item. Every feature starts **off**; switch on only the ones you want.
3. To remove the plugin, deactivate and delete it as usual. Uninstalling removes its settings and its own redirect table. Nothing it changed while enabled outlives switching the feature off.

Or with WP-CLI:

`wp plugin install adminkeep --activate`

== WP-CLI ==

Everything on the Adminkeep settings screen, plus the Custom CSS and SMTP screens, can be done from a shell with `wp adminkeep`.

`wp adminkeep feature list` — every feature and whether it is on
`wp adminkeep feature enable disable_comments` — switch a feature on (or `disable` it)
`wp adminkeep feature set order post_types=post,page` — change a feature's settings
`wp adminkeep comments purge` — delete spam and trashed comments, in batches
`wp adminkeep css set site.css` — replace the Custom CSS from a file
`wp adminkeep smtp set --host=smtp.example.com --port=587` — configure SMTP
`wp adminkeep smtp test you@example.com` — send a test email and see the server's reply

Run `wp help adminkeep` for the full reference. A change made here is cleaned and checked exactly as it is on the screen, and a mistyped value is refused rather than guessed at.

== Frequently Asked Questions ==

= Will this delete my comments? =

Not unless you ask it to. Turning Disable Comments on only hides them — a test asserts the comment
rows are untouched after a full enable-and-disable cycle.

There is a separate cleanup button that does delete, and it deletes **spam and trashed comments
only** unless you tick the box to include approved ones. It shows the exact count, asks you to
confirm, and cannot be undone.

= Can I turn it back off? =

Yes, instantly. There is never a migration to run or a repair step to find.

The locks work purely through WordPress filters, so nothing was written to your database to undo —
switch one off and your site is exactly as it was. The Content features are deliberately different:
they write the things you asked them to write. A copy you made, an order you saved, a file you
replaced, a redirect recorded when you renamed a page — switching the feature off stops it doing
any more, and leaves what it already did alone. Work you did on purpose should not disappear
because you unticked a checkbox.

= Does this actually stop comment spam bots? =

Yes. Bots usually POST straight to `wp-comments-post.php` without ever loading your page, so
hiding the comment form does nothing. Adminkeep refuses those requests with a 403 before
WordPress processes them, and refuses comment creation through the REST API as well.

= Is Installation Lockdown a security feature? =

Not exactly, and it would be dishonest to say otherwise. It is enforced in PHP, so anyone with
filesystem, database or WP-CLI access can bypass it. It reliably stops accidents and casual
changes — a client installing something on a whim, or uploading a plugin zip from who knows where. Treat it
as a policy guard, not a security boundary.

= Why not just use the DISALLOW_FILE_MODS constant? =

Because it cannot be switched off from the admin. Once it is in `wp-config.php` you need file
access to undo it, which strands people. Installation Lockdown filters capabilities instead, so
you can always turn it off from the settings screen. If you want the harder version, the constant
is still there and this plugin does not interfere with it.

= Does the SMTP feature work with Gmail or Microsoft 365? =

Gmail and Google Workspace: yes, with an app password. Microsoft 365 and Outlook.com: no — Microsoft now requires signing in through Microsoft (OAuth) for SMTP, which this feature does not support. A dedicated SMTP plugin is the better choice there.

= Where is my SMTP password kept? =

Encrypted in your site's database, which protects it in database backups. For the strongest setup define ADMINKEEP_SMTP_PASS (and the other ADMINKEEP_SMTP_* constants) in wp-config.php: values set there are not saved to the database, and the settings form does not display them.

= Can I manage Adminkeep with WP-CLI? =

Yes, since 1.5.0. `wp adminkeep feature list` shows every feature, and `wp help adminkeep` lists the commands for switching features, changing their settings, cleaning up comments, replacing the Custom CSS and configuring SMTP. If Installation Lockdown has locked you out of the admin, `wp adminkeep feature disable install_lock` is the way back in.

== Screenshots ==

1. Five groups, thirteen features, one switch each. Turn on only what you need.
2. Nothing is deleted until you have seen the exact count. Order notes and reviews are excluded unless you say otherwise.
3. Duplicate and Live Draft where you already work — the row actions, not a new menu.
4. Swapping a file for a different format tells you what references it first, then keeps the old URL redirecting.
5. Sorting gets a screen of its own: drag a row where you want it — and the order applies to your front-end queries too.
6. Rewrite a published page while it stays published. Merge back into the same post, same URL.
7. The administrator guard is on by default. Blocking plugin-created accounts is opt-in, because it breaks WooCommerce checkout.
8. Stop plugin and theme installs and uploads, while updates keep working — and switch it back off from this same screen.
9. The redirects WordPress core skips: hierarchical pages, and posts moved to a new parent.
10. Custom CSS lives under Appearance, in WordPress's own code editor, and stays when you switch themes.
11. SMTP under Settings: pick a provider, save, and send a test email that shows what the server said.

== Changelog ==

= 1.6.0 =
* New: "Hide unused features" on the settings page. Switch it on and the menu lists only the features you use. Search still finds the rest, and each administrator has their own setting.
* Improved: the Overview lists the features you have switched on first, and its "features enabled" count updates as soon as you save.
* Improved: the Registered column on the Users screen is narrower and shows a short month (Jan 10, 2024).
* Fixed: the SMTP test email was sent twice.
* Fixed: notices from other plugins were squeezed into the Adminkeep header on the settings page. They now sit above it.
* Fixed: after switching on Custom CSS or SMTP, the link to its screen appears as soon as you save, without reloading.
* Fixed: the settings filter only searched the first group.

= 1.5.0 =
* New: WP-CLI. `wp adminkeep` switches features on and off, changes their settings, cleans up comments, replaces the Custom CSS, configures SMTP and sends a test email. Run `wp help adminkeep` to see every command.

= 1.4.0 =
* New: SMTP, in a new Email group. Send your site's email through any SMTP server, with provider presets, a test email that shows the server's own reply, and settings that can live in wp-config.php.
* Changed: screens Adminkeep adds elsewhere in the admin (SMTP, Custom CSS, Order, Replace file) now carry a small Adminkeep mark at the start of the heading, linking to the Adminkeep settings. The settings page shows the mark too.

= 1.3.0 =
* New: User Registration Date — a sortable Registered column on the Users screen, in a new Admin group. It uses the date WordPress already stores, so every existing user has one.
* Changed: the switch on each panel now reads "Enable this feature".
* Removed: the Overview note about Version Lock leaving in 1.1.0.

= 1.2.0 =
* New: Custom CSS — site-level front-end CSS under Appearance → Custom CSS. It belongs to the site, not the theme, so it stays when you switch themes.
* Changed: internal names now match the plugin name. Settings and redirects are carried over automatically.
* Changed: plugin and author links now point to adminkeep.com.

= 1.1.0 =
* Initial release.