Frequently asked questions
Straight answers, including the ones that admit a limitation. More detail lives in the docs.
Will this delete my comments?
Not unless you ask it to. Turning Disable Comments on only hides them — a test asserts the comment rows are untouched after a full enable-and-disable cycle.
There is a separate cleanup button that does delete, and it deletes spam and trashed comments only unless you tick the box to include approved ones. It shows the exact count, asks you to confirm, and cannot be undone.
Can I turn it back off?
Yes, instantly. Every feature works through WordPress filters, so nothing was written to your database to undo. Disable the feature and your site is exactly as it was.
Does this actually stop comment spam bots?
Yes. Bots usually POST straight to wp-comments-post.php without ever loading your page, so hiding the comment form does nothing. Adminkeep refuses those requests with a 403 before WordPress processes them, and refuses comment creation through the REST API as well.
Is Installation Lockdown a security feature?
Not exactly, and it would be dishonest to say otherwise. It is enforced in PHP, so anyone with filesystem, database or WP-CLI access can bypass it.
It reliably stops accidents and casual changes — a client installing something on a whim, or uploading a plugin zip from who knows where. Treat it as a policy guard, not a security boundary.
Why not just use the DISALLOW_FILE_MODS constant?
Because it cannot be switched off from the admin. Once it is in wp-config.php you need file access to undo it, which strands people. Installation Lockdown filters capabilities instead, so you can always turn it off from the settings screen.
If you want the harder version, the constant is still there and this plugin does not interfere with it.
Is Adminkeep on wordpress.org?
Yes. In your WordPress admin go to Plugins → Add New Plugin, search for "Adminkeep" and install it from there. Updates arrive through the normal WordPress Updates screen.
Adminkeep was called WP Pro Admin before it joined the directory. It is the same plugin under a new name.