Compatibility

Every lock ships with defaults chosen so that turning it on does not break the things sites commonly run. The specifics:

WooCommerce and membership plugins

Registration Lockdown’s strictest layer — blocking accounts created by plugin code — is off by default, precisely because WooCommerce checkout and membership plugins create accounts that way. With the shipped defaults, a customer can still register at checkout while the administrator guard stays on. A test asserts a subscriber can still be created with defaults.

The cleanup tool treats WooCommerce data the same way: order notes, webhook logs, and product reviews are excluded from deletion unless you explicitly opt in — see comment cleanup.

Jetpack and remote publishing tools

The Jetpack mobile app and legacy remote publishing tools talk to your site over XML-RPC. If you use them, leave Disable XML-RPC off. Nothing else in the plugin touches that API.

Security plugins

Installation Lockdown freezes updates for everything — which would include your security plugin. Its allowlist exists for exactly this: name the plugins that should keep updating while everything else stays frozen.

The WordPress lockdown constants

DISALLOW_FILE_MODS and DISALLOW_FILE_EDIT still work, and WP Pro Admin never interferes with them. The plugin’s own locks are deliberately softer: they filter capabilities, so they can always be switched off from the settings screen instead of requiring file access. Run the constants if you want the hard version; the two approaches coexist.

Requirements and multisite

• WordPress 6.2 or newer, PHP 7.4 or newer.
• On multisite, uninstalling cleans up every site in the network, not just the current one.