---
title: Configuration
description: Every WP Pro Admin setting, feature by feature — what each switch does, what its options mean, and what the defaults are.
source: https://wpproadmin.com/docs/configuration/
---

Everything is configured from the **Pro Admin** screen in your admin menu. Each feature is
a single switch, off by default, and starts working the moment you turn it on. Changes save
as you make them — a "Changes saved" confirmation appears, and if a save fails, nothing is
changed.

Looking for a specific setting? Type in the **Filter settings** box at the top of the
sidebar — the feature list narrows as you type.

Every feature is instantly reversible: switch it off and your site behaves exactly as it
did before, with nothing to repair.

## Disable Comments

One switch, nothing else to configure — on purpose. Comment forms disappear, existing
comments are hidden (never deleted), direct bot POSTs to `wp-comments-post.php` and REST
comment creation are refused.

Below the switch is the plugin's one destructive tool, the **cleanup button**:

- By default it deletes only comments already marked spam or already in the trash.
- A separate checkbox extends it to approved and pending comments — never the default,
  always behind a confirmation.
- It shows the exact count before deleting, and deletes in batches so large sites can't
  time out.
- Comments on trashed posts are skipped — they return if the post is restored.

## Version Lock

This one isn't on the settings screen — it lives where the decision happens. Each row on
the **Plugins** screen gets a **Lock version** link. Locking a plugin removes it from the
update count, the Updates screen, and auto-updates.

The lock never blinds you: the settings screen lists every locked plugin with the pinned
version, the newest available version, and how far behind you are. An update that looks
like a security release is flagged rather than hidden, and if a locked plugin changes on
disk, the lock is reported as stale instead of silently re-pinning.

## Installation Lockdown

One switch freezes what is installed: no new plugins or themes, no uploads, no updates,
for anyone. Activating and deactivating what's already installed still works.

The **allowlist** below the switch is its one option: name a plugin or two that should
keep updating — typically your security plugin — while everything else stays frozen.

## Registration Lockdown

Stops new user accounts. Three layers, each its own setting:

- **Registration form** — forces "Anyone can register" off by filter, so it stays off even
  if something flips the database row directly.
- **Administrator guard** (on by default) — refuses creation of, or promotion to,
  administrator. This is the layer that stops an attacker's first move, and it leaves
  ordinary customer registration alone.
- **Plugin-code blocking** (off by default) — also blocks accounts created by plugin code.
  Leave this off if you run WooCommerce checkout or a membership plugin; it breaks them.

Blocked administrator attempts are recorded with the time and requested username.

## Disable XML-RPC

One switch. Closes every method at `xmlrpc.php`, including `pingback.ping` and
`system.multicall`, and stops the site advertising the API. Leave it off if you use the
Jetpack mobile app or a legacy remote publishing tool.

## Disable File Editing

One switch. Removes the built-in plugin and theme file editors. Implemented as a setting
rather than the `DISALLOW_FILE_EDIT` constant, so you can always switch it back off from
the same screen.

## Content tools — arriving in 2.2.0

The content tools ship in the 2.2.0 release. Their settings, briefly:

- **Duplicate** — choose which post types offer the one-click copy, and whether copying a
  page brings its child pages along.
- **Live Draft** — no options; each published page can have one private working copy, and
  publishing it is the merge.
- **Keep URL** — no options while on; renamed and moved pages keep answering on their old
  addresses. Recorded redirects are listed on the settings screen and can be removed one
  at a time.
- **Order** — enabled one post type at a time. Lists that already ask for a specific
  order (WooCommerce, search results) are always left alone.
- **Replace Media** — replaced files keep their previous version for 30 days so a mistaken
  replace can be undone.