Configuration

Everything is configured from the Pro Admin screen in your admin menu. Each feature is a single switch, off by default, and starts working the moment you turn it on. Changes save as you make them — a “Changes saved” confirmation appears, and if a save fails, nothing is changed.

Looking for a specific setting? Type in the Filter settings box at the top of the sidebar — the feature list narrows as you type.

Every feature is instantly reversible: switch it off and your site behaves exactly as it did before, with nothing to repair.

Disable Comments

One switch, nothing else to configure — on purpose. Comment forms disappear, existing comments are hidden (never deleted), direct bot POSTs to wp-comments-post.php and REST comment creation are refused.

Below the switch is the plugin’s one destructive tool, the cleanup button:

• By default it deletes only comments already marked spam or already in the trash.
• A separate checkbox extends it to approved and pending comments — never the default, always behind a confirmation.
• It shows the exact count before deleting, and deletes in batches so large sites can’t time out.
• Comments on trashed posts are skipped — they return if the post is restored.

Version Lock

This one isn’t on the settings screen — it lives where the decision happens. Each row on the Plugins screen gets a Lock version link. Locking a plugin removes it from the update count, the Updates screen, and auto-updates.

The lock never blinds you: the settings screen lists every locked plugin with the pinned version, the newest available version, and how far behind you are. An update that looks like a security release is flagged rather than hidden, and if a locked plugin changes on disk, the lock is reported as stale instead of silently re-pinning.

Installation Lockdown

One switch freezes what is installed: no new plugins or themes, no uploads, no updates, for anyone. Activating and deactivating what’s already installed still works.

The allowlist below the switch is its one option: name a plugin or two that should keep updating — typically your security plugin — while everything else stays frozen.

Registration Lockdown

Stops new user accounts. Three layers, each its own setting:

• Registration form — forces “Anyone can register” off by filter, so it stays off even if something flips the database row directly.
• Administrator guard (on by default) — refuses creation of, or promotion to, administrator. This is the layer that stops an attacker’s first move, and it leaves ordinary customer registration alone.
• Plugin-code blocking (off by default) — also blocks accounts created by plugin code. Leave this off if you run WooCommerce checkout or a membership plugin; it breaks them.

Blocked administrator attempts are recorded with the time and requested username.

Disable XML-RPC

One switch. Closes every method at xmlrpc.php, including pingback.ping and system.multicall, and stops the site advertising the API. Leave it off if you use the Jetpack mobile app or a legacy remote publishing tool.

Disable File Editing

One switch. Removes the built-in plugin and theme file editors. Implemented as a setting rather than the DISALLOW_FILE_EDIT constant, so you can always switch it back off from the same screen.

Content tools — arriving in 2.2.0

The content tools ship in the 2.2.0 release. Their settings, briefly:

• Duplicate — choose which post types offer the one-click copy, and whether copying a page brings its child pages along.
• Live Draft — no options; each published page can have one private working copy, and publishing it is the merge.
• Keep URL — no options while on; renamed and moved pages keep answering on their old addresses. Recorded redirects are listed on the settings screen and can be removed one at a time.
• Order — enabled one post type at a time. Lists that already ask for a specific order (WooCommerce, search results) are always left alone.
• Replace Media — replaced files keep their previous version for 30 days so a mistaken replace can be undone.