Frequently asked questions
Straight answers, including the ones that admit a limitation. More detail lives in the docs.
Will this delete my comments?
Not unless you ask it to. Turning Disable Comments on only hides them — a test asserts the comment rows are untouched after a full enable-and-disable cycle.
There is a separate cleanup button that does delete, and it deletes spam and trashed comments only unless you tick the box to include approved ones. It shows the exact count, asks you to confirm, and cannot be undone.
Can I turn it back off?
Yes, instantly. Every feature works through WordPress filters, so nothing was written to your database to undo. Disable the feature and your site is exactly as it was.
Does this actually stop comment spam bots?
Yes. Bots usually POST straight to wp-comments-post.php without ever loading your page, so hiding the comment form does nothing. WP Pro Admin refuses those requests with a 403 before WordPress processes them, and refuses comment creation through the REST API as well.
If I lock a plugin, will I miss a security update?
You will still be told about it. The settings screen lists every locked plugin with its pinned version, the latest available version, and a flag when the pending update looks like a security release.
Detection is best-effort from the release notes, so treat it as a prompt to look rather than a guarantee — but the plugin will never quietly hide it from you.
Is Installation Lockdown a security feature?
Not exactly, and it would be dishonest to say otherwise. It is enforced in PHP, so anyone with filesystem, database or WP-CLI access can bypass it.
It reliably stops accidents and casual changes — a client installing something on a whim, an update applied without thinking. Treat it as a policy guard, not a security boundary.
Why not just use the DISALLOW_FILE_MODS constant?
Because it cannot be switched off from the admin. Once it is in wp-config.php you need file access to undo it, which strands people. Installation Lockdown filters capabilities instead, so you can always turn it off from the settings screen.
If you want the harder version, the constant is still there and this plugin does not interfere with it.
Is WP Pro Admin on wordpress.org?
Not yet — submission is planned. Until then, download it from this site and install the zip; the plugin updates itself through the normal WordPress Updates screen either way.
Will there be a paid version later?
A paid tier may exist one day, but everything described on this site stays free, and no feature will be removed from the free version to create one.