Site Cleanup Controls

Site Cleanup Controls gives developers and site owners fine-grained control over 35+ WordPress features that are often unnecessary. Each feature has a simple on/off toggle, organised into five logical groups inside Settings -> Site Cleanup Controls.

No features are enabled by default — activate only what you need.

Security

• User Enumeration — Block ?author=N redirect attacks that expose usernames.
• Author Archives — Return 404 for author archive pages.
• XML-RPC + Pingback — Fully disable the XML-RPC endpoint and remove the X-Pingback header.
• Plugin and Theme Editor — Set DISALLOW_FILE_EDIT to prevent in-admin file editing.
• Application Passwords — Disable the Application Passwords feature.
• REST API — Restrict REST API access to authenticated users only.
• Right Click — Disable the browser context menu on the frontend.

Performance

• Emojis — Remove all emoji scripts, styles, and DNS prefetch hints.
• Embed Objects — Disable WordPress oEmbed and embed scripts.
• Dashicons — Prevent Dashicons from loading for non-logged-in visitors.
• Heartbeat — Deregister the Heartbeat API script.
• Block Library CSS — Remove wp-block-library and global-styles stylesheets on the frontend.
• Version Var (?ver=) — Strip ?ver= query strings from enqueued asset URLs.
• PDF Thumbnails — Skip thumbnail generation for uploaded PDF files.
• oEmbed — Remove oEmbed discovery links and disable autoembed.
• Remote Block Patterns — Stop WordPress fetching patterns from api.wordpress.org.

Head Cleanup

• Generator Meta Tag — Remove the WordPress version meta tag from head.
• WLW Manifest — Remove the Windows Live Writer manifest link.
• Really Simple Discovery (RSD) — Remove the RSD link tag.
• Short Link — Remove the shortlink tag and HTTP header.
• Adjacent Posts Links — Remove prev/next link tags from single post heads.
• RSS Feeds — Redirect all feed URLs to the homepage.

Admin Cleanup

• capital_P_dangit — Remove WordPress forced capitalisation filter.
• Screen Options and Help Tabs — Hide Screen Options and Help dropdowns.
• Howdy to Welcome — Replace “Howdy,” with “Welcome,” in the admin bar.
• Navigation Items in Admin Bar — Remove WP logo, site name, updates, and comments.
• Clean Dashboard — Remove all default dashboard widgets.
• Privacy Tools — Hide Export/Erase Personal Data from the Tools menu.
• Site Health Page — Hide Site Health from the Tools menu.
• WP Login Logo and Favicon — Hide the WordPress logo on the login page.
• Admin Email Verification Prompt — Disable the admin email confirm interstitial.
• Empty Trash (1 week) — Shorten automatic trash-emptying from 30 days to 7 days.

Content

• Comments — Disable comments sitewide.
• Post Revisions — Disable revision storage.
• Search — Redirect all search queries to the homepage.