Kishan Jasani

<p>Coreline is a lightweight WordPress security and optimization plugin that provides essential hardening features for your WordPress installation. It follows clean code principles, PSR standards, and is designed to be testable, scalable, and maintainable.</p>
<h4>Features</h4>
<ul>
<li><strong>Emoji Script Removal</strong> – Removes WordPress emoji detection scripts to improve performance</li>
<li><strong>WordPress Version Hiding</strong> – Removes WordPress version numbers from HTML and RSS feeds for better security</li>
<li><strong>Custom Login URL</strong> – Changes wp-login.php to a custom URL (e.g., <code>/secure-login/</code>) to prevent automated brute-force attacks</li>
<li><strong>Hotlink Protection</strong> – Prevents other websites from hotlinking your images (works on both Apache and Nginx)</li>
<li><strong>Disable Pingbacks & Trackbacks</strong> – Disables XML-RPC pingbacks and trackbacks for improved security</li>
</ul>
<h4>Benefits</h4>
<ul>
<li>Lightweight and fast</li>
<li>No database queries overhead</li>
<li>Clean, PSR-compliant code</li>
<li>Fully tested and maintained</li>
<li>Compatible with all major themes and plugins</li>
</ul>
<h4>Developer Friendly</h4>
<p>Coreline is built with developers in mind:</p>
<ul>
<li>PSR-4 autoloading</li>
<li>WordPress Coding Standards compliant</li>
<li>PHPStan Level 8 verified</li>
<li>Fully filterable and extensible</li>
<li>Comprehensive inline documentation</li>
</ul>
<h3>Support</h3>
<p>For bug reports and feature requests, please visit <a href="https://github.com/kishanjasani/coreline/issues" rel="nofollow ugc">GitHub Issues</a></p>
<h3>License</h3>
<p>This plugin is licensed under the <a href="https://www.gnu.org/licenses/gpl-2.0.html" rel="nofollow ugc">GPLv2 or later</a>.</p>


Coreline

Essential hardening and cleanup for every WordPress site.

WordPress.org

<p>This plugin optimizes the loading of images (and videos) with prioritization to improve <a href="https://web.dev/articles/lcp" rel="nofollow ugc">Largest Contentful Paint</a> (LCP), lazy loading, and more accurate image size selection.</p>
<p>The current optimizations include:</p>
<ol>
<li>Add breakpoint-specific <code>fetchpriority=high</code> preload links (both as <code>LINK[rel=preload]</code> elements and <code>Link</code> response headers) for image URLs of LCP elements:
<ol>
<li>An <code>IMG</code> element, including the <code>srcset</code>/<code>sizes</code> attributes supplied as <code>imagesrcset</code>/<code>imagesizes</code> on the <code>LINK</code>.</li>
<li>The first <code>SOURCE</code> element with a <code>type</code> attribute in a <code>PICTURE</code> element. (Art-directed <code>PICTURE</code> elements using media queries are not supported.)</li>
<li>An element with a CSS <code>background-image</code> inline <code>style</code> attribute.</li>
<li>An element with a CSS <code>background-image</code> applied with a stylesheet (when the image is from an allowed origin).</li>
<li>A <code>VIDEO</code> element’s <code>poster</code> image.</li>
</ol>
</li>
<li>Ensure <code>fetchpriority=high</code> is only added to an <code>IMG</code> when it is the LCP element across all responsive breakpoints.</li>
<li>Add <code>fetchpriority=low</code> to <code>IMG</code> tags which appear in the initial viewport but are not visible, such as when they are subsequent carousel slides.</li>
<li>Lazy loading:
<ol>
<li>Apply lazy loading to <code>IMG</code> tags based on whether they appear in any breakpoint’s initial viewport.</li>
<li>Implement lazy loading of CSS background images added via inline <code>style</code> attributes.</li>
<li>Lazy-load <code>VIDEO</code> tags by setting the appropriate attributes based on whether they appear in the initial viewport. If a <code>VIDEO</code> is the LCP element, it gets <code>preload=auto</code>; if it is in an initial viewport, the <code>preload=metadata</code> default is left; if it is not in an initial viewport, it gets <code>preload=none</code>. Lazy-loaded videos also get initial <code>preload</code>, <code>autoplay</code>, and <code>poster</code> attributes restored when the <code>VIDEO</code> is going to enter the viewport.</li>
</ol>
</li>
<li>Responsive image sizes:
<ol>
<li>Ensure <a href="https://make.wordpress.org/core/2024/10/18/auto-sizes-for-lazy-loaded-images-in-wordpress-6-7/" rel="nofollow ugc"><code>sizes=auto</code></a> is set on <code>IMG</code> tags after setting correct lazy-loading (above).</li>
<li>~~Compute the <code>sizes</code> attribute using the widths of an image collected from URL Metrics for each breakpoint (when not lazy-loaded since then handled by <code>sizes=auto</code>).~~ (This has been removed due to an <a href="https://github.com/WordPress/performance/issues/2098" rel="nofollow ugc">issue</a>; use <a href="https://wordpress.org/plugins/auto-sizes/" rel="ugc">Enhanced Responsive Images instead</a>.)</li>
</ol>
</li>
<li>Reduce the size of the <code>poster</code> image of a <code>VIDEO</code> from full size to the size appropriate for the maximum width of the video (on desktop).</li>
</ol>
<p><strong>This plugin requires the <a href="https://wordpress.org/plugins/optimization-detective/" rel="ugc">Optimization Detective</a> plugin as a dependency.</strong> Please refer to that plugin for additional background on how this plugin works as well as additional developer options.</p>
<p>👉 <strong>Note:</strong> This plugin optimizes pages for actual visitors, and it depends on visitors to optimize pages. As such, you won’t see optimizations applied immediately after activating the plugin. Please wait for URL Metrics to be gathered for both mobile and desktop visits. And since administrator users are not normal visitors typically, optimizations are not applied for admins by default.</p>
<p>Your site must have the <strong>REST API accessible</strong> to unauthenticated frontend visitors since this is how metrics are collected about how a page should be optimized. There are currently <strong>no settings</strong> and no user interface for this plugin since it is designed to work without any configuration.</p>


Image Prioritizer

Prioritizes the loading of images and videos based on how they appear to actual visitors: adds fetchpriority, preloads, lazy-loads, and sets sizes.

Coreline vs Image Prioritizer