websitefixcom

<p>You’ve heard “you should throttle the Heartbeat API” or “xmlrpc.php should probably be disabled”? But every time you end up in a forum thread with 12 conflicting code snippets, three of which will wreck your site.</p>
<p><strong>WebsiteFix One-Click Optimizer</strong> solves exactly this problem. Seven hand-curated performance and security fixes, each with auto-safety-check (automatically detects conflicting plugins and does NOT intervene), each one-click-activatable and just as one-click reversible.</p>
<h4>The 7 Fixes</h4>
<p><strong>1. Throttle the Heartbeat API</strong><br />
Reduces the WordPress Heartbeat frequency contextually: 60s in the admin, 120s in the post editor (instead of 15s), practically off on the frontend. Typical savings: 75–85% less admin-ajax.php load <span aria-hidden="true" class="wp-exclude-emoji">→</span> lower CPU throttling at your host, significantly lower TTFB value.</p>
<p><strong>2. Disable XML-RPC & Pingbacks</strong><br />
Closes the XML-RPC endpoint (by far the most common brute-force attack target on WordPress) and disables outbound pingbacks. Auto-safety-check: if Jetpack, Wordfence, or Sucuri are active, the fix does NOT intervene — you don’t have to choose between security plugin and xmlrpc hardening. Plus REST API user enumeration protection for anonymous requests.</p>
<p><strong>3. Remove Emojis & oEmbed Discovery</strong><br />
Removes the WordPress emoji polyfill scripts (<code>wp-emoji-release.min.js</code>, ~14 KB) and the oEmbed auto-discovery routes. Saves 2–3 HTTP requests per page load. URL embeds in the editor remain functional — only public discovery is turned off.</p>
<p><strong>4. Strip Query Strings from Static Assets</strong><br />
Strips <code>?ver=…</code> from CSS/JS asset paths. Proxy and CDN caches (Cloudflare, host caches) can now cleanly cache the assets. Auto-safety-check: with WP Rocket / W3 Total Cache / WP Super Cache, the fix does NOT intervene — caching plugins handle this themselves.</p>
<p><strong>5. Remove jQuery Migrate from Frontend</strong><br />
Removes <code>jquery-migrate.min.js</code> (~11 KB) from the frontend but keeps it active in the admin. On modern themes (2020+), Migrate is unnecessary. Lighthouse Performance score typically increases by 1–3 points.</p>
<p><strong>6. Block Author Archives (User Enumeration Protection)</strong><br />
Prevents username discovery via <code>/?author=N</code> or <code>/author/<name>/</code>. Auto-safety-check: if Yoast already has Author Archives disabled, the fix does not intervene. The most well-known brute-force prep trick is neutralized — calls are 301-redirected to the homepage. Additionally: REST API user-individual endpoints blocked for anonymous calls.</p>
<p><strong>7. Hide WordPress Version from Frontend</strong><br />
Removes the <code><meta name="generator"></code> tag from the HTML head, from the RSS feed, and from asset URL <code>?ver=</code> strings. External scanners and brute-force bots can no longer directly identify the exact WordPress version — version-specific exploit-sweep attacks become more expensive. Auto-safety-check: if Wordfence / Sucuri / All-in-One Security / Perfmatters are active, the fix does not intervene (they handle this themselves).</p>
<h4>How It Works Technically</h4>
<p>When you activate a fix, the plugin writes a single PHP file to <code>/wp-content/mu-plugins/wf-optimizer-<fix-slug>.php</code>. WordPress automatically loads must-use plugins <strong>before all regular plugins</strong> — no activation workflow needed, no reload trick, the fix takes effect immediately.</p>
<p>When you deactivate, the file is deleted. Standard WordPress behavior returns immediately. When you uninstall the plugin itself, ALL fix files are automatically removed.</p>
<p><strong>We NEVER edit your functions.php.</strong> We do not touch theme files, wp-config.php, or existing plugins. Each fix is isolated in its own file — you can inspect them yourself, and you can just as easily delete them manually if you don’t want to use the plugin anymore.</p>
<p>All filesystem operations go through the WordPress WP_Filesystem API (<code>put_contents</code>, <code>delete</code>, <code>is_writable</code>, etc.) — no direct PHP filesystem calls.</p>
<h4>What It Does NOT Do</h4>
<ul>
<li>Writes nothing to your database (a single <code>wp_options</code> entry with the list of active fixes is the exception — ~50 bytes).</li>
<li>Modifies no theme files, no functions.php, no wp-config.php.</li>
<li>Does not automatically deactivate existing plugins — auto-safety-check detects conflicts and skips the fix.</li>
<li>Sends no user data to external servers. Fully offline-capable.</li>
<li>Shows no ad banners, no nag screen, no trial expiration.</li>
</ul>
<h4>Who Is Behind This</h4>
<p>WebsiteFix is a WordPress diagnostic tool developed in Frankfurt, Germany. The seven snippets are ported 1:1 from our free Smart Fix Library at <a href="https://website-fix.com/smart-fix-library" rel="nofollow ugc">website-fix.com/smart-fix-library</a>. The plugin is open source under GPL. Feedback/bugs: support@website-fix.com.</p>
<h4>Auf Deutsch / In German</h4>
<p>Sieben kuratierte WordPress-Performance- und Security-Fixes mit einem Klick aktivierbar. Jeder Fix kommt mit Safety-Check (erkennt konfligierende Plugins automatisch und greift dann NICHT ein). Aktivierte Fixes werden als Must-Use-Plugin-Datei in <code>/wp-content/mu-plugins/</code> mit dem Präfix <code>wf-optimizer-</code> abgelegt — kein Theme-Edit, kein Reload-Workaround, sofortige Rückgängig-Möglichkeit. Read-only-Verbindung zu deiner Datenbank — nur ein einziger <code>wp_options</code>-Eintrag mit ~50 Bytes wird gespeichert. Die sieben Snippets sind 1:1 aus unserer kostenlosen Smart-Fix-Library auf website-fix.com portiert.</p>
<h3>Want a free diagnosis before fixing?</h3>
<p>If you’re not sure which of the 7 fixes you actually need — start with a free 60-second scan of your live site at <a href="https://website-fix.com/plugin/optimizer" rel="nofollow ugc">website-fix.com/plugin/optimizer</a>. It runs from outside (no FTP, no login, no admin access required) and tells you exactly which performance leaks are draining your hosting plan:</p>
<ul>
<li>Heartbeat API hammering your CPU? Yes/No, with the live frequency.</li>
<li>XML-RPC open to brute force? Yes/No, with the current attack surface.</li>
<li>Author archives leaking usernames? Yes/No, with the exposed names.</li>
<li>jQuery Migrate still loading in your frontend? Yes/No, with the wasted KB.</li>
</ul>
<p>You get a personalized “activate these 3 first” recommendation — instead of guessing. The scan is free, no signup, no email wall before the result.</p>
<p>After the scan: come back here, hit “Apply” on the matching fix in the plugin’s Tools page, done. Two free tools, one workflow.</p>
<p>Want the deeper 92-point audit (database bloat tables, PHP error stack traces, hook-chain conflicts, slow query log)? That’s at <a href="https://website-fix.com" rel="nofollow ugc">website-fix.com</a> — same place, same no-login policy. Use this plugin for the surface fixes, use the online tool for the diagnosis that needs more than a heuristic.</p>
<h4>Auf Deutsch</h4>
<p>Wenn du nicht sicher bist, welche der 7 Optimierungen du wirklich brauchst, starte mit dem kostenlosen 60-Sekunden-Scan auf <a href="https://website-fix.com/plugin/optimizer" rel="nofollow ugc">website-fix.com/plugin/optimizer</a>. Der Scan läuft extern — kein FTP, kein Login, kein Backend-Zugang — und zeigt dir konkret, welche Performance-Lecks deinen Hosting-Plan ausquetschen. Du bekommst eine “diese 3 zuerst aktivieren”-Empfehlung statt zu raten. Kostenlos, keine Anmeldung, keine E-Mail-Wall vor dem Ergebnis.</p>


WebsiteFix One-Click Performance Optimizer

Activate 7 WordPress performance and security fixes with one click. Safe, reversible, no code editing required.

David Matthew

<p>TrimPress optimizes and trims some of the cruft from WordPress for a lighter, more secure theme!</p>
<h3>Features</h3>
<ul>
<li>Slow down the Heartbeat API to save on admin-ajax usage.</li>
<li>Disable cart fragments, a resource-intensive WooCommerce script (TrimPress automatically detects WooCommerce and only shows this option if it is active).</li>
<li>Remove unnecessary clutter from the WordPress  section, like RSS, RSD, WLW manifest and adjacent post links.</li>
<li>Disable the built-in WordPress code editors that allow users to modify plugin and theme code.</li>
<li>Limit post revisions, which can cause unnecessary database bloat.</li>
<li>Disable automatic emoji rendering, which adds several extra scripts and styles to your site.</li>
<li>Disable the XML-RPC interface, an older system for remote WordPress access that can be exploited by hackers. </li>
<li>Remove the meta generator tag and version url parameters that let potential attackers know what WordPress version you’re using.</li>
<li>Disable comment autolinking, a feature often exploited by spammers.</li>
</ul>
<h3>Development</h3>
<ul>
<li>Namespaced and object-oriented code.</li>
<li>Adheres to <a href="https://github.com/WordPress/WordPress-Coding-Standards" rel="nofollow ugc">WordPress Coding Standards</a>.</li>
</ul>


TrimPress

TrimPress optimizes and trims some of the cruft from WordPress for a lighter, more secure theme!

WebsiteFix One-Click Performance Optimizer vs TrimPress